Remote Access Trojan
WellMess
First seen: 2018 • Status: inactive
Currently Inactive
WellMess was a spy tool used by Russian hackers to steal vaccine research during the pandemic.
Overview
WellMess is a cross-platform RAT attributed to APT29 (Cozy Bear). It was used in attacks against COVID-19 vaccine research organizations.
Also Known As
Well Mess
How It Spreads
- • Targeted exploitation
- • Custom malware delivery
- • Citrix vulnerability exploitation
What It Does
- • Remote access
- • Command execution
- • Data exfiltration
- • Cross-platform operation
Is your business exposed?
Target Platforms
Windows, Linux
Detection Tips
- • Monitor for WellMess indicators
- • Check for Go-based malware
- • Analyze vaccine research targeting
- • Review Citrix exploitation
MITRE ATT&CK Techniques
T1059, T1005, T1041, T1190
If You're Infected
- 1.
Engage national cyber security agency
- 2.
Conduct APT investigation
- 3.
Rebuild compromised systems
- 4.
Patch Citrix vulnerabilities
Related Malware
Is your business exposed?
Check if your company data is circulating on the dark web
Free scan • No credit card required