HOMETHREATSHIGHNOON
APT / THREAT GROUP

HIGHNOON

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

According to FireEye, HIGHNOON is a backdoor that may consist of multiple components. The components may include a loader, a DLL, and a rootkit. Both the loader and the DLL may be dropped together, but the rootkit may be embedded in the DLL. The HIGHNOON loader may be designed to run as a Windows service.

Threat Analysis

HIGHNOON is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://content.fireeye.com/apt-41/rpt-apt41/
→https://speakerdeck.com/aragorntseng/winnti-is-coming-evolution-after-prosecution-at-hitcon2021
→https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf
→https://twitter.com/MrDanPerez/status/1159461995013378048
→https://www.fireeye.com/blog/threat-research/2019/08/game-over-detecting-and-stopping-an-apt41-operation.html

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

HIGHNOONwin.highnoon

External Intelligence

Malpedia: win.highnoon

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search HIGHNOON