POLLBLEND
POLLBLEND is a Windows tunneler written C++ that has utilized hardcoded C2 servers and leveraged hardcoded URI parameters for follow-on actions.[1] POLLBLEND was first observed in 2025 and has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols |
POLLBLEND communicates with hardcoded C2 using HTTP POST Requests.[1] |
| Enterprise | T1041 | Exfiltration Over C2 Channel |
POLLBLEND has exfiltrated the victim device’s username and computer name within the JSON body through HTTP POST requests to the URI pathway |
|
| Enterprise | T1574 | .001 | Hijack Execution Flow: DLL |
POLLBLEND has been executed using DLL search order hijacking.[1] |
| Enterprise | T1105 | Ingress Tool Transfer |
POLLBLEND has utilized hardcoded C2 communications to download configuration data.[1] |
|
| Enterprise | T1553 | .002 | Subvert Trust Controls: Code Signing |
POLLBLEND has utilized valid digital signatures to evade detection from security tools.[1] |
Groups That Use This Software
| ID | Name | References |
|---|---|---|
| G1059 | NIMBUS MANTICORE |
POLLBLEND has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1] |