ATT&CKSoftwareSLOWDRIFT

SLOWDRIFT

S0218

Malware.View on attack.mitre.org

About this malware

SLOWDRIFT is a backdoor used by APT37 against academic and strategic victims in South Korea.

Techniques used3

Discovery1

T1082System Information Discovery

Command and Control2

T1102.002Bidirectional CommunicationT1105Ingress Tool Transfer

Procedure examples3

TechniqueProcedure example
T1082
System Information Discovery

SLOWDRIFT collects and sends system information to its C2.

FireEye APT37 Feb 2018
T1102.002
Bidirectional Communication

SLOWDRIFT uses cloud based services for C2.

FireEye APT37 Feb 2018
T1105
Ingress Tool Transfer

SLOWDRIFT downloads additional payloads.

FireEye APT37 Feb 2018

Groups that use it1

APT37

Campaigns0

None recorded.

References1

  1. FireEye APT37 Feb 2018 Open source
    FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.

© 2026 DetectionCode Website. All Rights Reserved.

Developed by Taher Gabr · LinkedIn