Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 16:43:35 UTC
Home > List all groups > List all tools > List all groups using tool HyperStack
 Tool: HyperStack
Names
HyperStack
GoldenSky
SilentMoon
Turla SilentMoon
BigBoss
Cacao
Category Malware
Type Backdoor
Description
(Accenture) HyperStack, first observed in 2018, is one of several RPC backdoors Turla
uses. A sample identified in September 2020 has updated functionality which appears to
be inspired the RPC backdoors previously publicly disclosed by ESET and Symantec
Researchers as well as with the Carbon backdoor. Based on these similarities, we assess
with high confidence that HyperStack is a custom Turla backdoor.
Information
MITRE ATT&CK Malpedia Last change to this tool card: 30 December 2022
Download this tool card in JSON format
All groups using tool HyperStack
Changed Name Country Observed
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=f1280fc8-feb4-4480-ac03-2ce589fece0a
Page 1 of 2

APT groups
  Turla, Waterbug, Venomous Bear 1996-2024  
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=f1280fc8-feb4-4480-ac03-2ce589fece0a
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=f1280fc8-feb4-4480-ac03-2ce589fece0a
Page 2 of 2