Tool
bitsadmin
- First Reported
- Feb 20, 2024
- Latest Reported
- Aug 10, 2026
Reported Context (3)
- After penetrating a poorly managed MS-SQL server, the attacker used utilities such as PowerShell, bitsadmin, and Certui to install SoftEther VPN and is believed to have ultimately installed a web shell. Larva-26010 Targets Korean Web Servers to Install SoftEther VPN
- Note: It is worth noting that a variant of this first stage, which uses almost the same mechanisms, employs BITSadmin to download and execute payloads. Gamaredon’s GammaLoad Uses Three-Stage Loader Chain to Deliver GammaSteel
- The malware then uses the Bitsadmin living-off-the-land binary (LoLBin) to retrieve the next-stage components from the aforementioned distribution server. First, it retrieves the legitimate executable associated with Astaroth, Mekotio and Ousaban Campaigns Abuse Google Cloud Run to Deliver Banking Trojans
Malware (10)
People (5)
Threat Actors (7)
MITRE ATT&CK (22)
Vendors (1)
Products (8)
Tools (9)
Industries (3)
Countries (5)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.