H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Kevin](https://attack.mitre.org/software/S1020) is a backdoor implant written in C++ that has been used by [HEXANE](https://attack.mitre.org/groups/G1001) since at least June 2020, including in operations against organizations in Tunisia.(Citation: Kaspersky Lyceum October 2021)

Labels

malware

22 recorded

Relationships

uses

Group

uses

to Data from Local System

Technique

uses

Technique

uses

to Data Transfer Size Limits

Technique

uses

to DNS

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Fallback Channels

Technique

uses

to File Deletion

Technique

uses

to Hidden Window

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

Technique

uses

to Protocol Tunneling

Technique

uses

to Rename Legitimate Utilities

Technique

uses

to Standard Encoding

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to Virtualization/Sandbox Evasion

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation Event Subscription

Technique

2 external

References

mitre-attack

S1020

Kaspersky Lyceum October 2021

https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf