Skip to content

Hide Navigation Hide TOC

TERRIBLETEA (4838b37b-2d1f-4cb8-945d-7185580f0bff)

TERRIBLETEA is a Go backdoor that communicates over HTTP using XXTEA for encrypted communications. It is built using multiple open-source Go modules and has a multitude of capabilities including Command execution, Keystroke logging, SOCKS5 proxy, Port scanning, File system interaction, SQL query execution, Screen captures, Ability to open a new SSH session, execute commands, and upload files to a remote server.

Cluster A Galaxy A Cluster B Galaxy B Level
UNC5266 (083a637b-c58c-4ccb-ab59-81d783873e80) Threat Actor TERRIBLETEA (4838b37b-2d1f-4cb8-945d-7185580f0bff) Backdoor 1
UNC5266 (083a637b-c58c-4ccb-ab59-81d783873e80) Threat Actor SLIVER (84c2d789-64be-429b-aeee-253a4e0e2aff) Tool 2