Small Sieve

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.

A sample analyzed by the NCSC determined Small Sieve to be a Python backdoor distributed using a Nullsoft Scriptable Install System installer.

Small Sieve to be a Python backdoor distributed using a Nullsoft Scriptable Install System installer, gram_app.exe, which installs the Python backdoor, indoor.exe, and adds it as a registry run key that enables persistence.

Small Sieve to be a Python backdoor distributed using a Nullsoft Scriptable Install System installer, gram_app.exe, which installs the Python backdoor, indoor.exe, and adds it as a registry run key that enables persistence.

These actors also maintain persistence on victim networks via tactics such as side-loading dynamic link libraries, to trick legitimate programs into running malware and obfuscating PowerShell scripts to hide command and control functions.

The malicious file impersonates a legitimate file that is signed as a Google Update executable file.

The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.

The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.

It says the Small Sieve's beacons and tasking are performed using Telegram API.

APT41 DUST used HTTPS for command and control. APT42 has used tools such as NICECURL with command and control communication taking place over HTTPS. Lumma Stealer has used HTTPS for command and control purposes.

Small Sieve’s beacons and taskings are performed using Telegram API over Hypertext Transfer Protocol Secure (HTTPS) [T1071.001], and the tasking and beaconing data is obfuscated through a hex byte swapping encoding scheme combined with an obfuscated Base64 function [T1027], T1132.002].

The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.

It also uses multiple malware sets, such as PowGoop, Small Sieve, Canopy/Starwhale, Mori and POWERSTATS for loading malware, backdoor access, persistence and exfiltration.