malware

DEADEYE

S1052 · ATT&CK v19.2

aka DEADEYE.EMBED, DEADEYE.APPEND

Platforms

Windows

Tracked actors

Description

[DEADEYE](https://attack.mitre.org/software/S1052) is a malware launcher that has been used by [APT41](https://attack.mitre.org/groups/G0096) since at least May 2021. [DEADEYE](https://attack.mitre.org/software/S1052) has variants that can either embed a payload inside a compiled binary (DEADEYE.EMBED) or append it to the end of a file (DEADEYE.APPEND).(Citation: Mandiant APT41)

Actors that use this

0 tracked actors

No tracked actor uses this yet

Not linked to any of our tracked MENA actors in actor_software — still browsable via the ATT&CK dictionary above.