H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[ADVSTORESHELL](https://attack.mitre.org/software/S0045) is a spying backdoor that has been used by [APT28](https://attack.mitre.org/groups/G0007) from at least 2012 to 2016. It is generally used for long-term espionage and is deployed on targets deemed interesting after a reconnaissance phase. (Citation: Kaspersky Sofacy) (Citation: ESET Sednit Part 2)

Labels

malware

24 recorded

Relationships

uses

to Archive Collected Data

Technique

uses

to Archive via Custom Method

Technique

uses

to Asymmetric Cryptography

Technique

uses

to Component Object Model Hijacking

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

Technique

uses

to Local Data Staging

Technique

uses

to Modify Registry

Technique

uses

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Peripheral Device Discovery

Technique

uses

to Process Discovery

Technique

uses

to Query Registry

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

Technique

uses

to Scheduled Transfer

Technique

uses

to Standard Encoding

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

from APT28

Group

3 external

References

mitre-attack

S0045

Kaspersky Sofacy

https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/

ESET Sednit Part 2

http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf