APT / THREAT GROUP

ACEHASH

aliases

Last seen:Mar 17, 2026

Intelligence Profile

ACEHASH is described by FireEye as combined credential harvester that consists of two components, a loader and encrypted/compressed payload. To execute, a password is necessary (e.g. 9839D7F1A0) and the individual modules are addressed with parameters (-m, -w, -h).

Threat Analysis

ACEHASH is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf

→https://www.fireeye.com/blog/threat-research/2019/08/game-over-detecting-and-stopping-an-apt41-operation.html

→https://www.secureworks.com/research/threat-profiles/bronze-atlas

→https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

ACEHASHwin.acehash

External Intelligence

Malpedia: win.acehash

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search ACEHASH