H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

DOWNIISSA

[DOWNIISSA](https://attack.mitre.org/software/S9021) is a shellcode downloader that has been used by [MirrorFace](https://attack.mitre.org/groups/G1054) since at least 2022 to deploy payloads, including the [LODEINFO](https://attack.mitre.org/software/S9020) backdoor.(Citation: Kaspersky LODEINFO OCT 2022)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[DOWNIISSA](https://attack.mitre.org/software/S9021) is a shellcode downloader that has been used by [MirrorFace](https://attack.mitre.org/groups/G1054) since at least 2022 to deploy payloads, including the [LODEINFO](https://attack.mitre.org/software/S9020) backdoor.(Citation: Kaspersky LODEINFO OCT 2022)

Labels

malware
8 recorded

Relationships

uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Encrypted/Encoded File
Technique
uses
to File Deletion
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Msiexec
Technique
uses
to Native API
Technique
uses
to Process Injection
Technique
uses
from MirrorFace
Group
2 external

References

mitre-attack
S9021
open
Kaspersky LODEINFO OCT 2022
https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance