MalwareUsed by 3 actors

GEdit

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

SECTOR02

In the latest blogpost, ESET has analyzed two variants of the yty malware framework: Gedit and DarkMusical.

via eseteset.com

DoNot APT

DoNot APT is known for using custom-built Windows malware, including backdoors like YTY and GEdit, often delivered through spear-phishing emails or malicious documents.

via trellix blogtrellix.com

DoNot

In the latest blogpost, ESET has analyzed two variants of the yty malware framework: Gedit and DarkMusical.

via eseteset.com

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

According to ESET telemetry, Donot Team has been consistently targeting the same entities with waves of spearphishing emails every two to four months.

T1566.001Spearphishing AttachmentEvidence1

According to ESET telemetry, Donot Team has been consistently targeting the same entities with waves of spearphishing emails every two to four months. The spearphishing emails have malicious Microsoft Office documents attached that the attackers use to deploy their malware.

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

The malicious framework consists of a chain of downloaders that ultimately download a backdoor with minimal functionality, used to download and execute further components of Donot Team’s toolset.

Credential Access

1 technique

T1056.001KeyloggingEvidence1

These include file collectors based on file extension and year of creation, screen capturers, keyloggers, reverse shells, and more.

Collection

3 techniques

T1005Data from Local SystemEvidence1

The main purpose of the “yty” malware framework is to collect and exfiltrate data. These include file collectors based on file extension and year of creation, screen capturers, keyloggers, reverse shells, and more.

T1056.001KeyloggingEvidence1

These include file collectors based on file extension and year of creation, screen capturers, keyloggers, reverse shells, and more.

T1113Screen CaptureEvidence1

These include file collectors based on file extension and year of creation, screen capturers, keyloggers, reverse shells, and more.

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence1

The malicious framework consists of a chain of downloaders that ultimately download a backdoor with minimal functionality, used to download and execute further components of Donot Team’s toolset.

T1219Remote Access ToolsEvidence1

These include file collectors based on file extension and year of creation, screen capturers, keyloggers, reverse shells, and more.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

trellix blogNews

May 19, 2026

From Click to Compromise: Unveiling the Sophisticated Attack of DoNot APT Group on Southern European Government Entities

A custom Windows backdoor associated with DoNot APT and mentioned as part of the group's known malware toolkit.

the hacker newsNews

Jul 9, 2025

DoNot APT Expands Operations, Targets European Foreign Ministries with LoptikMod Malware

A custom-built Windows backdoor used by DoNot Team.

esetNews

Jan 18, 2022

ESET Research investigates Donot Team: Cyberespionage targeting military & governments in South Asia | | ESET

A variant of the yty malware framework analyzed by ESET as part of Donot Team’s recent campaigns.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution3

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 3 actors

GEdit

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

SECTOR02

In the latest blogpost, ESET has analyzed two variants of the yty malware framework: Gedit and DarkMusical.

via eseteset.com

DoNot APT

DoNot APT is known for using custom-built Windows malware, including backdoors like YTY and GEdit, often delivered through spear-phishing emails or malicious documents.

via trellix blogtrellix.com

DoNot

In the latest blogpost, ESET has analyzed two variants of the yty malware framework: Gedit and DarkMusical.

via eseteset.com

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

According to ESET telemetry, Donot Team has been consistently targeting the same entities with waves of spearphishing emails every two to four months.

T1566.001Spearphishing AttachmentEvidence1

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

The malicious framework consists of a chain of downloaders that ultimately download a backdoor with minimal functionality, used to download and execute further components of Donot Team’s toolset.

Credential Access

1 technique

T1056.001KeyloggingEvidence1

These include file collectors based on file extension and year of creation, screen capturers, keyloggers, reverse shells, and more.

Collection

3 techniques

T1005Data from Local SystemEvidence1

T1056.001KeyloggingEvidence1

These include file collectors based on file extension and year of creation, screen capturers, keyloggers, reverse shells, and more.

T1113Screen CaptureEvidence1

These include file collectors based on file extension and year of creation, screen capturers, keyloggers, reverse shells, and more.

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence1

The malicious framework consists of a chain of downloaders that ultimately download a backdoor with minimal functionality, used to download and execute further components of Donot Team’s toolset.

T1219Remote Access ToolsEvidence1

These include file collectors based on file extension and year of creation, screen capturers, keyloggers, reverse shells, and more.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

trellix blogNews

May 19, 2026

From Click to Compromise: Unveiling the Sophisticated Attack of DoNot APT Group on Southern European Government Entities

A custom Windows backdoor associated with DoNot APT and mentioned as part of the group's known malware toolkit.

the hacker newsNews

Jul 9, 2025

DoNot APT Expands Operations, Targets European Foreign Ministries with LoptikMod Malware

A custom-built Windows backdoor used by DoNot Team.

esetNews

Jan 18, 2022

ESET Research investigates Donot Team: Cyberespionage targeting military & governments in South Asia | | ESET

A variant of the yty malware framework analyzed by ESET as part of Donot Team’s recent campaigns.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution3

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.