Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 13:53:32 UTC
Home > List all groups > List all tools > List all groups using tool WellMess
 Tool: WellMess
Names
WellMess
elf.wellmess
Category Malware
Type Backdoor, Exfiltration
Description
(NCSC-UK) WellMess is malware written in either Golang or .NET and has been in use
since at least 2018. WellMess was first reported on by JPCERT and LAC researchers in
July 2018. It is named after one of the function names in the malware -‘wellmess’.
WellMess is a lightweight malware designed to execute arbitrary shell commands,
upload and download files. The malware supports HTTP, TLS and DNS
communications methods.
Information
MITRE ATT&CK Malpedia AlienVault OTX Last change to this tool card: 30 December 2022
Download this tool card in JSON format
All groups using tool WellMess
Changed Name Country Observed
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=5619706d-69a0-45a6-9e40-f1c0e9ba2eed
Page 1 of 2

APT groups
  APT 29, Cozy Bear, The Dukes 2008-Feb 2025
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=5619706d-69a0-45a6-9e40-f1c0e9ba2eed
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=5619706d-69a0-45a6-9e40-f1c0e9ba2eed
Page 2 of 2