SYMBOLCOMMON_NAMEaka. SYNONYMS
win.sheriff (Back to overview)

Sheriff


According to IBM X-Force, this is a modular backdoor that was used for targeting the defense sector of Ukraine. It uses the Dropbox API for C2 and data exfiltration.

References
2025-03-25IBM X-ForceGolo Mühr
IBM X-Force discovers new Sheriff Backdoor used to target Ukraine
Deputy Sheriff

There is no Yara-Signature yet.