APT / THREAT GROUP

Upatre

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Upatre is primarly a downloader. It has been discovered in 2013 and since that time it has been widely updated. Upatre is responsible for delivering further malware to the victims, in specific upatre was a prolific delivery mechanism for Gameover P2P in 2013-2014 and then for Dyre in 2015.

Threat Analysis

Upatre is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://johannesbader.ch/2015/06/Win32-Upatre-BI-Part-1-Unpacking/

→https://marcoramilli.com/2020/06/24/is-upatre-downloader-coming-back/

→https://researchcenter.paloaltonetworks.com/2018/07/unit42-upatre-continues-evolve-new-anti-analysis-techniques/

→https://secrary.com/ReversingMalware/Upatre/

→https://unit42.paloaltonetworks.com/ticked-off-upatre-malwares-simple-anti-analysis-trick-to-defeat-sandboxes/

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

Upatrewin.upatre

External Intelligence

Malpedia: win.upatre

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Upatre