H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

MechaFlounder

[MechaFlounder](https://attack.mitre.org/software/S0459) is a python-based remote access tool (RAT) that has been used by [APT39](https://attack.mitre.org/groups/G0087). The payload uses a combination of actor developed code and code snippets freely available online in development communities.(Citation: Unit 42 MechaFlounder March 2019)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[MechaFlounder](https://attack.mitre.org/software/S0459) is a python-based remote access tool (RAT) that has been used by [APT39](https://attack.mitre.org/groups/G0087). The payload uses a combination of actor developed code and code snippets freely available online in development communities.(Citation: Unit 42 MechaFlounder March 2019)

Labels

malware
9 recorded

Relationships

uses
from APT39
Group
uses
to Exfiltration Over C2 Channel
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Match Legitimate Resource Name or Location
Technique
uses
to Python
Technique
uses
to Standard Encoding
Technique
uses
to System Owner/User Discovery
Technique
uses
to Web Protocols
Technique
uses
to Windows Command Shell
Technique
2 external

References

mitre-attack
S0459
open
Unit 42 MechaFlounder March 2019
https://unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance