FORENSIA

THREAT_ACTOR · G0135

BackdoorDiplomacy

Also known as: BackdoorDiplomacy

Profile

BackdoorDiplomacy is a cyber espionage threat group that has been active since at least 2017. BackdoorDiplomacy has targeted Ministries of Foreign Affairs and telecommunication companies in Africa, Europe, the Middle East, and Asia.

MITRE ATT&CK ↗

Techniques

15 ATT&CK techniques attributed to this actor.

T1027 Obfuscated Files or InformationT1036.004 Masquerade Task or ServiceT1036.005 Match Legitimate Resource Name or LocationT1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1055.001 Dynamic-link Library InjectionT1074.001 Local Data StagingT1095 Non-Application Layer ProtocolT1105 Ingress Tool TransferT1120 Peripheral Device DiscoveryT1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1574.001 DLLT1588.001 MalwareT1588.002 Tool

Software

5 malware/tools attributed to this actor.

MimikatzChina ChopperQuasarRATNBTscanTurian

Related corpus activity

9,708 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to BackdoorDiplomacy.

IndicatorTypeFamilySevSrc
cve-2026-3102cve—853
cve-2026-1969cve—851
cve-2025-11837cve—852
cve-2014-2321cve—851
cve-2025-34117cve—851
cve-2021-29441cve—851
cve-2026-22584cve—852
cve-2013-3307cve—852
cve-2016-15047cve—854
cve-2018-8007cve—851
cve-2020-17456cve—851
cve-2025-2492cve—852
cve-2017-18377cve—851
cve-2021-25646cve—851
cve-2025-66478cve—852
cve-2025-0921cve—852
cve-2016-5681cve—852
cve-2021-27076cve—851
cve-2022-47945cve—851
cve-2025-68670cve—852
cve-2025-34054cve—854
cve-2024-1781cve—851
cve-2023-44976cveransomware852
cve-2021-4045cve—851
cve-2020-22653cve—852
cve-2020-22658cve—852
cve-2025-23304cve—852
cve-2026-4368cveransomware851
cve-2013-7471cve—851
cve-2026-0740cve—851

Showing the top 30 by severity of 9,708.