H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Denis](https://attack.mitre.org/software/S0354) is a Windows backdoor and Trojan used by [APT32](https://attack.mitre.org/groups/G0050). [Denis](https://attack.mitre.org/software/S0354) shares several similarities to the [SOUNDBITE](https://attack.mitre.org/software/S0157) backdoor and has been used in conjunction with the [Goopy](https://attack.mitre.org/software/S0477) backdoor.(Citation: Cybereason Oceanlotus May 2017)

Labels

malware

21 recorded

Relationships

uses

from APT32

Group

uses

to Archive via Library

Technique

uses

to Command Obfuscation

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to DLL

Technique

uses

to DNS

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Hijack Execution Flow

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Obfuscated Files or Information

Technique

uses

Technique

uses

to Process Hollowing

Technique

uses

to Query Registry

Technique

uses

to Standard Encoding

Technique

uses

to System Checks

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Windows Command Shell

Technique

3 external

References

mitre-attack

S0354

Denis

—

Cybereason Oceanlotus May 2017

https://www.cybereason.com/blog/operation-cobalt-kitty-apt