Malware.View on attack.mitre.org
QUIETEXIT is a novel backdoor, based on the open-source Dropbear SSH client-server software, that has been used by APT29 since at least 2021. APT29 has deployed QUIETEXIT on opaque network appliances that typically don't support antivirus or endpoint detection and response tools within a victim environment.
| Technique | Procedure example |
|---|---|
| T1008 Fallback Channels |
QUIETEXIT can attempt to connect to a second hard-coded C2 if the first hard-coded C2 address fails. |
| T1036.005 Match Legitimate Resource Name or Location |
QUIETEXIT has attempted to change its name to `cron` upon startup. During incident response, QUIETEXIT samples have been identified that were renamed to blend in with other legitimate files. |
| T1071 Application Layer Protocol |
QUIETEXIT can use an inverse negotiated SSH connection as part of its C2. |
| T1090.002 External Proxy |
QUIETEXIT can proxy traffic via SOCKS. |
| T1095 Non-Application Layer Protocol |
QUIETEXIT can establish a TCP connection as part of its initial connection to the C2. |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
