Hide Navigation Hide TOC

RCSession (38c4d208-fe38-4965-871c-709fa1479ba3)

RCSession is a backdoor written in C++ that has been in use since at least 2018 by Mustang Panda and by Threat Group-3390 (Type II Backdoor).^{[Secureworks BRONZE PRESIDENT December 2019][Trend Micro Iron Tiger April 2021][Trend Micro DRBControl February 2020]}

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Threat Group-3390 (79be2f31-5626-425e-844c-fd9c99e38fe5)	Tidal Groups	RCSession (38c4d208-fe38-4965-871c-709fa1479ba3)	Tidal Software	1
Mustang Panda (4a4641b1-7686-49da-8d83-00d8013f4b47)	Tidal Groups	RCSession (38c4d208-fe38-4965-871c-709fa1479ba3)	Tidal Software	1