Wellmess

Category: ransomware · Aliases: APT.WellMess, Backdoor.WellMess, Linux/WellMess, Win32/WellMess · Sample count (EMBER 2018): 1 · Enrichment: insufficient_information · Updated: 2026-07-02T07:08:57Z

Category: RansomwareActor: Unknown / CybercriminalIndustry: Global / OpportunisticMotivation: Opportunistic

Overview

Executive Summary

WellMess is a highly sophisticated, cross-platform (Windows and Linux) malware family heavily utilized by the Russian state-sponsored Advanced Persistent Threat (APT) group known as APT29 (Cozy Bear, The Dukes). First identified in 2018, WellMess is a lightweight but powerful backdoor designed for long-term espionage and intellectual property theft. It gained significant notoriety for its role in targeting organizations involved in COVID-19 vaccine research during 2020.

Infection Vector and Technical Capabilities

APT29 typically deploys WellMess after gaining initial access to a network through the exploitation of unpatched vulnerabilities in public-facing infrastructure (e.g., Citrix, Pulse Secure, or Zimbra servers) or via highly targeted spear-phishing campaigns. Once deployed, WellMess exhibits advanced APT capabilities:

Cross-Platform Operation: Written in Go (Golang) or .NET, WellMess is designed to operate seamlessly on both Windows and Linux servers, making it highly versatile for compromising core enterprise infrastructure.
Encrypted C2 Communication: It communicates with its Command and Control (C2) servers using mutually authenticated TLS or HTTP/HTTPS, often utilizing base64 encoding and RC6 encryption to hide commands and exfiltrated data within seemingly legitimate web traffic (frequently utilizing stolen, legitimate SSL certificates).
Advanced Command Execution: The backdoor supports arbitrary shell command execution, file upload/download, and the ability to execute PowerShell scripts directly in memory without writing them to disk (fileless execution).

Threat Assessment

A WellMess detection is an absolute critical security incident (Code Red). It signifies an active, deep compromise by a highly resourced, Tier-1 state-sponsored adversary. The objective is not financial extortion (ransomware), but the stealthy, long-term theft of highly classified or proprietary intellectual property.

Incident Response and Remediation

Invoke Incident Response Retainer: A confirmed APT29 breach requires immediate escalation to specialized, external Incident Response (IR) teams and potentially national cyber security authorities (like CISA or NCSC).
Containment (Do Not Tip Off): Avoid immediate "whack-a-mole" remediation. The adversary likely has multiple redundant backdoors. Containment must be carefully planned to observe the attacker's TTPs and sever all access simultaneously.
Total Infrastructure Rebuild: Eradicating an APT requires fundamentally rebuilding compromised infrastructure from the ground up, enforcing strict network segmentation, and implementing pervasive MFA, as the adversary likely possesses global administrative credentials.

Known aliases

Threat reports may refer to this family under multiple names:

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1059.004 T1573.002 T1105 T1071.001

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

T1059.004: Restrict execution of scripting languages such as PowerShell, VBScript, or Python to authorized administrators. Enforce Script Block Logging.
T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.
T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_WELLMESS {
    meta:
        description = "Detects Wellmess (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "wellmess" ascii wide nocase
        $s2 = "apt.wellmess" ascii wide nocase
        $s3 = "backdoor.wellmess" ascii wide nocase
        $s4 = "linux/wellmess" ascii wide nocase
        $s5 = "win32/wellmess" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Wellmess Activity
id: 8e6b1016d57663d19a99643e88aba1b0
status: experimental
description: Detects generic indicators of the wellmess malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*wellmess*"
            - "*apt.wellmess*"
            - "*backdoor.wellmess*"
            - "*linux/wellmess*"
            - "*win32/wellmess*"
    condition: selection
level: medium

References & External Analysis

Search "wellmess" on VirusTotal (External Analysis)

Frequently Asked Questions

How do I remove the Wellmess Ransomware from Windows?

Manual removal of Wellmess is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.

Is Wellmess a virus or a Ransomware?

Wellmess is classified as a Ransomware. Unlike traditional viruses that infect files, modern malware like Wellmess typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.

What are the main symptoms of a Wellmess infection?

Symptoms of Wellmess can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.

Related Families (Category: ransomware)

Explore other malware families in the same category:

Protect Your Network Against Ransomwares

Want to prevent Wellmess and similar threats from compromising your organization? Read our comprehensive defensive guide: Ransomware Protection Guide.

Need help with an active incident? Published by the SystemHelpdesk team.

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/wellmess.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.