PuzzleMaker
PuzzleMaker is a nation-state APT group with an espionage motive, tracked by Brandefense. It uses 9 MITRE ATT&CK techniques.
- Techniques
- 9
- Exploited CVEs
- No CVE data
- First seen
- Jun 8, 2021
- Last seen
- Jun 8, 2021
- Record updated
How They Operate · MITRE ATT&CK.
9 techniques across 6 of 14 tacticsReconnaissance1
T1071.001
Application Layer Protocol: Web Protocols
Application Layer Protocol: Web Protocols
Resource Development·
Persistence1
T1543.003
Create or Modify System Process: Windows Service
Create or Modify System Process: Windows Service
Privilege Escalation1
T1068
Exploitation for Privilege Escalation
Exploitation for Privilege Escalation
Defense Evasion2
T1036.005
Masquerading: Match Legitimate Resource Name or Location
Masquerading: Match Legitimate Resource Name or Location
T1070.004
Indicator Removal: File Deletion
Indicator Removal: File Deletion
Credential Access·
Discovery·
Lateral Movement·
Collection·
Command and Control·
Exfiltration·
Impact·
Indicators Of Compromise.
TLP:AMBER5 indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout PuzzleMaker.
An advanced threat actor discovered in June 2021 responsible for targeted attacks utilizing chained Chrome and Windows zero-day exploits to deploy custom modular backdoors.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.