✕
Image
Currently viewing ATT&CK v19.2 which was live between April 28, 2026 and October 12, 2026. Learn more about the versioning system or see the live site.
ATT&CKcon 7.0 registration is open! Join us October 27-28, 2026 in McLean, VA or virtually. Register in person or register virtually. See the FAQ for hotel and venue details.
  1. Home
  2. Software
  3. Kivars

Kivars

Kivars is a modular remote access tool (RAT), derived from the Bifrost RAT, that was used by BlackTech in a 2010 campaign.[1]

ID: S0437
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.0
Created: 06 May 2020
Last Modified: 25 April 2025
Enterprise Layer
download view Image

Techniques Used

Domain ID Name Use
Enterprise T1083 File and Directory Discovery

Kivars has the ability to list drives on the infected host.[1]
Enterprise T1564 .003 Hide Artifacts: Hidden Window

Kivars has the ability to conceal its activity through hiding active windows.[1]
Enterprise T1070 .004 Indicator Removal: File Deletion

Kivars has the ability to uninstall malware from the infected host.[1]
Enterprise T1105 Ingress Tool Transfer

Kivars has the ability to download and execute files.[1]
Enterprise T1056 .001 Input Capture: Keylogging

Kivars has the ability to initiate keylogging on the infected host.[1]
Enterprise T1021 Remote Services

Kivars has the ability to remotely trigger keyboard input and mouse clicks. [1]
Enterprise T1113 Screen Capture

Kivars has the ability to capture screenshots on the infected host.[1]

Groups That Use This Software

ID Name References
G0098 BlackTech

[1][2]

References

  1. Bermejo, L., et al. (2017, June 22). Following the Trail of BlackTech’s Cyber Espionage Campaigns. Retrieved May 5, 2020.
  1. Threat Intelligence. (2020, September 29). Palmerworm: Espionage Gang Targets the Media, Finance, and Other Sectors. Retrieved March 25, 2022.