Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Witchetty · Unknown · assessed origin China · misp-galaxy · refreshed 2026-10-06

Witchetty

  • LookingFrog

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. —todaynew CVE5 new CVEs: CVE-2021-26855, CVE-2021-27065, CVE-2021-31207, CVE-2021-34473, CVE-2021-34523

Analyst brief

misp-galaxy

Witchetty was first documented by ESET in April 2022, who concluded that it was one of three sub-groups of TA410, a broad cyber-espionage operation with some links to the Cicada group (aka APT10). Witchetty’s activity was characterized by the use of two pieces of malware, a first-stage backdoor known as X4 and a second-stage payload known as LookBack. ESET reported that the group had targeted governments, diplomatic missions, charities, and industrial/manufacturing organizations.

CVEs Witchetty is cited as exploiting

none on KEV
  1. CVE-2021-270652026-10-17
    1. “the threat actors first gain initial access to a network by exploiting the Microsoft Exchange ProxyShell ( CVE-2021-34473 , CVE-2021-34523, and CVE-2021-31207) and ProxyLogon ( CVE-2021-26855 and CVE-2021-27065) attack chains.”

      cited as exploiting · named nearby · source: rewterz.com ↗ · 2026-10-17

    2. “The attackers exploited the ProxyShell ( CVE-2021-34473 , CVE-2021-34523 , and CVE-2021-31207 ) and ProxyLogon ( CVE-2021-26855 and CVE-2021-27065 ) vulnerabilities to install web shells on public-facing servers”

      cited as exploiting · named nearby · source: symantec-enterprise-blogs.security.com ↗ · 2026-10-17

  2. CVE-2021-268552026-10-17
    1. “the threat actors first gain initial access to a network by exploiting the Microsoft Exchange ProxyShell ( CVE-2021-34473 , CVE-2021-34523, and CVE-2021-31207) and ProxyLogon ( CVE-2021-26855 and CVE-2021-27065) attack chains.”

      cited as exploiting · named nearby · source: rewterz.com ↗ · 2026-10-17

    2. “The attackers exploited the ProxyShell ( CVE-2021-34473 , CVE-2021-34523 , and CVE-2021-31207 ) and ProxyLogon ( CVE-2021-26855 and CVE-2021-27065 ) vulnerabilities to install web shells on public-facing servers”

      cited as exploiting · named nearby · source: symantec-enterprise-blogs.security.com ↗ · 2026-10-17

  3. CVE-2021-312072026-10-17
    1. “the threat actors first gain initial access to a network by exploiting the Microsoft Exchange ProxyShell ( CVE-2021-34473 , CVE-2021-34523, and CVE-2021-31207) and ProxyLogon ( CVE-2021-26855 and CVE-2021-27065) attack chains.”

      cited as exploiting · named nearby · source: rewterz.com ↗ · 2026-10-17

    2. “The attackers exploited the ProxyShell ( CVE-2021-34473 , CVE-2021-34523 , and CVE-2021-31207 ) and ProxyLogon ( CVE-2021-26855 and CVE-2021-27065 ) vulnerabilities to install web shells on public-facing servers”

      cited as exploiting · named nearby · source: symantec-enterprise-blogs.security.com ↗ · 2026-10-17

  4. CVE-2021-344732026-10-17
    1. “the threat actors first gain initial access to a network by exploiting the Microsoft Exchange ProxyShell ( CVE-2021-34473 , CVE-2021-34523, and CVE-2021-31207) and ProxyLogon ( CVE-2021-26855 and CVE-2021-27065) attack chains.”

      cited as exploiting · named nearby · source: rewterz.com ↗ · 2026-10-17

    2. “The attackers exploited the ProxyShell ( CVE-2021-34473 , CVE-2021-34523 , and CVE-2021-31207 ) and ProxyLogon ( CVE-2021-26855 and CVE-2021-27065 ) vulnerabilities to install web shells on public-facing servers”

      cited as exploiting · named nearby · source: symantec-enterprise-blogs.security.com ↗ · 2026-10-17

  5. CVE-2021-345232026-10-17
    1. “the threat actors first gain initial access to a network by exploiting the Microsoft Exchange ProxyShell ( CVE-2021-34473 , CVE-2021-34523, and CVE-2021-31207) and ProxyLogon ( CVE-2021-26855 and CVE-2021-27065) attack chains.”

      cited as exploiting · named nearby · source: rewterz.com ↗ · 2026-10-17

    2. “The attackers exploited the ProxyShell ( CVE-2021-34473 , CVE-2021-34523 , and CVE-2021-31207 ) and ProxyLogon ( CVE-2021-26855 and CVE-2021-27065 ) vulnerabilities to install web shells on public-facing servers”

      cited as exploiting · named nearby · source: symantec-enterprise-blogs.security.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

3 sources
  1. 1.rewterz.com/rewterz-news/rewterz-threat-alert-witchetty-apt-group-…
  2. 2.symantec-enterprise-blogs.security.com/blogs/threat-intelligence/witchetty-steganography-espi…
  3. 3.welivesecurity.com/2022/04/27/lookback-ta410-umbrella-cyberespionage-ttps…

Track Witchetty on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.