SysUpdate

Malware
8 incidents First seen 2026-03-23 Last seen 2026-10-26
Also known as
HyperSSLSoldierFOCUSFJORD
Overview

SysUpdate is a backdoor written in C++ that has been used by Threat Group-3390 since at least 2020.

Investigate in CTI Graph Login required Open in Dashboard
Threat ecosystem
Actors Malware Campaigns CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 255 36 techniques 1 groups use it WindowsLinux in ATT&CK since 2021-11-29 updated 2025-10-21 · v1.3
Activity by month (incidents)
2026-032026-10
Sectors targeted
government · 6defense · 3telecommunications · 3aerospace · 1aviation · 1cryptocurrency · 1education · 1finance · 1health · 1hospitality · 1
Countries targeted
US · 7CA · 6ZA · 2AR · 1AT · 1BE · 1BG · 1BO · 1BR · 1BY · 1CH · 1CL · 1
Origin
US · 6CA · 5IR · 3JO · 3AT · 1CH · 1
Kinds of incident
Law Enforcement · 7Ransomware & Extortion · 4Data Breach · 2Fraud & Crypto Theft · 2AI-Enabled Attack · 1Cyberattack (general) · 1
Techniques seen in incidents
Extortion · 5Ransomware · 4T1588.001 - Malware · 4Data Breach · 2Ddos · 2Botnet · 1Data Leak · 1Defacement · 1Impersonation · 1Phishing · 1Privilege Escalation · 1Sabotage · 1Social Engineering · 1
Related actors
ShinyHunters · 5LAPSUS$ · 1Scattered Spider · 1
Related CVEs
CVE-2023-45208 · 1CVE-2026-35273 · 1
ATT&CK techniques by tactic (36)
execution T1047 Windows Management Instrumentation T1106 Native API T1569.002 Service Execution T1574.001 DLL
persistence T1112 Modify Registry T1543.002 Systemd Service T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder
privilege escalation T1543.002 Systemd Service T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder
discovery T1007 System Service Discovery T1016 System Network Configuration Discovery T1016.001 Internet Connection Discovery T1033 System Owner/User Discovery T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1680 Local Storage Discovery
collection T1005 Data from Local System T1113 Screen Capture
command and control T1071.004 DNS T1105 Ingress Tool Transfer T1132.001 Standard Encoding T1573.001 Symmetric Cryptography
exfiltration T1041 Exfiltration Over C2 Channel
stealth T1027.002 Software Packing T1027.011 Fileless Storage T1027.013 Encrypted/Encoded File T1036.004 Masquerade Task or Service T1070.004 File Deletion T1140 Deobfuscate/Decode Files or Information T1564.001 Hidden Files and Directories T1574.001 DLL
defense impairment T1112 Modify Registry T1553.002 Code Signing
Groups that use it
Threat Group-3390
Incident timeline
2026-10-26
BleepingComputer CyberScoop Data Breaches TheRecord Mastodon BrianKrebs SecurityWeek AlienVault OTX SecurityWeek The Register - CSO The Hacker News CyberScoop Mastodon BrianKrebs Chosun National CyberScoop TheRecord Krebs On Security The Register - CSO AlienVault OTX Krebs On Security HackRead AlienVault OTX BleepingComputer
2026-10-08
Dark Reading BleepingComputer TheRecord SecurityWeek
2026-10-08
Fake Decryption Tools Masked $11M Markup in Ransomware Recovery Scheme
SecurityWeek
2026-10-02
In Rare Move, Alleged Iranian State Hacker Extradited to US
SecurityWeek
2026-09-28
Data Breaches
2026-09-28
SecurityWeek BleepingComputer
2026-09-25
Krebs On Security
2026-03-23
US sentences Nigerian national to 7 years in $6 million email fraud scheme
TheRecord