Small Sieve is a Telegram Bot API-based Python backdoor that has been distributed using a Nullsoft Scriptable Install System (NSIS) Installer; it has been used by MuddyWater since at least January 2022.
Security researchers have also noted Small Sieve's use by UNC3313, which may be associated with MuddyWater.
|Enterprise||T1071||.001||Application Layer Protocol: Web Protocols||
Small Sieve can contact actor-controlled C2 servers by using the Telegram API over HTTPS.
|Enterprise||T1547||.001||Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder||
Small Sieve has the ability to add itself to
|Enterprise||T1059||.003||Command and Scripting Interpreter: Windows Command Shell||
Small Sieve can use
|.006||Command and Scripting Interpreter: Python||
Small Sieve can use Python scripts to execute commands.
|Enterprise||T1132||.002||Data Encoding: Non-Standard Encoding||
Small Sieve can use a custom hex byte swapping encoding scheme to obfuscate tasking traffic.
|Enterprise||T1573||.002||Encrypted Channel: Asymmetric Cryptography||
Small Sieve can use SSL/TLS for its HTTPS Telegram Bot API-based C2 channel.
Small Sieve can only execute correctly if the word
|Enterprise||T1105||Ingress Tool Transfer||
Small Sieve has the ability to download files.
|Enterprise||T1036||.005||Masquerading: Match Legitimate Name or Location||
Small Sieve can use variations of Microsoft and Outlook spellings, such as "Microsift", in its file names to avoid detection.
|Enterprise||T1027||Obfuscated Files or Information||
Small Sieve has the ability to use a custom hex byte swapping encoding scheme combined with an obfuscated Base64 function to protect program strings and Telegram credentials.
|Enterprise||T1016||System Network Configuration Discovery||
Small Sieve can obtain the IP address of a victim host.
|Enterprise||T1033||System Owner/User Discovery||
Small Sieve can obtain the id of a logged in user.
|Enterprise||T1102||.002||Web Service: Bidirectional Communication||
Small Sieve has the ability to use the Telegram Bot API from Telegram Messenger to send and receive messages.