Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 14:43:47 UTC
Home > List all groups > List all tools > List all groups using tool Moriya
 Tool: Moriya
Names Moriya
Category Malware
Type Rootkit, Backdoor
Description
(Kaspersky) Based on string artefacts within the malware’s binaries, we named this rootkit
Moriya. This tool is a passive backdoor which allows attackers to inspect all incoming traffic
to the infected machine, filter out packets that are marked as designated for the malware and
respond to them. This forms a covert channel over which attackers are able to issue shell
commands and receive back their outputs.
Information
Malpedia Last change to this tool card: 28 December 2021
Download this tool card in JSON format
All groups using tool Moriya
Changed Name Country Observed
APT groups
 Earth Kurma 2020
 Operation TunnelSnake 2018
2 groups listed (2 APT, 0 other, 0 unknown)
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=b0096525-5d1e-434a-9060-4c73f5da2492
Page 1 of 2

Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=b0096525-5d1e-434a-9060-4c73f5da2492
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=b0096525-5d1e-434a-9060-4c73f5da2492
Page 2 of 2

  Earth Kurma Operation TunnelSnake 2020 2018 
2 groups listed (2 APT, 0 other, 0 unknown) 
   Page 1 of 2