MALWARE FAMILY

PocoDown

Internal ID: win.pocodown

aliases

Last seen:Mar 17, 2026

Intelligence Profile

uses POCO C++ cross-platform library, Xor-based string obfuscation, SSL library code and string overlap with Xtunnel, infrastructure overlap with X-Agent, probably in use since mid-2018

Threat Analysis

PocoDown is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://threatvector.cylance.com/en_us/home/flirting-with-ida-and-apt28.html

→https://threatvector.cylance.com/en_us/home/inside-the-apt28-dll-backdoor-blitz.html

→https://twitter.com/cyb3rops/status/1129653190444703744

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.pocodown

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search PocoDown