Loading malware…
Koadic is an open-source post-exploitation framework for Windows environments, published in 2017 and commonly tracked as a command-and-control and post-compromise tool rather than a conventional standalone malware family. It is written in Python, while its agent functionality relies heavily on JScript and VBScript executed through Windows Script Host. The framework is designed to provide operators with remote execution, payload delivery, persistence, privilege escalation, reconnaissance, and follow-on post-exploitation capabilities on compromised Windows systems.
Koadic is notable for extensive abuse of native Windows binaries and scripting mechanisms. Reported execution methods include use of mshta, regsvr32, rundll32, PowerShell, and wmic, allowing operators to proxy execution through trusted system components and reduce visibility. It can run arbitrary shellcode and has been observed using reflective DLL techniques for process injection. For defense evasion, Koadic has used hidden PowerShell execution and signed-binary proxy execution patterns.
Its persistence options include PowerShell-based persistence, scheduled tasks, Registry Run key persistence, and WMI event subscription mechanisms. Privilege escalation functionality includes User Account Control bypass techniques involving eventvwr.exe and sdclt.exe. Koadic also supports downloading and executing additional payloads, making it useful as a staging and orchestration framework during multi-stage intrusions.
Reconnaissance and lateral-enablement features attributed to Koadic include retrieval of Windows domain information, inspection of the IP routing table, identification of logged-in users and user sessions across the domain, scanning for open SMB services, and discovery of network shares and related environment details. It can also collect files from compromised hosts and return them to the operator.
Koadic has been used by multiple threat actors and intrusion campaigns as an off-the-shelf post-exploitation capability. Public reporting has linked its use to MuddyWater activity, the ChessMaster espionage campaign, and criminal delivery chains such as SocGholish. It has also appeared in ransomware affiliate tradecraft alongside other offensive tooling. Its role in operations is typically as a flexible Windows post-exploitation framework that bridges initial compromise and later-stage actions such as credential access, persistence, lateral movement, and deployment of additional malware.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
When we tracked ChessMaster back in November, we noted that it exploited the SOAP WSDL parser vulnerability CVE-2017-8759 (patched in September 2017) within the Microsoft .NET framework to download additional malware. | ChessMaster can utilize any of these methods to download the next malware in the chain, the open source post-exploitation tool known as “Koadic,” which the previous campaign also used.
While ChessMaster still uses the previous exploit, it also added more methods to its arsenal: one exploits another vulnerability, CVE-2017-11882 (patched in November 2017), which was also exploited to deliver illegal versions of the Loki infostealer. | ChessMaster can utilize any of these methods to download the next malware in the chain, the open source post-exploitation tool known as “Koadic,” which the previous campaign also used.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence.
Since the emergence of MuddyWater, we found that its operators used multiple open source post-exploitation tools... Koadic
ChessMaster can utilize any of these methods to download the next malware in the chain, the open source post-exploitation tool known as “Koadic,” which the previous campaign also used.
APT28 has obtained and used open-source tools like Koadic, Mimikatz, and Responder.
UNC2198 has used Cobalt Strike BEACON, Metasploit METERPRETER, KOADIC, and PowerShell EMPIRE offensive security tools during this phase as well.
33 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution matrix 2 Technique Count Frameworks WMI 1/10 • Koadic
Persistence matrix 1 Technique Count Frameworks Scheduled Task/Job 7/10
Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence.
Koadic performs most of its operations using Windows Script Host (VBScript) and runs arbitrary shellcode.
The content repeatedly describes threat actors and malware using PowerShell to execute payloads, run commands, download additional malware, perform lateral movement, evade defenses, and execute scripts in memory.
Numerous entries state malware can create a remote shell or reverse shell, for example 4H RAT, BLACKCOFFEE, DarkComet, PlugX, QuasarRAT, and others. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.
When we tracked ChessMaster back in November, we noted that it exploited the SOAP WSDL parser vulnerability CVE-2017-8759 ... While ChessMaster still uses the previous exploit, it also added more methods to its arsenal: one exploits another vulnerability, CVE-2017-11882...
Persistence matrix 1 Technique Count Frameworks Scheduled Task/Job 7/10
Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence.
Persistence matrix 1 Technique Count Frameworks Scheduled Task/Job 7/10
Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence.
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
Persistence matrix 2 Technique Count Framework WMI Event Subscription 4/10
Persistence matrix 1 Technique Count Frameworks Registry Run Key/Startup Folder 9/10
The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
APT29 has use mshta to execute malicious scripts on a compromised host... APT32 has used mshta.exe for code execution... APT38 has used a renamed version of mshta.exe to execute malicious HTML files... FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.
AppleSeed can call regsvr32.exe for execution. APT19 used Regsvr32 to bypass application control techniques. APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory.
Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.
Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
Cobalt Strike has the ability to load DLLs via reflective injection... Lazarus Group malware sample performs reflective DLL injection... Matryoshka uses reflective DLL injection... Netwalker DLL has been injected reflectively into the memory of a legitimate running process.
{Variable}.user.DC Get DCName from Registry ... {Variable}.registry.read Get/Read Registry Entries
AdFind can extract subnet information from Active Directory; actors used ipconfig /all after exploiting a machine; numerous malware and groups used ipconfig, ifconfig, arp, route, netsh, nbtstat, NBTscan, and related APIs to gather IP, MAC, DNS, DHCP, gateway, proxy, domain, ARP cache, routing, and adapter details.
APT41 used the WMIEXEC utility to execute whoami commands on remote machines; FIN10 used Meterpreter to enumerate users on remote systems; Operation Wocao enumerated sessions and users on a remote host.
The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
Andariel has collected large numbers of files from compromised network systems for later extraction... APT28 has retrieved internal documents from machines inside victim environments... BADNEWS crawls the victim's local drives and collects documents... many listed groups and malware collect files, documents, credentials, payment card data, or other information from compromised hosts.
ANEL will send the infected environment’s information to the C&C server.
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
81 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access/post-exploitation tool previously distributed via SocGholish.
Named malware/tool family deployed via SocGholish.
Backdoor/post-exploitation malware that hides PowerShell execution windows.
Post-exploitation framework/RAT associated with using multiple taskhost.exe/taskhostex.exe processes to support discovery and lateral movement.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.