H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Helminth](https://attack.mitre.org/software/S0170) is a backdoor that has at least two variants - one written in VBScript and PowerShell that is delivered via a macros in Excel spreadsheets, and one that is a standalone Windows executable. (Citation: Palo Alto OilRig May 2016)

Labels

malware

22 recorded

Relationships

uses

to Automated Collection

Technique

uses

to Clipboard Data

Technique

uses

to Code Signing

Technique

uses

to Data Transfer Size Limits

Technique

uses

to DNS

Technique

uses

to Domain Groups

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Local Data Staging

Technique

uses

to Local Groups

Technique

uses

Technique

uses

to Process Discovery

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Scheduled Task

Technique

uses

to Shortcut Modification

Technique

uses

to Standard Encoding

Technique

uses

to Symmetric Cryptography

Technique

uses

to Visual Basic

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

Group

3 external

References

mitre-attack

S0170

Helminth

—

Palo Alto OilRig May 2016

http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/