APT / THREAT GROUP

HATVIBE

Internal ID: vbs.hatvibe

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to Sekoia, the aim of this backdoor is to receive VBS modules for execution from a remote C2 server. Once received, HATVIBE uses a simple XOR algorithm to decrypt each module, contact it between two <script> tags before adding it to the HTML body of the HTA file, leading to the automatic execution of the received module.

Threat Analysis

HATVIBE is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.sekoia.io/double-tap-campaign-russia-nexus-apt-possibly-related-to-apt28-conducts-cyber-espionage-on-central-asia-and-kazakhstan-diplomatic-relations/

→https://blog.sekoia.io/double-tap-campaign-russia-nexus-apt-possibly-related-to-apt28-conducts-cyber-espionage-on-central-asia-and-kazakhstan-diplomatic-relations/#h-iii-hatvibe-and-cherryspy-infection-chain

→https://cert.gov.ua/article/6280129

→https://github.com/blackorbird/APT_REPORT/blob/master/APT28/APT28%20the%20long%20hand%20of%20Russian%20interests.pdf

→https://go.recordedfuture.com/hubfs/reports/CTA-RU-2024-1121.pdf

→https://go.recordedfuture.com/hubfs/reports/cta-2025-0522.pdf

→https://www.bitdefender.com/en-us/blog/businessinsights/uac-0063-cyber-espionage-operation-expanding-from-central-asia

→https://www.recordedfuture.com/research/russia-aligned-tag-110-targets-tajikistan-with-macro-enabled

Quick Facts

TypeAPT / Threat Group

Aliases1

Also Known As

vbs.hatvibe

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search HATVIBE