Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-06 00:22:43 UTC
Home > List all groups > List all tools > List all groups using tool Koadic
 Tool: Koadic
Names Koadic
Category Tools
Type Backdoor, Vulnerability scanner, Loader
Description
Koadic is a Windows post-exploitation framework and penetration testing tool. Koadic
is publicly available on GitHub and the tool is executed via the command-line. Koadic
has several options for staging payloads and creating implants. Koadic performs most of
its operations using Windows Script Host.
Information
MITRE ATT&CK Malpedia AlienVault OTX Last change to this tool card: 14 May 2020
Download this tool card in JSON format
All groups using tool Koadic
Changed Name Country Observed
APT groups
 LazyScripter [Unknown] 2018
 MuddyWater, Seedworm, TEMP.Zagros, Static Kitten 2017-Jul 2025
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d3413309-de30-45f1-9a08-4b48a6bbda77
Page 1 of 2

Sofacy, APT 28, Fancy Bear, Sednit 2004-Apr 2025
3 groups listed (3 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d3413309-de30-45f1-9a08-4b48a6bbda77
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d3413309-de30-45f1-9a08-4b48a6bbda77
Page 2 of 2