WellMess

Executive Summary

WellMess is a low‑profile Windows agent leveraged by APT29 for stealthy credential theft and data exfiltration. The malware exists in both .NET and Go variants, uses encrypted communication back to the command‐and‐control servers, and installs minimal persistence mechanisms to maintain long‑term access.

WellMess is a lightweight, multi‑language malware family that has been in operation since at least 2018 and is known to be used by the Russian advanced persistent threat group APT29 (Cozy Bear). The code base consists of both .NET and Go implementations, giving attackers flexibility across Windows environments while keeping the overall footprint small. Analysts first identified WellMess in July 2020 when CISA, PWC and NCSC released independent reports linking it to known Cozy Bear operations. In typical APT29 deployments, WellMess is employed as a stealthy command‑and‑control (C2) agent that gathers system metadata and harvests credentials stored in Windows Credential Manager. Once collected, data are encrypted and transmitted back to the adversary’s infrastructure over legitimate protocols such as HTTPS or DNS tunnelling. The weaponized code also supports basic persistence via registry run keys and can create or modify scheduled tasks for long‑term foothold. The malware is designed to blend into normal Windows activity, avoiding major security detection tools by keeping its size minimal and using native API calls rather than heavy shellcode. Its dual-language approach (C# and Go) also allows the threat actor to swap components depending on operational needs or defensive posture, thus complicating attribution and reverse‑engineering efforts.

Key Capabilities

• Stealthy persistence via registry run keys and scheduled tasks
• Credential harvesting from Windows Credential Manager
• Collection of system and network metadata
• Encrypted exfiltration over standard protocols (HTTPS/DNS)
• Cross‑platform code (C# .NET & Go) for flexible deployment

ATT&CK Techniques

Recommended Actions

• Implement host‑based intrusion detection with signatures matching WellMess binaries and registry changes
• Configure endpoint protection to block execution of unknown Go or .NET executables
• Use credential guard policies and monitor Credential Manager access
• Deploy network monitoring to detect anomalous HTTPS/DNS traffic to unfamiliar domains
• Apply patching for known operating system exploits that could be leveraged by similar tools

Suggested Tags