JHUHUGIT

Malware
10 incidents First seen 2026-03-10 Last seen 2026-07-26
Also known as
Trojan.SofacySeduploaderJKEYSKWSednitGAMEFISHSofacyCarberp
Overview

JHUHUGIT is malware used by APT28. It is based on Carberp source code and serves as reconnaissance malware.

Investigate in CTI Graph Login required Open in Dashboard
Threat ecosystem
Actors Malware Campaigns CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 190 27 techniques 1 groups use it Windows in ATT&CK since 2017-05-31 updated 2024-11-17 · v2.2
Activity by month (incidents)
2026-032026-07
Sectors targeted
government · 7defense · 5technology · 2aviation · 1education · 1energy · 1hospitality · 1telecommunications · 1transportation · 1
Countries targeted
UA · 5US · 5BR · 3RU · 3AO · 2AR · 2AU · 2BD · 2BF · 2BI · 2BJ · 2BN · 2
Origin
RU · 9CA · 2GB · 2AF · 1AT · 1AU · 1
Kinds of incident
State-Sponsored & Espionage · 6Exploited Vulnerability · 4Cyberattack (general) · 2Malware & Botnets · 2
Techniques seen in incidents
Phishing · 6Espionage · 5Exfiltration · 4T1059.001 - PowerShell · 4T1588.001 - Malware · 4Ransomware · 3T1059.007 - JavaScript · 3T1589.001 - Credentials · 3Botnet · 2Keylogging · 2Lateral Movement · 2Reconnaissance · 2Social Engineering · 2T1584.004 - Server · 2
Related actors
APT28 · 9APT29 · 2Winter Vivern · 2Silence · 1
Related CVEs
CVE-2023-50224 · 2CVE-2025-66376 · 2CVE-2020-7796 · 1CVE-2025-27915 · 1CVE-2025-48700 · 1CVE-2025-68645 · 1CVE-2026-20131 · 1CVE-2026-2096 · 1CVE-2026-20963 · 1CVE-2026-21509 · 1
ATT&CK techniques by tactic (27)
execution T1053.005 Scheduled Task T1059.003 Windows Command Shell
persistence T1037.001 Logon Script (Windows) T1053.005 Scheduled Task T1543.003 Windows Service T1546.015 Component Object Model Hijacking T1547.001 Registry Run Keys / Startup Folder
privilege escalation T1037.001 Logon Script (Windows) T1053.005 Scheduled Task T1055 Process Injection T1068 Exploitation for Privilege Escalation T1543.003 Windows Service T1546.015 Component Object Model Hijacking T1547.001 Registry Run Keys / Startup Folder
discovery T1016 System Network Configuration Discovery T1057 Process Discovery T1680 Local Storage Discovery
collection T1113 Screen Capture T1115 Clipboard Data
command and control T1008 Fallback Channels T1071.001 Web Protocols T1105 Ingress Tool Transfer T1132.001 Standard Encoding
stealth T1027.013 Encrypted/Encoded File T1055 Process Injection T1070.004 File Deletion T1218.011 Rundll32
Groups that use it
APT28
Incident timeline
2026-07-26
Hackers Hijack Hotel Wi-Fi to Steal Microsoft 365 Credentials
Security Affairs
2026-07-23
Security Affairs BleepingComputer BleepingComputer Dark Reading
2026-04-09
CyberScoop Infosecurity-Magazine Dark Reading The Hacker News
2026-04-07
Authorities disrupt router DNS hijacks used to steal Microsoft 365 logins
BleepingComputer
2026-04-07
Russian APT28 Hackers Hijack Routers to Steal Credentials, UK Security Agency Warns
Infosecurity-Magazine
2026-03-19
Security Affairs The Hacker News BleepingComputer Security Affairs The Hacker News BleepingComputer
2026-03-15
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 88
Security Affairs
2026-03-10
Russian Threat Actor Sednit Resurfaces With Sophisticated Toolkit
Dark Reading
2026-03-10
Security Affairs The Hacker News
2026-03-10
The Register - Cybercrime BleepingComputer