H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[CozyCar](https://attack.mitre.org/software/S0046) is malware that was used by [APT29](https://attack.mitre.org/groups/G0016) from 2010 to 2015. It is a modular malware platform, and its backdoor component can be instructed to download and execute a variety of modules with different functionality. (Citation: F-Secure The Dukes)

Labels

malware

15 recorded

Relationships

uses

from APT29

Group

uses

to Bidirectional Communication

Technique

uses

to Encrypted/Encoded File

Technique

uses

to LSASS Memory

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Rename Legitimate Utilities

Technique

uses

Technique

uses

to Scheduled Task

Technique

uses

to Security Account Manager

Technique

uses

to Security Software Discovery

Technique

uses

to System Information Discovery

Technique

uses

to Virtualization/Sandbox Evasion

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Service

Technique

2 external

References

mitre-attack

S0046

F-Secure The Dukes

https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf