H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Comnie](https://attack.mitre.org/software/S0244) is a remote backdoor which has been used in attacks in East Asia. (Citation: Palo Alto Comnie)

Labels

malware

19 recorded

Relationships

uses

to Automated Collection

Technique

uses

to Bidirectional Communication

Technique

uses

to Binary Padding

Technique

uses

to Local Account

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Process Discovery

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Remote System Discovery

Technique

uses

to Rundll32

Technique

uses

to Security Software Discovery

Technique

uses

to Shortcut Modification

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to System Service Discovery

Technique

uses

to Visual Basic

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

3 external

References

mitre-attack

S0244

open

Comnie

—

Palo Alto Comnie

https://researchcenter.paloaltonetworks.com/2018/01/unit42-comnie-continues-target-organizations-east-asia/

open