MALWARE FAMILY

WellMess

Internal ID: win.wellmess

aliases

Last seen:Mar 17, 2026

Intelligence Profile

WellMess is A Remote Access Trojan written in GoLang and .NET. It has hard-coded User-Agents. Attackers deploy WellMess using separate tools which also allow lateral movement, for example "gost". Command and Control traffic is handled via HTTP using the Set-Cookie field and message body.

Threat Analysis

WellMess is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.jpcert.or.jp/2018/07/malware-wellmes-9b78.html

→https://blog.talosintelligence.com/2020/08/attribution-puzzle.html

→https://blogs.jpcert.or.jp/en/2018/07/malware-wellmes-9b78.html

→https://censys.com/advanced-persistent-infrastructure-tracking/

→https://community.riskiq.com/article/541a465f/description

→https://securelist.com/apt-trends-report-q2-2020/97937/

→https://us-cert.cisa.gov/ncas/alerts/aa21-116a

→https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198b

→https://us-cert.cisa.gov/sites/default/files/publications/AA21-116A_Russian_Foreign_Intelligence_Service_Cyber_Operations_508C.pdf

→https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-old-dogs-new-tricks.pdf

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.wellmess

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search WellMess