H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[TURNEDUP](https://attack.mitre.org/software/S0199) is a non-public backdoor. It has been dropped by [APT33](https://attack.mitre.org/groups/G0064)'s [StoneDrill](https://attack.mitre.org/software/S0380) malware. (Citation: FireEye APT33 Sept 2017) (Citation: FireEye APT33 Webinar Sept 2017)

Labels

malware

7 recorded

Relationships

uses

from APT33

Group

uses

to Asynchronous Procedure Call

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Screen Capture

Technique

uses

to System Information Discovery

Technique

uses

to Windows Command Shell

Technique

4 external

References

mitre-attack

S0199

TURNEDUP

—

FireEye APT33 Sept 2017

https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html

FireEye APT33 Webinar Sept 2017

https://www.brighttalk.com/webcast/10703/275683