Threat Actor

Suckfly

Also known as: Suckfly

[Suckfly](https://attack.mitre.org/groups/G0039) is a China-based threat group that has been active since at least 2014. (Citation: Symantec Suckfly March 2016)

5
Techniques
1
Software

Properties

stix_id
intrusion-set--5cbe0d3b-6fb1-471f-b591-4b192915116d
signal_observed_at
2026-09-11T17:54:59+00:00
type
intrusion-set

MITRE ATT&CK Techniques (5)

Code Signing

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a bi

Network Service Discovery

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vul

OS Credential Dumping

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password.

Valid Accounts

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense

Windows Command Shell

Adversaries may abuse the Windows command shell for execution. The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the prima

Software & Tools (1)

Nidiran [malware]

[Nidiran](https://attack.mitre.org/software/S0118) is a custom backdoor developed and used by [Suckfly](https://attack.mitre.org/groups/G0039). It has

Explore this actor's full graph with Ninja Signal

Suckfly — Threat Actor Profile — Ninja Signal | Ninja Signal