BACKSPACE is a backdoor used by APT30 that dates back to at least 2005. [1]

ID: S0031
Associated Software: Lecna
Platforms: Windows
Version: 1.0

Techniques Used

Domain ID Name Use
Enterprise T1059 Command-Line Interface Adversaries can direct BACKSPACE to execute from the command-line on infected hosts, or have BACKSPACE create a reverse shell.[1]
Enterprise T1090 Connection Proxy The "ZJ" variant of BACKSPACE allows "ZJ link" infections with Internet access to relay traffic from "ZJ listen" to a command server.[1]
Enterprise T1001 Data Obfuscation Newer variants of BACKSPACE will encode C2 communications with a custom system.[1]
Enterprise T1089 Disabling Security Tools The "ZR" variant of BACKSPACE will check to see if known host-based firewalls are installed on the infected systems. BACKSPACE will attempt to establish a C2 channel, then will examine open windows to identify a pop-up from the firewall software and will simulate a mouse-click to allow the connection to proceed.[1]
Enterprise T1041 Exfiltration Over Command and Control Channel Adversaries can direct BACKSPACE to upload files to the C2 Server.[1]
Enterprise T1083 File and Directory Discovery BACKSPACE allows adversaries to search for files.[1]
Enterprise T1112 Modify Registry BACKSPACE is capable of deleting Registry keys, sub-keys, and values on a victim system.[1]
Enterprise T1104 Multi-Stage Channels BACKSPACE attempts to avoid detection by checking a first stage command and control server to determine if it should connect to the second stage server, which performs "louder" interactions with the malware.[1]
Enterprise T1057 Process Discovery BACKSPACE may collect information about running processes.[1]
Enterprise T1012 Query Registry BACKSPACE is capable of enumerating and making modifications to an infected system's Registry.[1]
Enterprise T1060 Registry Run Keys / Startup Folder BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.[1]
Enterprise T1023 Shortcut Modification BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.[1]
Enterprise T1071 Standard Application Layer Protocol BACKSPACE uses HTTP as a transport to communicate with its command server.[1]
Enterprise T1082 System Information Discovery During its initial execution, BACKSPACE extracts operating system information from the infected host.[1]


Groups that use this software: