TF-MAL-elf.wellmail

Description

ThreatFox malware family `elf.wellmail`. Printable name: WellMail.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• WellMail - Threat Group Cards: A Threat Actor Encyclopedia
  web:apt.etda.or.th

  Last change to this tool card: 30 December 2022 Download this tool card in JSON format All groups using tool WellMail

  2026-05-22 05:24 UTC
• WellMail, Software S0515 | MITRE ATT&CK®
  web:attack.mitre.org

  WellMail WellMail is a lightweight malware written in Golang used by APT29, similar in design and structure to WellMess. [1] [2]

  2026-05-22 05:24 UTC
• Malware: How To Protect Against, Detect, and Remove It
  web:consumer.ftc.gov

  Malware is one of the biggest threats to the security of your computer, tablet, phone, and other devices. Learn how to protect yourself, how to tell if your device has malware , and how to remove it.

  2026-05-22 05:24 UTC
• Trellix Insights: APT29 C2 Servers: Bear Tracks lead to infrastructure ...
  web:kcm.trellix.com

  Active infrastructure believed to be associated with the Russian threat actor APT29 and used to deliver malware tracked as WellMail and WellMess was identified in a report released on July 30, 2021. The research, performed by RiskIQ, identified SSL certificates, IP addresses, and associated domain names belonging to C2 servers.

  2026-05-22 05:24 UTC
• Remediate malicious email delivered in Office 365
  web:learn.microsoft.com

  Manual and automated remediation Manual hunting occurs when security teams identify threats manually by using the search and filtering capabilities in Explorer (Threat Explorer). Manual email remediation can be triggered through any email view ( Malware , Phish, or All email) after you identify a set of emails that need to be remediated.

  2026-05-22 05:24 UTC
• WellMail (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  Details for the WellMail malware family including references, samples and yara signatures.

  2026-05-22 05:24 UTC
• Open Hunting - Threat Library
  web:openhunting.io

  The NCSC has named this malware 'WellMail' due to file paths containing the word 'mail' and the use of server port 25 present in the sample analysed. Similar to { {WellMess}}, WellMail uses hard-coded client and certificate authority TLS certificates to communicate with C2 servers.

  2026-05-22 05:24 UTC
• Malware Incident Response: The 7-Step Playbook for 2025 - Breachsense
  web:www.breachsense.com

  Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.

  2026-05-22 05:24 UTC
• Malware, Phishing, and Ransomware - CISA
  web:www.cisa.gov

  Overview Cyber-attacks can come in many forms. Malware , Phishing, and Ransomware are becoming increasingly common forms of attack and can affect individuals and large organizations. Malware is any software used to gain unauthorized access to IT systems in order to steal data, disrupt system services or damage IT networks in any way. Ransomware is a type of malware identified by specified data ...

  2026-05-22 05:24 UTC
• Mitigating malware and ransomware attacks - The National Cyber Security ...
  web:www.ncsc.gov.uk

  How to defend organisations against malware or ransomware attacks.

  2026-05-22 05:24 UTC

Only Available for Registered Users. Sign in to view.