Threat intelligence / Malware

Small Sieve

[Small Sieve](https://attack.mitre.org/software/S1035) is a Telegram Bot API-based Python backdoor that has been distributed using a Nullsoft Scriptable Install System (NSIS) Installer; it has been used by [MuddyWater](https://attack.mitre.org/groups/G0069) since at least January 2022.(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: NCSC GCHQ Small Sieve Jan 2022) Security researchers have also noted [Small Sieve](https://attack.mitre.org/software/S1035)'s use by UNC3313, which may be associated with [MuddyWater](https://attack.mitre.org/groups/G0069).(Citation: Mandiant UNC3313 Feb 2022)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Small Sieve](https://attack.mitre.org/software/S1035) is a Telegram Bot API-based Python backdoor that has been distributed using a Nullsoft Scriptable Install System (NSIS) Installer; it has been used by [MuddyWater](https://attack.mitre.org/groups/G0069) since at least January 2022.(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: NCSC GCHQ Small Sieve Jan 2022) Security researchers have also noted [Small Sieve](https://attack.mitre.org/software/S1035)'s use by UNC3313, which may be associated with [MuddyWater](https://attack.mitre.org/groups/G0069).(Citation: Mandiant UNC3313 Feb 2022)

Labels

malware

14 recorded

Relationships

uses

from MuddyWater

Group

uses

to Asymmetric Cryptography

Technique

uses

to Bidirectional Communication

Technique

uses

to Execution Guardrails

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Non-Standard Encoding

Technique

uses

to Obfuscated Files or Information

Technique

uses

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

5 external

References

mitre-attack

S1035

GRAMDOOR

—

DHS CISA AA22-055A MuddyWater February 2022

https://www.cisa.gov/uscert/ncas/alerts/aa22-055a

NCSC GCHQ Small Sieve Jan 2022

https://www.ncsc.gov.uk/files/NCSC-Malware-Analysis-Report-Small-Sieve.pdf

Mandiant UNC3313 Feb 2022

https://www.mandiant.com/resources/telegram-malware-iranian-espionage