H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Tool

Donut

[Donut](https://attack.mitre.org/software/S0695) is an open source framework used to generate position-independent shellcode.(Citation: Donut Github)(Citation: Introducing Donut) [Donut](https://attack.mitre.org/software/S0695) generated code has been used by multiple threat actors to inject and load malicious payloads into memory.(Citation: NCC Group WastedLocker June 2020)

Tool
TypeTool
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Donut](https://attack.mitre.org/software/S0695) is an open source framework used to generate position-independent shellcode.(Citation: Donut Github)(Citation: Introducing Donut) [Donut](https://attack.mitre.org/software/S0695) generated code has been used by multiple threat actors to inject and load malicious payloads into memory.(Citation: NCC Group WastedLocker June 2020)

Labels

tool
17 recorded

Relationships

uses
to Command and Scripting Interpreter
Technique
uses
to Compression
Technique
uses
to Disable or Modify Tools
Technique
uses
to Encrypted/Encoded File
Technique
uses
to Indicator Removal
Technique
uses
to Ingress Tool Transfer
Technique
uses
to JavaScript
Technique
uses
to Native API
Technique
uses
to PowerShell
Technique
uses
to Process Discovery
Technique
uses
to Process Injection
Technique
uses
to Python
Technique
uses
to Reflective Code Loading
Technique
uses
to Software Packing
Technique
uses
to Visual Basic
Technique
uses
to Web Protocols
Technique
uses
from Indrik Spider
Group
4 external

References

mitre-attack
S0695
open
NCC Group WastedLocker June 2020
https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/
open
Introducing Donut
https://thewover.github.io/Introducing-Donut/
open
Donut Github
https://github.com/TheWover/donut
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance