CORESHELL

Family profile

Sofacy is an APT28-associated Windows malware family name historically used for an early-stage implant also referred to as SOURFACE, and in some reporting linked alongside the CORESHELL naming lineage. It is part of the broader malware ecosystem used by the Russian state-linked espionage group widely tracked as APT28, Fancy Bear, Sednit, or STRONTIUM. The implant has been used in targeted cyber-espionage operations against government, military, defense, political, and security-related organizations, particularly in Europe and other regions aligned with Russian intelligence priorities.

As documented in public reporting on APT28 tradecraft, Sofacy/SOURFACE functioned as a first-stage foothold used to establish access and support follow-on deployment of more capable implants. Related APT28 tooling provided remote access and modular post-compromise functionality, and the Sofacy malware lineage is associated with encrypted and Base64-encoded command-and-control communications. CORESHELL-related variants in this lineage have been observed using custom stream ciphers for command traffic, establishing persistence through Windows autostart mechanisms, and being executed through rundll32 to proxy DLL execution. The malware family is therefore best understood as part of a staged espionage toolchain rather than a standalone commodity threat.

Operationally, Sofacy was commonly delivered in highly targeted spearphishing campaigns using themed lures and malicious attachments. Once access was established, APT28 frequently deployed additional backdoors and espionage modules to expand collection and maintain resilience. The malware family is closely associated with long-running Russian intelligence collection operations and is notable for its role in the early evolution of APT28’s intrusion toolkit.

Capabilities

Defense Evasion
Initial Access
Persistence

Reported operators

Threat actors

1 named in public reporting

APT28

APT28_2011-09_Telus_Trojan.Win32.Sofacy.A ... APT28_2015-07_Telus_Trojan-Downloader.Win32.Sofacy.B ... APT28_2015-12_Kaspersky_Sofacy APT hits high profile targets | APT28_2014-10_Telus_Coreshell.A ... coreshell.dll

Exploited software

Vulnerabilities linked to CORESHELL

1 CVEs

CVE-2014-4076 TCP/IP Elevation of Privilege Vulnerability in Microsoft Windows Server 2003 SP2

MITRE ATT&CK

CORESHELL in ATT&CK

27 distinct techniques

Techniques

27 techniques

T1132 Data Encoding T1105 Ingress Tool Transfer T1082 System Information Discovery T1071.001 Web Protocols T1218.011 Rundll32 T1573 Encrypted Channel T1203 Exploitation for Client Execution T1547.001 Registry Run Keys / Startup Folder T1068 Exploitation for Privilege Escalation T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information T1046 Network Service Discovery T1059.004 Unix Shell T1059 Command and Scripting Interpreter T1012 Query Registry T1555 Credentials from Password Stores T1056.001 Keylogging T1083 File and Directory Discovery T1566.002 Spearphishing Link T1566 Phishing T1189 Drive-by Compromise T1573.001 Symmetric Cryptography T1190 Exploit Public-Facing Application T1680 Local Storage Discovery T1132.001 Standard Encoding T1071.003 Mail Protocols T1027.016 Junk Code Insertion