ThaiCERT    ETDA    MDES
Report
Search
Home > List all groups > List all tools > List all groups using tool WellMess

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: WellMess

NamesWellMess
CategoryMalware
TypeBackdoor, Exfiltration
Description(NCSC-UK) WellMess is malware written in either Golang or .NET and has been in use since at least 2018. WellMess was first reported on by JPCERT and LAC researchers in July 2018. It is named after one of the function names in the malware -‘wellmess’. WellMess is a lightweight malware designed to execute arbitrary shell commands, upload and download files. The malware supports HTTP, TLS and DNS communications methods.
Information<https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development.pdf>
<https://blogs.jpcert.or.jp/en/2018/07/malware-wellmes-9b78.html>
<https://www.lac.co.jp/lacwatch/pdf/20180614_cecreport_vol3.pdf>
<https://www.botconf.eu/wp-content/uploads/2018/12/2018-Y-Ishikawa-S-Nagano-Lets-go-with-a-Go-RAT-_final.pdf>
<https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198b>
Malpedia<https://malpedia.caad.fkie.fraunhofer.de/details/elf.wellmess>
AlienVault OTX<https://otx.alienvault.com/browse/pulses?q=tag:WellMess>

Last change to this tool card: 30 July 2020

Download this tool card in JSON format

Previous: WellMail
Next: Whisky

All groups using tool WellMess

ChangedNameCountryObserved

APT groups

 APT 29, Cozy Bear, The DukesRussia2008-Jul 2021 HOTX

1 group listed (1 APT, 0 other, 0 unknown)

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key