H3XA — Operational Evidence

TypeTool

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[MCMD](https://attack.mitre.org/software/S0500) is a remote access tool that provides remote command shell capability used by [Dragonfly](https://attack.mitre.org/groups/G0035).(Citation: Secureworks MCMD July 2019)

Labels

tool

11 recorded

Relationships

uses

from Dragonfly

Group

uses

to Clear Persistence

Technique

uses

to Data from Local System

Technique

uses

to Hidden Window

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Scheduled Task

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

2 external

References

mitre-attack

S0500

open

Secureworks MCMD July 2019

https://www.secureworks.com/research/mcmd-malware-analysis

open