H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[HTTPBrowser](https://attack.mitre.org/software/S0070) is malware that has been used by several threat groups. (Citation: ThreatStream Evasion Analysis) (Citation: Dell TG-3390) It is believed to be of Chinese origin. (Citation: ThreatConnect Anthem)

Labels

malware

13 recorded

Relationships

uses

from APT18

Group

uses

to DLL

Technique

uses

to DNS

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

from Threat Group-3390

Group

5 external

References

mitre-attack

S0070

HttpDump

—

ThreatStream Evasion Analysis

https://www.threatstream.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop

Dell TG-3390

https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage

ThreatConnect Anthem

https://www.threatconnect.com/the-anthem-hack-all-roads-lead-to-china/