Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 21:15:50 UTC
Home > List all groups > List all tools > List all groups using tool TDTESS
 Tool: TDTESS
Names TDTESS
Category Malware
Type Backdoor, Info stealer, Downloader
Description
(ClearSky) TDTESS is 64-bit .NET binary backdoor that provides a reverse shell with
an option to download and execute files. It routinely calls in to the command and control
server for new instructions using basic authentication. Commands are sent via a web
page. The malware creates a stealth service, which will not show on the service manager
or other tools that enumerate services from WINAPI or Windows Management
Instrumentation.
Information
MITRE ATT&CK Malpedia Last change to this tool card: 23 April 2020
Download this tool card in JSON format
All groups using tool TDTESS
Changed Name Country Observed
APT groups
 CopyKittens, Slayer Kitten 2013-Jan 2017
 Magic Hound, APT 35, Cobalt Illusion, Charming Kitten 2012-Jun 2025
2 groups listed (2 APT, 0 other, 0 unknown)
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=c5b4a58f-1972-434b-bc58-b018be0f8276
Page 1 of 2

Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=c5b4a58f-1972-434b-bc58-b018be0f8276
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=c5b4a58f-1972-434b-bc58-b018be0f8276
Page 2 of 2