H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[H1N1](https://attack.mitre.org/software/S0132) is a malware variant that has been distributed via a campaign using VBA macros to infect victims. Although it initially had only loader capabilities, it has evolved to include information-stealing functionality. (Citation: Cisco H1N1 Part 1)

Labels

malware

13 recorded

Relationships

uses

to Bypass User Account Control

Technique

uses

to Credentials from Web Browsers

Technique

uses

to Data Encoding

Technique

uses

to Disable or Modify Tools

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Inhibit System Recovery

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Replication Through Removable Media

Technique

uses

to Software Packing

Technique

uses

to Symmetric Cryptography

Technique

uses

to Taint Shared Content

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Host Firewall

Technique

2 external

References

mitre-attack

S0132

Cisco H1N1 Part 1

http://blogs.cisco.com/security/h1n1-technical-analysis-reveals-new-capabilities