Home / Threat actors / BackdoorDiplomacy
BackdoorDiplomacy G0135
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
1
associated CVEs
17
Techniques
5
Malware and tools
BackdoorDiplomacy is a cyber espionage threat group that has been active since at least 2017. BackdoorDiplomacy has targeted Ministries of Foreign Affairs and telecommunication companies in Africa, Europe, the Middle East, and Asia.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
CVE-2020-5902
Critical · 9.8
KEV Ransomware F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
“BackdoorDiplomacy has exploited CVE-2020-5902, an F5 BIP-IP vulnerability, to drop a Linux backdoor.”
Techniques by tactic
Resource Development
T1588.001 MalwareT1588.002 Tool Initial Access
T1190 Exploit Public-Facing Application Execution
T1574.001 DLL Persistence
T1505.003 Web Shell Privilege Escalation
T1055.001 Dynamic-link Library Injection Stealth
T1027 Obfuscated Files or InformationT1036.004 Masquerade Task or ServiceT1036.005 Match Legitimate Resource Name or LocationT1055.001 Dynamic-link Library InjectionT1574.001 DLL Discovery
T1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1120 Peripheral Device Discovery Collection
T1074.001 Local Data Staging Command and Control
T1095 Non-Application Layer ProtocolT1105 Ingress Tool Transfer Malware and tools
- China ChopperMalwareS0020
- TurianMalwareS0647
- MimikatzToolS0002
- NBTscanToolS0590
- QuasarRATToolS0262
© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.