HOMETHREATSHyperSSL
MALWARE FAMILY

HyperSSL

Internal ID: win.hyperssl
1
aliases
Last seen:Mar 17, 2026

Intelligence Profile

Sideloader used by EmissaryPanda

Threat Analysis

HyperSSL is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://norfolkinfosec.com/emissary-panda-dll-backdoor/
→https://twitter.com/ESETresearch/status/1594937054303236096
→https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/
→https://vblocalhost.com/uploads/VB2020-Shank-Piccolini.pdf
→https://web.archive.org/web/20200307113010/https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1574947864.pdf
→https://www.fireeye.com/blog/threat-research/2021/08/unc215-chinese-espionage-campaign-in-israel.html
→https://www.mandiant.com/resources/blog/chinese-espionage-tactics
→https://www.mandiant.com/resources/unc215-chinese-espionage-campaign-in-israel
→https://www.sstic.org/media/SSTIC2021/SSTIC-actes/Taking_Advantage_of_PE_Metadata_or_How_To_Complete/SSTIC2021-Article-Taking_Advantage_of_PE_Metadata_or_How_To_Complete_your_Favorite_Threat_Actor_Sample_Collection-lunghi.pdf
→https://www.sstic.org/media/SSTIC2021/SSTIC-actes/Taking_Advantage_of_PE_Metadata_or_How_To_Complete/SSTIC2021-Slides-Taking_Advantage_of_PE_Metadata_or_How_To_Complete_your_Favorite_Threat_Actor_Sample_Collection-lunghi.pdf

Quick Facts

TypeMalware Family
Aliases1

Also Known As

win.hyperssl

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search HyperSSL
HyperSSL — Malware Family | Threat Intelligence | CTIWATCH.COM