APT / THREAT GROUP

PocoDown

aliases

Last seen:Mar 17, 2026

Intelligence Profile

uses POCO C++ cross-platform library, Xor-based string obfuscation, SSL library code and string overlap with Xtunnel, infrastructure overlap with X-Agent, probably in use since mid-2018

Threat Analysis

PocoDown is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://threatvector.cylance.com/en_us/home/flirting-with-ida-and-apt28.html

→https://threatvector.cylance.com/en_us/home/inside-the-apt28-dll-backdoor-blitz.html

→https://twitter.com/cyb3rops/status/1129653190444703744

Quick Facts

TypeAPT / Threat Group

Aliases4

Also Known As

BlitzPocoDownwin.pocodownPocoDownloader

External Intelligence

Malpedia: win.pocodown

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search PocoDown