H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Cannon](https://attack.mitre.org/software/S0351) is a Trojan with variants written in C# and Delphi. It was first observed in April 2018. (Citation: Unit42 Cannon Nov 2018)(Citation: Unit42 Sofacy Dec 2018)

Labels

malware

12 recorded

Relationships

uses

from APT28

Group

uses

to Exfiltration Over C2 Channel

Technique

uses

to File and Directory Discovery

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Local Storage Discovery

Technique

uses

to Mail Protocols

Technique

uses

to Process Discovery

Technique

uses

to Screen Capture

Technique

uses

to System Information Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Time Discovery

Technique

uses

to Winlogon Helper DLL

Technique

4 external

References

mitre-attack

S0351

open

Cannon

—

Unit42 Cannon Nov 2018

https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/

open

Unit42 Sofacy Dec 2018

https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/

open