{
"enterprise-attack": {
"techniques": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [
{
"type": "attack-pattern",
"id": "attack-pattern--4bc31b94-045b-4752-8920-aebaebdb6470",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-02-21 21:08:33.237000+00:00",
"modified": "2026-08-04 20:30:54.394000+00:00",
"name": "Email Account",
"description": "Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists)\n\nIn on-premises Exchange and Exchange Online, the Get-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016)\n\nIn Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1087/003",
"external_id": "T1087.003"
},
{
"source_name": "Black Hills Attacking Exchange MailSniper, 2016",
"description": "Bullock, B.. (2016, October 3). Attacking Exchange with MailSniper. Retrieved October 6, 2019.",
"url": "https://www.blackhillsinfosec.com/attacking-exchange-with-mailsniper/"
},
{
"source_name": "Google Workspace Global Access List",
"description": "Google. (n.d.). Retrieved March 16, 2021.",
"url": "https://support.google.com/a/answer/166870?hl=en"
},
{
"source_name": "Microsoft Exchange Address Lists",
"description": "Microsoft. (2020, February 7). Address lists in Exchange Server. Retrieved March 26, 2020.",
"url": "https://docs.microsoft.com/en-us/exchange/email-addresses-and-address-books/address-lists/address-lists?view=exchserver-2019"
},
{
"source_name": "Microsoft getglobaladdresslist",
"description": "Microsoft. (n.d.). Get-GlobalAddressList. Retrieved October 6, 2019.",
"url": "https://docs.microsoft.com/en-us/powershell/module/exchange/email-addresses-and-address-books/get-globaladdresslist"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"Office Suite"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-08-04 20:30:54.394000+00:00\", \"old_value\": \"2025-10-24 17:48:44.685000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2",
"changelog_mitigations": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0229: Enumeration of Global Address Lists via Email Account Discovery"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--b6301b64-ef57-4cce-bb0b-77026f14a8db",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-01-22 21:04:23.285000+00:00",
"modified": "2026-08-04 20:30:56.386000+00:00",
"name": "Event Triggered Execution",
"description": "Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation: Backdooring an AWS account)(Citation: Varonis Power Automate Data Exfiltration)(Citation: Microsoft DART Case Report 001)\n\nAdversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.(Citation: FireEye WMI 2015)(Citation: Malware Persistence on OS X)(Citation: amnesia malware)\n\nSince the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1546",
"external_id": "T1546"
},
{
"source_name": "FireEye WMI 2015",
"description": "Ballenthin, W., et al. (2015). Windows Management Instrumentation (WMI) Offense, Defense, and Forensics. Retrieved March 30, 2016.",
"url": "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf"
},
{
"source_name": "Microsoft DART Case Report 001",
"description": "Berk Veral. (2020, March 9). Real-life cybercrime stories from DART, the Microsoft Detection and Response Team. Retrieved May 27, 2022.",
"url": "https://www.microsoft.com/security/blog/2020/03/09/real-life-cybercrime-stories-dart-microsoft-detection-and-response-team"
},
{
"source_name": "amnesia malware",
"description": "Claud Xiao, Cong Zheng, Yanhui Jia. (2017, April 6). New IoT/Linux Malware Targets DVRs, Forms Botnet. Retrieved February 19, 2018.",
"url": "https://researchcenter.paloaltonetworks.com/2017/04/unit42-new-iotlinux-malware-targets-dvrs-forms-botnet/"
},
{
"source_name": "Backdooring an AWS account",
"description": "Daniel Grzelak. (2016, July 9). Backdooring an AWS account. Retrieved May 27, 2022.",
"url": "https://medium.com/daniel-grzelak/backdooring-an-aws-account-da007d36f8f9"
},
{
"source_name": "Varonis Power Automate Data Exfiltration",
"description": "Eric Saraga. (2022, February 2). Using Power Automate for Covert Data Exfiltration in Microsoft 365. Retrieved May 27, 2022.",
"url": "https://www.varonis.com/blog/power-automate-data-exfiltration"
},
{
"source_name": "Malware Persistence on OS X",
"description": "Patrick Wardle. (2015). Malware Persistence on OS X Yosemite. Retrieved July 10, 2017.",
"url": "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows",
"SaaS",
"IaaS",
"Office Suite"
],
"x_mitre_version": "1.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-08-04 20:30:56.386000+00:00\", \"old_value\": \"2025-10-24 17:49:15.866000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.4",
"changelog_mitigations": {
"shared": [
"M1026: Privileged Account Management",
"M1051: Update Software"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0010: Behavioral Detection of Event Triggered Execution Across Platforms"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--9db0cf3a-a3c9-4012-8268-123b9db6fd82",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-04-18 17:59:24.739000+00:00",
"modified": "2026-08-04 20:30:55.427000+00:00",
"name": "Exploitation of Remote Services",
"description": "Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code.\u00a0A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.\n\nAn adversary may need to determine if the remote system is in a vulnerable state, which may be done through [Network Service Discovery](https://attack.mitre.org/techniques/T1046) or other Discovery methods looking for common, vulnerable software that may be deployed in the network, the lack of certain patches that may indicate vulnerabilities, or security software that may be used to detect or contain remote exploitation. Servers are likely a high value target for lateral movement exploitation, but endpoint systems may also be at risk if they provide an advantage or access to additional resources.\n\nThere are several well-known vulnerabilities that exist in common services such as SMB(Citation: CIS Multiple SMB Vulnerabilities) and RDP(Citation: NVD CVE-2017-0176) as well as applications that may be used within internal networks such as MySQL(Citation: NVD CVE-2016-6662) and web server services.(Citation: NVD CVE-2014-7169)(Citation: Ars Technica VMWare Code Execution Vulnerability 2021) Additionally, there have been a number of vulnerabilities in VMware vCenter installations, which may enable threat actors to move laterally from the compromised vCenter server to virtual machines or even to ESXi hypervisors.(Citation: Broadcom VMSA-2024-0019)\n\nDepending on the permissions level of the vulnerable remote service an adversary may achieve [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068) as a result of lateral movement exploitation as well.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "lateral-movement"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1210",
"external_id": "T1210"
},
{
"source_name": "Broadcom VMSA-2024-0019",
"description": "Broadcom. (2024, September 17). VMSA-2024-0019: Questions & Answers. Retrieved April 8, 2025.",
"url": "https://github.com/vmware/vcf-security-and-compliance-guidelines/blob/main/security-advisories/vmsa-2024-0019/README.md"
},
{
"source_name": "CIS Multiple SMB Vulnerabilities",
"description": "CIS. (2017, May 15). Multiple Vulnerabilities in Microsoft Windows SMB Server Could Allow for Remote Code Execution. Retrieved April 3, 2018.",
"url": "https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-microsoft-windows-smb-server-could-allow-for-remote-code-execution/"
},
{
"source_name": "Ars Technica VMWare Code Execution Vulnerability 2021",
"description": "Dan Goodin . (2021, February 25). Code-execution flaw in VMware has a severity rating of 9.8 out of 10. Retrieved April 8, 2025.",
"url": "https://arstechnica.com/information-technology/2021/02/armed-with-exploits-hackers-on-the-prowl-for-a-critical-vmware-vulnerability/"
},
{
"source_name": "NVD CVE-2016-6662",
"description": "National Vulnerability Database. (2017, February 2). CVE-2016-6662 Detail. Retrieved April 3, 2018.",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6662"
},
{
"source_name": "NVD CVE-2017-0176",
"description": "National Vulnerability Database. (2017, June 22). CVE-2017-0176 Detail. Retrieved April 3, 2018.",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0176"
},
{
"source_name": "NVD CVE-2014-7169",
"description": "National Vulnerability Database. (2017, September 24). CVE-2014-7169 Detail. Retrieved April 3, 2018.",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7169"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"ExtraHop"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"Windows",
"macOS",
"ESXi"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-08-04 20:30:55.427000+00:00\", \"old_value\": \"2025-10-24 17:49:09.112000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2",
"changelog_mitigations": {
"shared": [
"M1016: Vulnerability Scanning",
"M1019: Threat Intelligence Program",
"M1026: Privileged Account Management",
"M1030: Network Segmentation",
"M1042: Disable or Remove Feature or Program",
"M1048: Application Isolation and Sandboxing",
"M1050: Exploit Protection",
"M1051: Update Software"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0118: Exploitation of Remote Services \u2013 multi-platform lateral movement detection"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--0cf55441-b176-4332-89e7-2c4c7799d0ff",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-06-07 13:20:23.767000+00:00",
"modified": "2026-08-04 20:30:53.394000+00:00",
"name": "Email Hiding Rules",
"description": "Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails. Rules may be created or modified within email clients or through external features such as the New-InboxRule or Set-InboxRule [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets on Windows systems.(Citation: Microsoft Inbox Rules)(Citation: MacOS Email Rules)(Citation: Microsoft New-InboxRule)(Citation: Microsoft Set-InboxRule)\n\nAdversaries may utilize email rules within a compromised user's mailbox to delete and/or move emails to less noticeable folders. Adversaries may do this to hide security alerts, C2 communication, or responses to [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) emails sent from the compromised account.\n\nAny user or administrator within the organization (or adversary with valid credentials) may be able to create rules to automatically move or delete emails. These rules can be abused to impair/delay detection had the email content been immediately seen by a user or defender. Malicious rules commonly filter out emails based on key words (such as malware, suspicious, phish, and hack) found in message bodies and subject lines. (Citation: Microsoft Cloud App Security)\n\nIn some environments, administrators may be able to enable email rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsoft Mail Flow Rules 2023) Adversaries that abuse such features may be able to automatically modify or delete all emails related to specific topics (such as internal security incident notifications).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1564/008",
"external_id": "T1564.008"
},
{
"source_name": "MacOS Email Rules",
"description": "Apple. (n.d.). Use rules to manage emails you receive in Mail on Mac. Retrieved June 14, 2021.",
"url": "https://support.apple.com/guide/mail/use-rules-to-manage-emails-you-receive-mlhlp1017/mac"
},
{
"source_name": "Microsoft Mail Flow Rules 2023",
"description": "Microsoft. (2023, February 22). Mail flow rules (transport rules) in Exchange Online. Retrieved March 13, 2023.",
"url": "https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules"
},
{
"source_name": "Microsoft Inbox Rules",
"description": "Microsoft. (n.d.). Manage email messages by using rules. Retrieved June 11, 2021.",
"url": "https://support.microsoft.com/en-us/office/manage-email-messages-by-using-rules-c24f5dea-9465-4df4-ad17-a50704d66c59"
},
{
"source_name": "Microsoft New-InboxRule",
"description": "Microsoft. (n.d.). New-InboxRule. Retrieved June 7, 2021.",
"url": "https://docs.microsoft.com/en-us/powershell/module/exchange/new-inboxrule?view=exchange-ps"
},
{
"source_name": "Microsoft Set-InboxRule",
"description": "Microsoft. (n.d.). Set-InboxRule. Retrieved June 7, 2021.",
"url": "https://docs.microsoft.com/en-us/powershell/module/exchange/set-inboxrule?view=exchange-ps"
},
{
"source_name": "Microsoft Cloud App Security",
"description": "Niv Goldenberg. (2018, December 12). Rule your inbox with Microsoft Cloud App Security. Retrieved June 7, 2021.",
"url": "https://techcommunity.microsoft.com/t5/security-compliance-and-identity/rule-your-inbox-with-microsoft-cloud-app-security/ba-p/299154"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Dor Edry, Microsoft",
"Liran Ravich, CardinalOps"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"Linux",
"macOS",
"Office Suite"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-08-04 20:30:53.394000+00:00\", \"old_value\": \"2026-05-12 15:12:00.620000+00:00\"}}}",
"previous_version": "2.0",
"changelog_mitigations": {
"shared": [
"M1047: Audit"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0192: Detection Strategy for Email Hiding Rules"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--16e94db9-b5b1-4cd0-b851-f38fbd0a70f2",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-02-21 21:15:33.222000+00:00",
"modified": "2026-08-04 20:30:53.932000+00:00",
"name": "Cloud Groups",
"description": "Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group.\n\nWith authenticated access there are several tools that can be used to find permissions groups. The Get-MsolRole PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts (Citation: Microsoft Msolrole)(Citation: GitHub Raindance).\n\nAzure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups. The command az ad user get-member-groups will list groups associated to a user account for Azure while the API endpoint GET https://cloudidentity.googleapis.com/v1/groups lists group resources available to a user for Google.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation) In AWS, the commands `ListRolePolicies` and `ListAttachedRolePolicies` allow users to enumerate the policies attached to a role.(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022)\n\nAdversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS GetBucketAcl API (Citation: AWS Get Bucket ACL). Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1069/003",
"external_id": "T1069.003"
},
{
"source_name": "AWS Get Bucket ACL",
"description": "Amazon Web Services. (n.d.). Retrieved May 28, 2021.",
"url": "https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketAcl.html"
},
{
"source_name": "Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022",
"description": "Dror Alon. (2022, December 8). Compromised Cloud Compute Credentials: Case Studies From the Wild. Retrieved March 9, 2023.",
"url": "https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/"
},
{
"source_name": "Black Hills Red Teaming MS AD Azure, 2018",
"description": "Felch, M.. (2018, August 31). Red Teaming Microsoft Part 1 Active Directory Leaks via Azure. Retrieved October 6, 2019.",
"url": "https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/"
},
{
"source_name": "Google Cloud Identity API Documentation",
"description": "Google. (n.d.). Retrieved March 16, 2021.",
"url": "https://cloud.google.com/identity/docs/reference/rest"
},
{
"source_name": "Microsoft AZ CLI",
"description": "Microsoft. (n.d.). az ad user. Retrieved October 6, 2019.",
"url": "https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest"
},
{
"source_name": "Microsoft Msolrole",
"description": "Microsoft. (n.d.). Get-MsolRole. Retrieved October 6, 2019.",
"url": "https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolrole?view=azureadps-1.0"
},
{
"source_name": "GitHub Raindance",
"description": "Stringer, M.. (2018, November 21). RainDance. Retrieved October 6, 2019.",
"url": "https://github.com/True-Demon/raindance"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Regina Elwell",
"Isif Ibrahima, Mandiant"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"SaaS",
"IaaS",
"Office Suite",
"Identity Provider"
],
"x_mitre_version": "1.5",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-08-04 20:30:53.932000+00:00\", \"old_value\": \"2025-10-24 17:48:26.982000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.5",
"changelog_mitigations": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0251: Behavioral Detection of Cloud Group Enumeration via API and CLI Access"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--7de1f7ac-5d0c-4c9c-8873-627202205331",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-08-03 03:20:58.955000+00:00",
"modified": "2026-08-04 20:30:54.961000+00:00",
"name": "Steal or Forge Authentication Certificates",
"description": "Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts.(Citation: O365 Blog Azure AD Device IDs)(Citation: Microsoft AD CS Overview)\n\nAuthentication certificates can be both stolen and forged. For example, AD CS certificates can be stolen from encrypted storage (in the Registry or files)(Citation: APT29 Deep Look at Credential Roaming), misplaced certificate files (i.e. [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)), or directly from the Windows certificate store via various crypto APIs.(Citation: SpecterOps Certified Pre Owned)(Citation: GitHub CertStealer)(Citation: GitHub GhostPack Certificates) With appropriate enrollment rights, users and/or machines within a domain can also request and/or manually renew certificates from enterprise certificate authorities (CA). This enrollment process defines various settings and permissions associated with the certificate. Of note, the certificate\u2019s extended key usage (EKU) values define signing, encryption, and authentication use cases, while the certificate\u2019s subject alternative name (SAN) values define the certificate owner\u2019s alternate names.(Citation: Medium Certified Pre Owned)\n\nAbusing certificates for authentication credentials may enable other behaviors such as [Lateral Movement](https://attack.mitre.org/tactics/TA0008). Certificate-related misconfigurations may also enable opportunities for [Privilege Escalation](https://attack.mitre.org/tactics/TA0004), by way of allowing users to impersonate or assume privileged accounts or permissions via the identities (SANs) associated with a certificate. These abuses may also enable [Persistence](https://attack.mitre.org/tactics/TA0003) via stealing or forging certificates that can be used as [Valid Accounts](https://attack.mitre.org/techniques/T1078) for the duration of the certificate's validity, despite user password resets. Authentication certificates can also be stolen and forged for machine accounts.\n\nAdversaries who have access to root (or subordinate) CA certificate private keys (or mechanisms protecting/managing these keys) may also establish [Persistence](https://attack.mitre.org/tactics/TA0003) by forging arbitrary authentication certificates for the victim domain (known as \u201cgolden\u201d certificates).(Citation: Medium Certified Pre Owned) Adversaries may also target certificates and related services in order to access other forms of credentials, such as [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) ticket-granting tickets (TGT) or NTLM plaintext.(Citation: Medium Certified Pre Owned)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1649",
"external_id": "T1649"
},
{
"source_name": "GitHub GhostPack Certificates",
"description": "HarmJ0y. (2018, August 22). SharpDPAPI - Certificates. Retrieved August 2, 2022.",
"url": "https://github.com/GhostPack/SharpDPAPI#certificates"
},
{
"source_name": "Microsoft AD CS Overview",
"description": "Microsoft. (2016, August 31). Active Directory Certificate Services Overview. Retrieved August 2, 2022.",
"url": "https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831740(v=ws.11)"
},
{
"source_name": "Medium Certified Pre Owned",
"description": "Schroeder, W. (2021, June 17). Certified Pre-Owned. Retrieved August 2, 2022.",
"url": "https://posts.specterops.io/certified-pre-owned-d95910965cd2"
},
{
"source_name": "SpecterOps Certified Pre Owned",
"description": "Schroeder, W. & Christensen, L. (2021, June 22). Certified Pre-Owned - Abusing Active Directory Certificate Services. Retrieved August 2, 2022.",
"url": "https://web.archive.org/web/20220818094600/https://specterops.io/assets/resources/Certified_Pre-Owned.pdf"
},
{
"source_name": "O365 Blog Azure AD Device IDs",
"description": "Syynimaa, N. (2022, February 15). Stealing and faking Azure AD device identities. Retrieved August 3, 2022.",
"url": "https://o365blog.com/post/deviceidentity/"
},
{
"source_name": "GitHub CertStealer",
"description": "TheWover. (2021, April 21). CertStealer. Retrieved August 2, 2022.",
"url": "https://github.com/TheWover/CertStealer"
},
{
"source_name": "APT29 Deep Look at Credential Roaming",
"description": "Thibault Van Geluwe De Berlaere. (2022, November 8). They See Me Roaming: Following APT29 by Taking a Deeper Look at Windows Credential Roaming. Retrieved November 9, 2022.",
"url": "https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Tristan Bennett, Seamless Intelligence",
"Lee Christensen, SpecterOps",
"Thirumalai Natarajan, Mandiant"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"Linux",
"macOS",
"Identity Provider"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-08-04 20:30:54.961000+00:00\", \"old_value\": \"2025-04-15 23:12:50.646000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2",
"changelog_mitigations": {
"shared": [
"M1015: Active Directory Configuration",
"M1041: Encrypt Sensitive Information",
"M1042: Disable or Remove Feature or Program",
"M1047: Audit"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0240: Detection Strategy for Steal or Forge Authentication Certificates"
],
"new": [],
"dropped": []
}
}
],
"revocations": [],
"deprecations": [],
"deletions": []
},
"software": {
"additions": [
{
"type": "malware",
"id": "malware--5b30f717-1d7b-4e91-a97d-be361d00aa5e",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-07-24 17:52:27.451000+00:00",
"modified": "2026-07-31 02:39:34.113000+00:00",
"name": "CanisterWorm",
"description": "[CanisterWorm](https://attack.mitre.org/software/S9042) is a self-propagating malware that has been used by [TeamPCP](https://attack.mitre.org/groups/G1056) in credential harvesting and software supply chain campaigns since at least 2026. [CanisterWorm](https://attack.mitre.org/software/S9042) has used npm credentials to infect software packages and propagate across developer ecosystems. [CanisterWorm](https://attack.mitre.org/software/S9042) has a targeted wiper component and can use decentralized C2 infrastructure implemented via an Internet Computer Protocol (ICP) blockchain canister.(Citation: Aikido TeamPCP Telnyx MAR 2026)(Citation: Palo Alto TeamPCP MAR 2026)(Citation: Aikido CanisterWorm MAR 2026)(Citation: Aikido TeamPCP Trivy MAR 2026)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S9042",
"external_id": "S9042"
},
{
"source_name": "Aikido TeamPCP Trivy MAR 2026",
"description": "Eriksen, C. (2026, March 20). TeamPCP deploys CanisterWorm on NPM following Trivy compromise. Retrieved July 27, 2026.",
"url": "https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise"
},
{
"source_name": "Aikido CanisterWorm MAR 2026",
"description": "Eriksen, C. (2026, March 22). CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran. Retrieved July 27, 2026.",
"url": "https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran"
},
{
"source_name": "Aikido TeamPCP Telnyx MAR 2026",
"description": "Eriksen, C. (2026, March 27). Popular telnyx package compromised on PyPI by TeamPCP. Retrieved July 16, 2026.",
"url": "https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm"
},
{
"source_name": "Palo Alto TeamPCP MAR 2026",
"description": "Unit 42. (2026, March 31). Weaponizing the Protectors: TeamPCP\u2019s Multi-Stage Supply Chain Attack on Security Infrastructure. Retrieved July 1, 2026.",
"url": "https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"CanisterWorm"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Dhanvarshini Gopalsamy, NEC Corporation India",
"Kamei Risa, NEC Corporation",
"Sareena Karapoola, NEC Corporation India"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Containers",
"Linux"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--f5a56c26-e192-489d-a77e-a8b38fd70eee",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-07-30 20:47:44.241000+00:00",
"modified": "2026-07-31 03:34:21.895000+00:00",
"name": "Kali365",
"description": "[Kali365](https://attack.mitre.org/software/S9044) is a Phishing-as-a-Service (PHaaS) kit first observed in April 2026 that generates victim-targeted lures across multiple operating systems to induce users into copying and pasting actor-controlled commands for local execution.(Citation: Artic Wolf Labs Kali365 Device Code April 2026)(Citation: FBI IC3 Alert I-052126 Kali365 May 2026)(Citation: Huntress Kali365 Device Code June 2026)(Citation: SpyCloud Kali365 June 2026) [Kali365](https://attack.mitre.org/software/S9044) incorporates on-demand device code generation and mirrors the copy-paste execution tradecraft associated with ClickFix. (Citation: Huntress Kali365 Device Code June 2026) Operators have used [Kali365](https://attack.mitre.org/software/S9044) to harvest victims' OAuth tokens and session cookies through adversary-in-the-middle (AiTM) interception, enabling account takeover.(Citation: Artic Wolf Labs Kali365 Device Code April 2026)(Citation: Artic Wolf Kali365 Device Code OAuth June 2026)(Citation: FBI IC3 Alert I-052126 Kali365 May 2026)(Citation: Huntress Kali365 Device Code June 2026)(Citation: SpyCloud Kali365 June 2026) [Kali365](https://attack.mitre.org/software/S9044) PHaaS was first observed in April 2026.(Citation: Artic Wolf Labs Kali365 Device Code April 2026) [Kali365](https://attack.mitre.org/software/S9044) has also been affiliated with other branding to include Octopi365 and Freedom365.(Citation: Huntress Kali365 Device Code June 2026)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S9044",
"external_id": "S9044"
},
{
"source_name": "Artic Wolf Labs Kali365 Device Code April 2026",
"description": "Artic Wolf Labs. (2026, April 24). Token Bingo: Don\u2019t Let Your Code be the Winner. Retrieved July 30, 2026.",
"url": "https://arcticwolf.com/resources/blog/token-bingo-dont-let-your-code-be-the-winner/"
},
{
"source_name": "Artic Wolf Kali365 Device Code OAuth June 2026",
"description": "Artic Wolf Labs. (2026, June 2). Retrieved July 30, 2026.",
"url": "https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/"
},
{
"source_name": "FBI IC3 Alert I-052126 Kali365 May 2026",
"description": "Federal Bureau of Investigation. (2026, May 21). Alert Number: I-052126-PSA: Kali365 Phishing-as-a-Service Kit Hijacks Microsoft 365 Access Tokens. Retrieved July 30, 2026.",
"url": "https://www.ic3.gov/PSA/2026/PSA260521"
},
{
"source_name": "Huntress Kali365 Device Code June 2026",
"description": "Tanner Flip. (2026, June 11). Hook, Line, and Token: Anatomy of the Kali365 / Octopi365 Phishing-as-a-Service Kit. Retrieved July 30, 2026.",
"url": "https://www.huntress.com/blog/kali365-device-code-phishing-kit"
},
{
"source_name": "SpyCloud Kali365 June 2026",
"description": "Trevor Hilligoss. (2026, June 11). Kali365: Anatomy of a Microsoft 365 Phishing-as-a-Service Kit \u2013 From Telegram Hype to FBI Takedown Theater. Retrieved July 30, 2026.",
"url": "https://spycloud.com/blog/kali365-anatomy-of-a-microsoft365-phishing-as-a-service-kit/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"Kali365"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"IaaS",
"macOS",
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--7f211b2e-c008-4cac-9ea8-29bd7edd50a4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-07-29 14:50:38.891000+00:00",
"modified": "2026-07-31 02:40:12.281000+00:00",
"name": "Mini Shai-Hulud",
"description": "[Mini Shai-Hulud](https://attack.mitre.org/software/S9043) is a credential stealer and self-replicating supply chain worm, derived from [Shai-Hulud](https://attack.mitre.org/software/S9008), that has been used by [TeamPCP](https://attack.mitre.org/groups/G1056) to target Continuous Integration and Continuous Delivery/Deployment (CI/CD) workflows since at least 2026. [Mini Shai-Hulud](https://attack.mitre.org/software/S9043) can compromise credentials across multiple cloud, container, and AI configuration file paths and can use stolen npm and GitHub OIDC tokens to spread to other packages maintained by the compromised user. [Mini Shai-Hulud](https://attack.mitre.org/software/S9043) also has a targeted wiper component and has used multiple C2 and data exfiltration mechanisms.(Citation: Wiz Mini Shai-Hulud MAY 2026)(Citation: Trend Micro TeamPCP MAY 2026)(Citation: Hunt.io TeamPCP Toolkit MAY 2026)(Citation: Phoenix TeamPCP 20 MAY 2026)(Citation: Flashpoint Mini Shai-Hulud MAY 2026)(Citation: FBI TeamPCP JUL 2026)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S9043",
"external_id": "S9043"
},
{
"source_name": "FBI TeamPCP JUL 2026",
"description": "FBI. (2026, July 2). Cyber Criminal Group TeamPCP. Retrieved July 7, 2026.",
"url": "https://www.ic3.gov/CSA/2026/260702.pdf"
},
{
"source_name": "Flashpoint Mini Shai-Hulud MAY 2026",
"description": "Flashpoint. (2026, May 28). The Mini Shai-Hulud Worm and the New Era of CI/CD Exploitation. Retrieved July 16, 2026.",
"url": "https://flashpoint.io/blog/mini-shai-hulud-worm-new-era-ci-cd-exploitation/"
},
{
"source_name": "Hunt.io TeamPCP Toolkit MAY 2026",
"description": "Hunt.io. (2026, May 14). How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account. Retrieved July 16, 2026.",
"url": "https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"
},
{
"source_name": "Wiz Mini Shai-Hulud MAY 2026",
"description": "McCarthy, R., Cohen, A., and Read, B. (2026, May 12). Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised. Retrieved July 16, 2026.",
"url": "https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised"
},
{
"source_name": "Trend Micro TeamPCP MAY 2026",
"description": "Santos, J. and Navato, J.R. (2026, May 13). Analyzing TeamPCP\u2019s Supply Chain Attacks: Checkmarx KICS and elementary-data in CI/CD Credential Theft. Retrieved July 16, 2026.",
"url": "https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"
},
{
"source_name": "Phoenix TeamPCP 20 MAY 2026",
"description": "Webb, M. (2026, May 20). TeamPCP Wave Four: GitHub Breach via Poisoned VS Code Extension, durabletask PyPI Worm, and ~4,000 Internal Repositories Exfiltrated. Retrieved July 16, 2026.",
"url": "https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"Mini Shai-Hulud"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Rajkumar Barot"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Containers",
"IaaS",
"Linux",
"macOS",
"SaaS",
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--fe5b2f0f-8fdc-459d-85b7-dd45c0217a0c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-07-01 21:11:27.530000+00:00",
"modified": "2026-07-31 02:42:44.295000+00:00",
"name": "TeamPCP Cloud Stealer",
"description": "The [TeamPCP Cloud Stealer](https://attack.mitre.org/software/S9041) is a comprehensive filesystem credential stealer that can harvest, encrypt, and exfiltrate credentials from over 50 sensitive file paths across CI/CD, cloud, developer tooling, and container environments. The [TeamPCP Cloud Stealer](https://attack.mitre.org/software/S9041) was the primary payload used by [TeamPCP](https://attack.mitre.org/groups/G1056) in March 2026 during early stages of a cascading supply chain campaign targeting CI/CD workflows.(Citation: Wiz Trivy Compromise MAR 2026)(Citation: Aqua Security Trivy Compromise MAR 2026)(Citation: Aqua Security Blog Trivy Compromise APR 2026)(Citation: Sysdig TeamPCP MAR 2026)(Citation: Wiz TeamPCP KICS MAR 2026)(Citation: Palo Alto TeamPCP MAR 2026)(Citation: Google AI Threat Tracker MAY 2026)(Citation: FBI TeamPCP JUL 2026)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S9041",
"external_id": "S9041"
},
{
"source_name": "SANDCLOCK",
"description": "(Citation: Google AI Threat Tracker MAY 2026)(Citation: FBI TeamPCP JUL 2026)"
},
{
"source_name": "Aqua Security Trivy Compromise MAR 2026",
"description": "Aqua Security . (2026, March 21). Trivy ecosystem supply chain temporarily compromised. Retrieved July 1, 2026.",
"url": "https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23"
},
{
"source_name": "Aqua Security Blog Trivy Compromise APR 2026",
"description": "Aqua Team. (2026, April 1). Update: Ongoing Investigation and Continued Remediation. Retrieved July 1, 2026.",
"url": "https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"
},
{
"source_name": "FBI TeamPCP JUL 2026",
"description": "FBI. (2026, July 2). Cyber Criminal Group TeamPCP. Retrieved July 7, 2026.",
"url": "https://www.ic3.gov/CSA/2026/260702.pdf"
},
{
"source_name": "Google AI Threat Tracker MAY 2026",
"description": "Google Threat Intelligence Group. (2026, May 11). GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access. Retrieved July 7, 2026.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access"
},
{
"source_name": "Wiz Trivy Compromise MAR 2026",
"description": "McCarthy, R. (2026, March 20). Trivy Compromised: Everything You Need to Know about the Latest Supply Chain Attack. Retrieved July 1, 2026.",
"url": "https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"
},
{
"source_name": "Wiz TeamPCP KICS MAR 2026",
"description": "McCarthy, R., Haughom, J., Read, B. (2026, March 23). KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack. Retrieved July 1, 2026.",
"url": "https://www.wiz.io/blog/teampcp-attack-kics-github-action"
},
{
"source_name": "Sysdig TeamPCP MAR 2026",
"description": "Sysdig Threat Research Team. (2026, March 23). TeamPCP expands: Supply chain compromise spreads from Trivy to Checkmarx GitHub Actions. Retrieved July 1, 2026.",
"url": "https://www.sysdig.com/blog/teampcp-expands-supply-chain-compromise-spreads-from-trivy-to-checkmarx-github-actions"
},
{
"source_name": "Palo Alto TeamPCP MAR 2026",
"description": "Unit 42. (2026, March 31). Weaponizing the Protectors: TeamPCP\u2019s Multi-Stage Supply Chain Attack on Security Infrastructure. Retrieved July 1, 2026.",
"url": "https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"TeamPCP Cloud Stealer",
"SANDCLOCK"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Containers",
"Linux",
"macOS",
"SaaS",
"Windows"
],
"x_mitre_version": "1.0"
}
],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [],
"revocations": [],
"deprecations": [],
"deletions": []
},
"groups": {
"additions": [
{
"type": "intrusion-set",
"id": "intrusion-set--5e30362d-935b-4b1c-8bf2-96c7b7b7e299",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-07-29 14:27:00.016000+00:00",
"modified": "2026-07-31 18:47:57.967000+00:00",
"name": "ShinyHunters",
"description": "[ShinyHunters](https://attack.mitre.org/groups/G1057) is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. [ShinyHunters](https://attack.mitre.org/groups/G1057) has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. [ShinyHunters](https://attack.mitre.org/groups/G1057) has been associated with the broader collective called The Community, also known as The Com whose members have also included [Scattered Spider](https://attack.mitre.org/groups/G1015) and [LAPSUS$](https://attack.mitre.org/groups/G1004). Public reporting has mentioned a variety of names for operations [ShinyHunters](https://attack.mitre.org/groups/G1057) members have reportedly conducted with members of other groups, including \u201cScattered Lapsus Hunters,\u201d \u201cScattered Lapsus Shiny Hunters,\u201d and \u201cSLSH.\u201d(Citation: ElecticIQ Buyukkaya_ShinyHunters_Sept2025)(Citation: SOCRadar_ShinyHunters_Mar2024)(Citation: Unit42KelleyVaya_BlingLibra_Aug2024)(Citation: Intel471_SH_Aug2021)(Citation: FBI_SHLMS_May2026)(Citation: Google_SHOracle_Jun2026)(Citation: Mandiant_SHDataTheft_Jan2026)(Citation: Google Salesforce JUN 2025)",
"aliases": [
"ShinyHunters",
"UNC6240",
"Bling Libra"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1057",
"external_id": "G1057"
},
{
"source_name": "UNC6240",
"description": "(Citation: Mandiant_SHDataTheft_Jan2026)(Citation: Google_SHOracle_Jun2026)"
},
{
"source_name": "Bling Libra",
"description": "(Citation: Unit42KelleyVaya_BlingLibra_Aug2024)"
},
{
"source_name": "ElecticIQ Buyukkaya_ShinyHunters_Sept2025",
"description": "B\u00fcy\u00fckkaya, A. (2025, September 22). ShinyHunters Calling: Financially Motivated Data Extortion Group Targeting Enterprise Cloud Applications. Retrieved May 18, 2026.",
"url": "https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications"
},
{
"source_name": "FBI_SHLMS_May2026",
"description": "Federal Bureau of Investigation. (2026, May 15). ShinyHunters: Cyber Criminal Group Attacks Learning Management System. Retrieved July 1, 2026.",
"url": "https://www.ic3.gov/PSA/2026/PSA260515"
},
{
"source_name": "Google Salesforce JUN 2025",
"description": "Google Threat Intelligence Group. (2025, June 4). The Cost of a Call: From Voice Phishing to Data Extortion. Retrieved October 22, 2025.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion"
},
{
"source_name": "Intel471_SH_Aug2021",
"description": "Intel 471. (2021, August 23). Here\u2019s how to guard your enterprise against ShinyHunters. Retrieved July 29, 2026.",
"url": "https://www.intel471.com/blog/shinyhunters-data-breach-mitre-attack"
},
{
"source_name": "Unit42KelleyVaya_BlingLibra_Aug2024",
"description": "Kelley, M., Vaya, C. (2024, August 23). Bling Libra\u2019s Tactical Evolution: The Threat Actor Group Behind ShinyHunters Ransomware. Retrieved May 18, 2026.",
"url": "https://unit42.paloaltonetworks.com/shinyhunters-ransomware-extortion/"
},
{
"source_name": "Google_SHOracle_Jun2026",
"description": "Mandiant, Google Threat Intelligence Group. (2026, June 11). ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit. Retrieved June 11, 2026.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"
},
{
"source_name": "Mandiant_SHDataTheft_Jan2026",
"description": "Mandiant. (2026, January 30). Vishing for Access: Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft. Retrieved June 16, 2026.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft"
},
{
"source_name": "SOCRadar_ShinyHunters_Mar2024",
"description": "SOCRadar. (2024, March 18). Dark Web Profile: ShinyHunters. Retrieved May 18, 2026.",
"url": "https://socradar.io/dark-web-profile-shinyhunters/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--20f26558-e05d-46cf-8847-c2b5a83ee779",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-07-16 15:13:31.109000+00:00",
"modified": "2026-07-31 18:47:42.686000+00:00",
"name": "TeamPCP",
"description": "[TeamPCP](https://attack.mitre.org/groups/G1056) is a financially-motivated, cloud-native threat group that has been active since at least September 2025. Initially focused on ransomware and cryptocurrency theft, [TeamPCP](https://attack.mitre.org/groups/G1056) shifted in early 2026 to systematic, worm-driven credential theft and software supply chain attacks targeting Continuous Integration and Continuous Delivery (CI/CD) workflows. [TeamPCP](https://attack.mitre.org/groups/G1056) has monetized access through extortion and through partnerships with ransomware actors including Vect and CipherForce.(Citation: Wiz TeamPCP Profile MAY 2026)(Citation: Wiz Trivy Compromise MAR 2026)(Citation: Aqua Security Trivy Compromise MAR 2026)(Citation: Aqua Security Blog Trivy Compromise APR 2026)(Citation: Palo Alto TeamPCP MAR 2026)(Citation: Trend Micro TeamPCP MAY 2026)",
"aliases": [
"TeamPCP",
"PCPCat",
"ShellForce",
"DeadCatx3",
"SHADOW-WATER-058",
"UNC6780"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1056",
"external_id": "G1056"
},
{
"source_name": "UNC6780",
"description": "(Citation: Google AI Threat Tracker MAY 2026)"
},
{
"source_name": "PCPCat",
"description": "(Citation: Palo Alto TeamPCP MAR 2026)"
},
{
"source_name": "ShellForce",
"description": "(Citation: Palo Alto TeamPCP MAR 2026)"
},
{
"source_name": "DeadCatx3",
"description": "(Citation: Palo Alto TeamPCP MAR 2026)"
},
{
"source_name": "Aqua Security Trivy Compromise MAR 2026",
"description": "Aqua Security . (2026, March 21). Trivy ecosystem supply chain temporarily compromised. Retrieved July 1, 2026.",
"url": "https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23"
},
{
"source_name": "Aqua Security Blog Trivy Compromise APR 2026",
"description": "Aqua Team. (2026, April 1). Update: Ongoing Investigation and Continued Remediation. Retrieved July 1, 2026.",
"url": "https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"
},
{
"source_name": "Google AI Threat Tracker MAY 2026",
"description": "Google Threat Intelligence Group. (2026, May 11). GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access. Retrieved July 7, 2026.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access"
},
{
"source_name": "Wiz Trivy Compromise MAR 2026",
"description": "McCarthy, R. (2026, March 20). Trivy Compromised: Everything You Need to Know about the Latest Supply Chain Attack. Retrieved July 1, 2026.",
"url": "https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"
},
{
"source_name": "Trend Micro TeamPCP MAY 2026",
"description": "Santos, J. and Navato, J.R. (2026, May 13). Analyzing TeamPCP\u2019s Supply Chain Attacks: Checkmarx KICS and elementary-data in CI/CD Credential Theft. Retrieved July 16, 2026.",
"url": "https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"
},
{
"source_name": "Palo Alto TeamPCP MAR 2026",
"description": "Unit 42. (2026, March 31). Weaponizing the Protectors: TeamPCP\u2019s Multi-Stage Supply Chain Attack on Security Infrastructure. Retrieved July 1, 2026.",
"url": "https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"
},
{
"source_name": "Wiz TeamPCP Profile MAY 2026",
"description": "Wiz. (2026, May 20). TeamPCP. Retrieved July 16, 2026.",
"url": "https://threats.wiz.io/all-actors/teampcp"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Kamei Risa, NEC Corporation",
"Sareena Karapoola, NEC Corporation India",
"Dhanvarshini Gopalsamy, NEC Corporation India",
"Rajkumar Barot",
"Jose Moya Villalba"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0"
}
],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [
{
"type": "intrusion-set",
"id": "intrusion-set--8332952e-b86b-486b-acc3-1c2a85d39394",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-26 18:38:00.759000+00:00",
"modified": "2026-07-31 20:48:39.666000+00:00",
"name": "APT-C-23",
"description": "[APT-C-23](https://attack.mitre.org/groups/G1028) is a threat group that has been active since at least 2014.(Citation: symantec_mantis) [APT-C-23](https://attack.mitre.org/groups/G1028) has primarily focused its operations on the Middle East, including Israeli military assets. [APT-C-23](https://attack.mitre.org/groups/G1028) has developed mobile spyware targeting Android and iOS devices since 2017.(Citation: welivesecurity_apt-c-23)",
"aliases": [
"APT-C-23",
"Mantis",
"Arid Viper",
"Desert Falcon",
"TAG-63",
"Grey Karkadann",
"Big Bang APT",
"Two-tailed Scorpion"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1028",
"external_id": "G1028"
},
{
"source_name": "Big Bang APT",
"description": "(Citation: checkpoint_interactive_map_apt-c-23) "
},
{
"source_name": "Grey Karkadann",
"description": "(Citation: sentinelone_israel_hamas_war)"
},
{
"source_name": "Mantis",
"description": "(Citation: symantec_mantis)(Citation: sentinelone_israel_hamas_war)"
},
{
"source_name": "Two-tailed Scorpion",
"description": "(Citation: welivesecurity_apt-c-23)"
},
{
"source_name": "Arid Viper",
"description": "(Citation: welivesecurity_apt-c-23)(Citation: sentinelone_israel_hamas_war)(Citation: fb_arid_viper)"
},
{
"source_name": "Desert Falcon",
"description": "(Citation: welivesecurity_apt-c-23)(Citation: sentinelone_israel_hamas_war)(Citation: fb_arid_viper)"
},
{
"source_name": "fb_arid_viper",
"description": "Flossman, M., Scott, M. (2021, April). Technical Paper // Taking Action Against Arid Viper. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20231126111812/https:/about.fb.com/wp-content/uploads/2021/04/Technical-threat-report-Arid-Viper-April-2021.pdf"
},
{
"source_name": "sentinelone_israel_hamas_war",
"description": "Hegel, T., Milenkoski, A. (2023, October 24). The Israel-Hamas War | Cyber Domain State-Sponsored Activity of Interest. Retrieved March 4, 2024.",
"url": "https://web.archive.org/web/20240208234008/www.sentinelone.com/labs/the-israel-hamas-war-cyber-domain-state-sponsored-activity-of-interest/"
},
{
"source_name": "checkpoint_interactive_map_apt-c-23",
"description": "Kayal, A. (2018, August 26). Interactive Mapping of APT-C-23. Retrieved March 4, 2024.",
"url": "https://web.archive.org/web/20230604112435/https://research.checkpoint.com/2018/interactive-mapping-of-apt-c-23/"
},
{
"source_name": "welivesecurity_apt-c-23",
"description": "Stefanko, L. (2020, September 30). APT\u2011C\u201123 group evolves its Android spyware. Retrieved March 4, 2024.",
"url": "https://web.archive.org/web/20201123042131/www.welivesecurity.com/2020/09/30/aptc23-group-evolves-its-android-spyware/"
},
{
"source_name": "symantec_mantis",
"description": "Symantec Threat Hunter Team. (2023, April 4). Mantis: New Tooling Used in Attacks Against Palestinian Targets. Retrieved March 4, 2024.",
"url": "https://web.archive.org/web/20231227054130/https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/mantis-palestinian-attacks"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Sittikorn Sangrattanapitak"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:39.666000+00:00\", \"old_value\": \"2024-11-17 20:01:55.806000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--c4d50cdf-87ce-407d-86d8-862883485842",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-05-05 18:53:08.166000+00:00",
"modified": "2026-07-31 18:48:17.693000+00:00",
"name": "APT-C-36",
"description": "[APT-C-36](https://attack.mitre.org/groups/G0099) is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. [APT-C-36](https://attack.mitre.org/groups/G0099) has targeted government institutions and entities in the financial, energy, and professional manufacturing sectors across Colombia and other Latin American countries.(Citation: QiAnXin APT-C-36 Feb2019)(Citation: Kaspersky BlindEagle AUG 2024)(Citation: Check Point Blind Eagle MAR 2025)(Citation: Recorded Future TAG-144 AUG 2025)",
"aliases": [
"APT-C-36",
"Blind Eagle",
"TAG-144",
"AguilaCiega",
"APT-Q-98"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0099",
"external_id": "G0099"
},
{
"source_name": "Blind Eagle",
"description": "(Citation: QiAnXin APT-C-36 Feb2019)(Citation: Recorded Future TAG-144 AUG 2025)"
},
{
"source_name": "TAG-144",
"description": "(Citation: Recorded Future TAG-144 AUG 2025)"
},
{
"source_name": "AguilaCiega",
"description": "(Citation: Recorded Future TAG-144 AUG 2025)"
},
{
"source_name": "APT-Q-98",
"description": "(Citation: Recorded Future TAG-144 AUG 2025)"
},
{
"source_name": "Check Point Blind Eagle MAR 2025",
"description": "Check Point Research. (2025, March 10). Blind Eagle: \u2026And Justice for All. Retrieved April 16, 2026.",
"url": "https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"
},
{
"source_name": "Kaspersky BlindEagle AUG 2024",
"description": "Global Research & Analysis Team, Kaspersky. (2024, August 19). BlindEagle flying high in Latin America. Retrieved April 16, 2026.",
"url": "https://securelist.com/blindeagle-apt/113414/"
},
{
"source_name": "Recorded Future TAG-144 AUG 2025",
"description": "Insikt Group. (2025, August 26). TAG-144\u2019s Persistent Grip on South American Organizations. Retrieved April 16, 2026.",
"url": "https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"
},
{
"source_name": "QiAnXin APT-C-36 Feb2019",
"description": "QiAnXin Threat Intelligence Center. (2019, February 18). APT-C-36: Continuous Attacks Targeting Colombian Government Institutions and Corporations. Retrieved May 5, 2020.",
"url": "https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Jose Luis S\u00e1nchez Martinez"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:17.693000+00:00\", \"old_value\": \"2026-04-23 03:37:06.250000+00:00\"}}}",
"previous_version": "2.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--6a2e693f-24e5-451a-9f88-b36a108e5662",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:47.955000+00:00",
"modified": "2026-07-31 18:47:59.697000+00:00",
"name": "APT1",
"description": "[APT1](https://attack.mitre.org/groups/G0006) is a Chinese threat group that has been attributed to the 2nd Bureau of the People\u2019s Liberation Army (PLA) General Staff Department\u2019s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398. (Citation: Mandiant APT1)",
"aliases": [
"APT1",
"Comment Crew",
"Comment Group",
"Comment Panda"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0006",
"external_id": "G0006"
},
{
"source_name": "APT1",
"description": "(Citation: Mandiant APT1)"
},
{
"source_name": "Comment Crew",
"description": "(Citation: Mandiant APT1)"
},
{
"source_name": "Comment Group",
"description": "(Citation: Mandiant APT1)"
},
{
"source_name": "Comment Panda",
"description": "(Citation: CrowdStrike Putter Panda)"
},
{
"source_name": "Mandiant APT1",
"description": "Mandiant. (n.d.). APT1 Exposing One of China\u2019s Cyber Espionage Units. Retrieved July 18, 2016.",
"url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
},
{
"source_name": "CrowdStrike Putter Panda",
"description": "Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.",
"url": "http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:59.697000+00:00\", \"old_value\": \"2025-04-25 14:49:20.672000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.4"
},
{
"type": "intrusion-set",
"id": "intrusion-set--c47f937f-1022-4f42-8525-e7a4779a14cb",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:47.537000+00:00",
"modified": "2026-07-31 18:48:17.463000+00:00",
"name": "APT12",
"description": "[APT12](https://attack.mitre.org/groups/G0005) is a threat group that has been attributed to China. The group has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments.(Citation: Meyers Numbered Panda)",
"aliases": [
"APT12",
"IXESHE",
"DynCalc",
"Numbered Panda",
"DNSCALC"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0005",
"external_id": "G0005"
},
{
"source_name": "APT12",
"description": "(Citation: Meyers Numbered Panda) (Citation: Moran 2014)"
},
{
"source_name": "IXESHE",
"description": "(Citation: Meyers Numbered Panda) (Citation: Moran 2014)"
},
{
"source_name": "DynCalc",
"description": "(Citation: Meyers Numbered Panda) (Citation: Moran 2014)"
},
{
"source_name": "Numbered Panda",
"description": "(Citation: Meyers Numbered Panda)"
},
{
"source_name": "DNSCALC",
"description": "(Citation: Moran 2014)"
},
{
"source_name": "Meyers Numbered Panda",
"description": "Meyers, A. (2013, March 29). Whois Numbered Panda. Retrieved January 14, 2016.",
"url": "http://www.crowdstrike.com/blog/whois-numbered-panda/"
},
{
"source_name": "Moran 2014",
"description": "Moran, N., Oppenheim, M., Engle, S., & Wartell, R.. (2014, September 3). Darwin\u2019s Favorite APT Group [Blog]. Retrieved November 12, 2014.",
"url": "https://www.fireeye.com/blog/threat-research/2014/09/darwins-favorite-apt-group-2.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:17.463000+00:00\", \"old_value\": \"2025-04-25 14:49:18.305000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--d6e88e18-81e8-4709-82d8-973095da1e70",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:56.270000+00:00",
"modified": "2026-07-31 18:48:21.512000+00:00",
"name": "APT16",
"description": "[APT16](https://attack.mitre.org/groups/G0023) is a China-based threat group that has launched spearphishing campaigns targeting Japanese and Taiwanese organizations. (Citation: FireEye EPS Awakens Part 2)",
"aliases": [
"APT16"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0023",
"external_id": "G0023"
},
{
"source_name": "APT16",
"description": "(Citation: FireEye EPS Awakens Part 2)"
},
{
"source_name": "FireEye EPS Awakens Part 2",
"description": "Winters, R. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.",
"url": "https://web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:21.512000+00:00\", \"old_value\": \"2025-04-16 20:37:41.686000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--090242d7-73fc-4738-af68-20162f7a5aae",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:57.307000+00:00",
"modified": "2026-07-31 18:47:36.723000+00:00",
"name": "APT17",
"description": "[APT17](https://attack.mitre.org/groups/G0025) is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations. (Citation: FireEye APT17)",
"aliases": [
"APT17",
"Deputy Dog"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0025",
"external_id": "G0025"
},
{
"source_name": "APT17",
"description": "(Citation: FireEye APT17)"
},
{
"source_name": "Deputy Dog",
"description": "(Citation: FireEye APT17)"
},
{
"source_name": "FireEye APT17",
"description": "FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20240119213200/https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:36.723000+00:00\", \"old_value\": \"2024-11-17 15:03:54.769000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--38fd6a28-3353-4f2b-bb2b-459fecd5c648",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:57.733000+00:00",
"modified": "2026-07-31 18:47:50.082000+00:00",
"name": "APT18",
"description": "[APT18](https://attack.mitre.org/groups/G0026) is a threat group that has operated since at least 2009 and has targeted a range of industries, including technology, manufacturing, human rights groups, government, and medical. (Citation: Dell Lateral Movement)",
"aliases": [
"APT18",
"TG-0416",
"Dynamite Panda",
"Threat Group-0416"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0026",
"external_id": "G0026"
},
{
"source_name": "Threat Group-0416",
"description": "(Citation: ThreatStream Evasion Analysis)"
},
{
"source_name": "APT18",
"description": "(Citation: ThreatStream Evasion Analysis)(Citation: Anomali Evasive Maneuvers July 2015)"
},
{
"source_name": "TG-0416",
"description": "(Citation: ThreatStream Evasion Analysis)(Citation: Anomali Evasive Maneuvers July 2015)"
},
{
"source_name": "Dynamite Panda",
"description": "(Citation: ThreatStream Evasion Analysis)(Citation: Anomali Evasive Maneuvers July 2015)"
},
{
"source_name": "Dell Lateral Movement",
"description": "Carvey, H.. (2014, September 2). Where you AT?: Indicators of lateral movement using at.exe on Windows 7 systems. Retrieved January 25, 2016.",
"url": "http://www.secureworks.com/resources/blog/where-you-at-indicators-of-lateral-movement-using-at-exe-on-windows-7-systems/"
},
{
"source_name": "Anomali Evasive Maneuvers July 2015",
"description": "Shelmire, A. (2015, July 06). Evasive Maneuvers by the Wekby group with custom ROP-packing and DNS covert channels. Retrieved November 15, 2018.",
"url": "https://www.anomali.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop"
},
{
"source_name": "ThreatStream Evasion Analysis",
"description": "Shelmire, A.. (2015, July 6). Evasive Maneuvers. Retrieved January 22, 2016.",
"url": "https://www.threatstream.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:50.082000+00:00\", \"old_value\": \"2024-04-11 03:03:44.056000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--fe8796a4-2a02-41a0-9d27-7aa1e995feb6",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-10-17 00:14:20.652000+00:00",
"modified": "2026-07-31 18:48:29.759000+00:00",
"name": "APT19",
"description": "[APT19](https://attack.mitre.org/groups/G0073) is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. In 2017, a phishing campaign was used to target seven law and investment firms. (Citation: FireEye APT19) Some analysts track [APT19](https://attack.mitre.org/groups/G0073) and [Deep Panda](https://attack.mitre.org/groups/G0009) as the same group, but it is unclear from open source information if the groups are the same. (Citation: ICIT China's Espionage Jul 2016) (Citation: FireEye APT Groups) (Citation: Unit 42 C0d0so0 Jan 2016)",
"aliases": [
"APT19",
"Codoso",
"C0d0so0",
"Codoso Team",
"Sunshop Group"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0073",
"external_id": "G0073"
},
{
"source_name": "Sunshop Group",
"description": "(Citation: Dark Reading Codoso Feb 2015)"
},
{
"source_name": "Codoso Team",
"description": "(Citation: FireEye APT Groups)"
},
{
"source_name": "APT19",
"description": "(Citation: FireEye APT19)"
},
{
"source_name": "Codoso",
"description": "(Citation: Unit 42 C0d0so0 Jan 2016)"
},
{
"source_name": "C0d0so0",
"description": "(Citation: Unit 42 C0d0so0 Jan 2016)"
},
{
"source_name": "FireEye APT19",
"description": "Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.",
"url": "https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"
},
{
"source_name": "Dark Reading Codoso Feb 2015",
"description": "Chickowski, E. (2015, February 10). Chinese Hacking Group Codoso Team Uses Forbes.com As Watering Hole. Retrieved September 13, 2018.",
"url": "https://www.darkreading.com/attacks-breaches/chinese-hacking-group-codoso-team-uses-forbescom-as-watering-hole-/d/d-id/1319059"
},
{
"source_name": "FireEye APT Groups",
"description": "FireEye. (n.d.). Advanced Persistent Threat Groups. Retrieved August 3, 2018.",
"url": "https://www.fireeye.com/current-threats/apt-groups.html#apt19"
},
{
"source_name": "Unit 42 C0d0so0 Jan 2016",
"description": "Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.",
"url": "https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/"
},
{
"source_name": "ICIT China's Espionage Jul 2016",
"description": "Scott, J. and Spaniel, D. (2016, July 28). ICIT Brief - China\u2019s Espionage Dynasty: Economic Death by a Thousand Cuts. Retrieved June 7, 2018.",
"url": "https://web.archive.org/web/20171017072306/https://icitech.org/icit-brief-chinas-espionage-dynasty-economic-death-by-a-thousand-cuts/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"FS-ISAC",
"Darren Spruell"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.6",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:29.759000+00:00\", \"old_value\": \"2024-04-11 03:03:02.576000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.6"
},
{
"type": "intrusion-set",
"id": "intrusion-set--bef4c620-0787-42a8-a96d-b7eb6e85917c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:48.664000+00:00",
"modified": "2026-07-31 20:48:44.067000+00:00",
"name": "APT28",
"description": "[APT28](https://attack.mitre.org/groups/G0007) is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub August 2020)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021) This group has been active since at least 2004.(Citation: DOJ GRU Indictment Jul 2018)(Citation: Ars Technica GRU indictment Jul 2018)(Citation: Crowdstrike DNC June 2016)(Citation: FireEye APT28)(Citation: SecureWorks TG-4127)(Citation: FireEye APT28 January 2017)(Citation: GRIZZLY STEPPE JAR)(Citation: Sofacy DealersChoice)(Citation: Palo Alto Sofacy 06-2018)(Citation: Symantec APT28 Oct 2018)(Citation: ESET Zebrocy May 2019)\n\n[APT28](https://attack.mitre.org/groups/G0007) reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.(Citation: Crowdstrike DNC June 2016) In 2018, the US indicted five GRU Unit 26165 officers associated with [APT28](https://attack.mitre.org/groups/G0007) for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.(Citation: US District Court Indictment GRU Oct 2018) Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as [Sandworm Team](https://attack.mitre.org/groups/G0034). ",
"aliases": [
"APT28",
"IRON TWILIGHT",
"SNAKEMACKEREL",
"Swallowtail",
"Group 74",
"Sednit",
"Sofacy",
"Pawn Storm",
"Fancy Bear",
"STRONTIUM",
"Tsar Team",
"Threat Group-4127",
"TG-4127",
"Forest Blizzard",
"FROZENLAKE",
"GruesomeLarch"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0007",
"external_id": "G0007"
},
{
"source_name": "SNAKEMACKEREL",
"description": "(Citation: Accenture SNAKEMACKEREL Nov 2018)"
},
{
"source_name": "Fancy Bear",
"description": "(Citation: Crowdstrike DNC June 2016)(Citation: Kaspersky Sofacy)(Citation: ESET Sednit Part 3)(Citation: Ars Technica GRU indictment Jul 2018)(Citation: Talos Seduploader Oct 2017)(Citation: Symantec APT28 Oct 2018)(Citation: Securelist Sofacy Feb 2018)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)"
},
{
"source_name": "Tsar Team",
"description": "(Citation: ESET Sednit Part 3)(Citation: Talos Seduploader Oct 2017)(Citation: Talos Seduploader Oct 2017)"
},
{
"source_name": "APT28",
"description": "(Citation: FireEye APT28) (Citation: SecureWorks TG-4127) (Citation: Crowdstrike DNC June 2016) (Citation: Kaspersky Sofacy) (Citation: ESET Sednit Part 3) (Citation: Ars Technica GRU indictment Jul 2018)(Citation: Talos Seduploader Oct 2017)(Citation: Symantec APT28 Oct 2018)(Citation: Securelist Sofacy Feb 2018)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)"
},
{
"source_name": "STRONTIUM",
"description": "(Citation: Kaspersky Sofacy)(Citation: ESET Sednit Part 3)(Citation: Microsoft STRONTIUM Aug 2019)(Citation: Microsoft STRONTIUM New Patterns Cred Harvesting Sept 2020)(Citation: TrendMicro Pawn Storm Dec 2020)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)"
},
{
"source_name": "FROZENLAKE",
"description": "(Citation: Leonard TAG 2023)"
},
{
"source_name": "Forest Blizzard",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "GruesomeLarch",
"description": "(Citation: Nearest Neighbor Volexity)"
},
{
"source_name": "IRON TWILIGHT",
"description": "(Citation: Secureworks IRON TWILIGHT Profile)(Citation: Secureworks IRON TWILIGHT Active Measures March 2017)"
},
{
"source_name": "Threat Group-4127",
"description": "(Citation: SecureWorks TG-4127)"
},
{
"source_name": "TG-4127",
"description": "(Citation: SecureWorks TG-4127)"
},
{
"source_name": "Pawn Storm",
"description": "(Citation: SecureWorks TG-4127)(Citation: ESET Sednit Part 3)(Citation: TrendMicro Pawn Storm Dec 2020) "
},
{
"source_name": "Swallowtail",
"description": "(Citation: Symantec APT28 Oct 2018)"
},
{
"source_name": "Group 74",
"description": "(Citation: Talos Seduploader Oct 2017)"
},
{
"source_name": "Accenture SNAKEMACKEREL Nov 2018",
"description": "Accenture Security. (2018, November 29). SNAKEMACKEREL. Retrieved April 15, 2019.",
"url": "https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"
},
{
"source_name": "Crowdstrike DNC June 2016",
"description": "Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016.",
"url": "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
},
{
"source_name": "Leonard TAG 2023",
"description": "Billy Leonard. (2023, April 19). Ukraine remains Russia\u2019s biggest cyber focus in 2023. Retrieved March 1, 2024.",
"url": "https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"
},
{
"source_name": "US District Court Indictment GRU Oct 2018",
"description": "Brady, S . (2018, October 3). Indictment - United States vs Aleksei Sergeyevich Morenets, et al.. Retrieved October 1, 2020.",
"url": "https://www.justice.gov/opa/page/file/1098481/download"
},
{
"source_name": "GRIZZLY STEPPE JAR",
"description": "Department of Homeland Security and Federal Bureau of Investigation. (2016, December 29). GRIZZLY STEPPE \u2013 Russian Malicious Cyber Activity. Retrieved January 11, 2017.",
"url": "https://www.us-cert.gov/sites/default/files/publications/JAR_16-20296A_GRIZZLY%20STEPPE-2016-1229.pdf"
},
{
"source_name": "ESET Zebrocy May 2019",
"description": "ESET Research. (2019, May 22). A journey to Zebrocy land. Retrieved June 20, 2019.",
"url": "https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/"
},
{
"source_name": "ESET Sednit Part 3",
"description": "ESET. (2016, October). En Route with Sednit - Part 3: A Mysterious Downloader. Retrieved November 21, 2016.",
"url": "http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf"
},
{
"source_name": "Sofacy DealersChoice",
"description": "Falcone, R. (2018, March 15). Sofacy Uses DealersChoice to Target European Government Agency. Retrieved June 4, 2018.",
"url": "https://researchcenter.paloaltonetworks.com/2018/03/unit42-sofacy-uses-dealerschoice-target-european-government-agency/"
},
{
"source_name": "FireEye APT28 January 2017",
"description": "FireEye iSIGHT Intelligence. (2017, January 11). APT28: At the Center of the Storm. Retrieved November 17, 2024.",
"url": "https://www.mandiant.com/sites/default/files/2021-09/APT28-Center-of-Storm-2017.pdf"
},
{
"source_name": "FireEye APT28",
"description": "FireEye. (2015). APT28: A WINDOW INTO RUSSIA\u2019S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.",
"url": "https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"
},
{
"source_name": "Ars Technica GRU indictment Jul 2018",
"description": "Gallagher, S. (2018, July 27). How they did it (and will likely try again): GRU hackers vs. US elections. Retrieved September 13, 2018.",
"url": "https://arstechnica.com/information-technology/2018/07/from-bitly-to-x-agent-how-gru-hackers-targeted-the-2016-presidential-election/"
},
{
"source_name": "TrendMicro Pawn Storm Dec 2020",
"description": "Hacquebord, F., Remorin, L. (2020, December 17). Pawn Storm\u2019s Lack of Sophistication as a Strategy. Retrieved January 13, 2021.",
"url": "https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html"
},
{
"source_name": "Securelist Sofacy Feb 2018",
"description": "Kaspersky Lab's Global Research & Analysis Team. (2018, February 20). A Slice of 2017 Sofacy Activity. Retrieved November 27, 2018.",
"url": "https://securelist.com/a-slice-of-2017-sofacy-activity/83930/"
},
{
"source_name": "Kaspersky Sofacy",
"description": "Kaspersky Lab's Global Research and Analysis Team. (2015, December 4). Sofacy APT hits high profile targets with updated toolset. Retrieved December 10, 2015.",
"url": "https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/"
},
{
"source_name": "Nearest Neighbor Volexity",
"description": "Koessel, Sean. Adair, Steven. Lancaster, Tom. (2024, November 22). The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access. Retrieved February 25, 2025.",
"url": "https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/"
},
{
"source_name": "Palo Alto Sofacy 06-2018",
"description": "Lee, B., Falcone, R. (2018, June 06). Sofacy Group\u2019s Parallel Attacks. Retrieved June 18, 2018.",
"url": "https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"
},
{
"source_name": "Talos Seduploader Oct 2017",
"description": "Mercer, W., et al. (2017, October 22). \"Cyber Conflict\" Decoy Document Used in Real Cyber Conflict. Retrieved November 2, 2018.",
"url": "https://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft STRONTIUM New Patterns Cred Harvesting Sept 2020",
"description": "Microsoft Threat Intelligence Center (MSTIC). (2020, September 10). STRONTIUM: Detecting new patterns in credential harvesting. Retrieved September 11, 2020.",
"url": "https://www.microsoft.com/security/blog/2020/09/10/strontium-detecting-new-patters-credential-harvesting/"
},
{
"source_name": "Microsoft STRONTIUM Aug 2019",
"description": "MSRC Team. (2019, August 5). Corporate IoT \u2013 a path to intrusion. Retrieved August 16, 2019.",
"url": "https://msrc-blog.microsoft.com/2019/08/05/corporate-iot-a-path-to-intrusion/"
},
{
"source_name": "DOJ GRU Indictment Jul 2018",
"description": "Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved November 17, 2024.",
"url": "https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"
},
{
"source_name": "Cybersecurity Advisory GRU Brute Force Campaign July 2021",
"description": "NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.",
"url": "https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"
},
{
"source_name": "NSA/FBI Drovorub August 2020",
"description": "NSA/FBI. (2020, August). Russian GRU 85th GTsSS Deploys Previously Undisclosed Drovorub Malware. Retrieved August 25, 2020.",
"url": "https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF"
},
{
"source_name": "SecureWorks TG-4127",
"description": "SecureWorks Counter Threat Unit Threat Intelligence. (2016, June 16). Threat Group-4127 Targets Hillary Clinton Presidential Campaign. Retrieved August 3, 2016.",
"url": "https://www.secureworks.com/research/threat-group-4127-targets-hillary-clinton-presidential-campaign"
},
{
"source_name": "Secureworks IRON TWILIGHT Active Measures March 2017",
"description": "Secureworks CTU. (2017, March 30). IRON TWILIGHT Supports Active Measures. Retrieved February 28, 2022.",
"url": "https://www.secureworks.com/research/iron-twilight-supports-active-measures"
},
{
"source_name": "Secureworks IRON TWILIGHT Profile",
"description": "Secureworks CTU. (n.d.). IRON TWILIGHT. Retrieved February 28, 2022.",
"url": "https://www.secureworks.com/research/threat-profiles/iron-twilight"
},
{
"source_name": "Symantec APT28 Oct 2018",
"description": "Symantec Security Response. (2018, October 04). APT28: New Espionage Operations Target Military and Government Organizations. Retrieved November 14, 2018.",
"url": "https://www.symantec.com/blogs/election-security/apt28-espionage-military-government"
},
{
"source_name": "Sednit",
"description": "This designation has been used in reporting both to refer to the threat group and its associated malware [JHUHUGIT](https://attack.mitre.org/software/S0044).(Citation: FireEye APT28 January 2017)(Citation: SecureWorks TG-4127)(Citation: Kaspersky Sofacy)(Citation: Ars Technica GRU indictment Jul 2018)"
},
{
"source_name": "Sofacy",
"description": "This designation has been used in reporting both to refer to the threat group and its associated malware.(Citation: FireEye APT28)(Citation: SecureWorks TG-4127)(Citation: Crowdstrike DNC June 2016)(Citation: ESET Sednit Part 3)(Citation: Ars Technica GRU indictment Jul 2018)(Citation: Talos Seduploader Oct 2017)"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Drew Church, Splunk",
"Emily Ratliff, IBM",
"Richard Gold, Digital Shadows",
"S\u00e9bastien Ruel, CGI"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "5.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:44.067000+00:00\", \"old_value\": \"2026-05-12 15:12:00.732000+00:00\"}}}",
"previous_version": "5.3"
},
{
"type": "intrusion-set",
"id": "intrusion-set--899ce53f-13a0-479b-a0e4-67d46e241542",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:52.748000+00:00",
"modified": "2026-07-31 18:48:06.517000+00:00",
"name": "APT29",
"description": "[APT29](https://attack.mitre.org/groups/G0016) is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).(Citation: White House Imposing Costs RU Gov April 2021)(Citation: UK Gov Malign RIS Activity April 2021) They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. [APT29](https://attack.mitre.org/groups/G0016) reportedly compromised the Democratic National Committee starting in the summer of 2015.(Citation: F-Secure The Dukes)(Citation: GRIZZLY STEPPE JAR)(Citation: Crowdstrike DNC June 2016)(Citation: UK Gov UK Exposes Russia SolarWinds April 2021)\n\nIn April 2021, the US and UK governments attributed the [SolarWinds Compromise](https://attack.mitre.org/campaigns/C0024) to the SVR; public statements included citations to [APT29](https://attack.mitre.org/groups/G0016), Cozy Bear, and The Dukes.(Citation: NSA Joint Advisory SVR SolarWinds April 2021)(Citation: UK NSCS Russia SolarWinds April 2021) Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: MSTIC NOBELIUM Mar 2021)(Citation: CrowdStrike SUNSPOT Implant January 2021)(Citation: Volexity SolarWinds)(Citation: Cybersecurity Advisory SVR TTP May 2021)(Citation: Unit 42 SolarStorm December 2020)",
"aliases": [
"APT29",
"IRON RITUAL",
"IRON HEMLOCK",
"NobleBaron",
"Dark Halo",
"NOBELIUM",
"UNC2452",
"YTTRIUM",
"The Dukes",
"Cozy Bear",
"CozyDuke",
"SolarStorm",
"Blue Kitsune",
"UNC3524",
"Midnight Blizzard"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0016",
"external_id": "G0016"
},
{
"source_name": "CozyDuke",
"description": "(Citation: Crowdstrike DNC June 2016)"
},
{
"source_name": "Cozy Bear",
"description": "(Citation: Crowdstrike DNC June 2016)(Citation: ESET Dukes October 2019)(Citation: NCSC APT29 July 2020)(Citation: Cybersecurity Advisory SVR TTP May 2021)(Citation: CrowdStrike StellarParticle January 2022)"
},
{
"source_name": "The Dukes",
"description": "(Citation: F-Secure The Dukes)(Citation: ESET Dukes October 2019)(Citation: NCSC APT29 July 2020)(Citation: Cybersecurity Advisory SVR TTP May 2021)"
},
{
"source_name": "APT29",
"description": "(Citation: F-Secure The Dukes)(Citation: FireEye APT29 Nov 2018)(Citation: ESET Dukes October 2019)(Citation: NCSC APT29 July 2020)(Citation: Cybersecurity Advisory SVR TTP May 2021)"
},
{
"source_name": "UNC2452",
"description": "(Citation: FireEye SUNBURST Backdoor December 2020)"
},
{
"source_name": "UNC3524",
"description": "(Citation: Mandiant APT29 Eye Spy Email Nov 22)"
},
{
"source_name": "Midnight Blizzard",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "YTTRIUM",
"description": "(Citation: Microsoft Unidentified Dec 2018)"
},
{
"source_name": "NOBELIUM",
"description": "(Citation: MSTIC NOBELIUM Mar 2021)(Citation: MSTIC NOBELIUM May 2021)(Citation: MSTIC Nobelium Toolset May 2021)(Citation: MSRC Nobelium June 2021)"
},
{
"source_name": "Blue Kitsune",
"description": "(Citation: PWC WellMess July 2020)(Citation: PWC WellMess C2 August 2020)"
},
{
"source_name": "IRON HEMLOCK",
"description": "(Citation: Secureworks IRON HEMLOCK Profile)"
},
{
"source_name": "IRON RITUAL",
"description": "(Citation: Secureworks IRON RITUAL Profile)"
},
{
"source_name": "NobleBaron",
"description": "(Citation: SentinelOne NobleBaron June 2021)"
},
{
"source_name": "SolarStorm",
"description": "(Citation: Unit 42 SolarStorm December 2020)"
},
{
"source_name": "Dark Halo",
"description": "(Citation: Volexity SolarWinds)"
},
{
"source_name": "Crowdstrike DNC June 2016",
"description": "Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016.",
"url": "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
},
{
"source_name": "Volexity SolarWinds",
"description": "Cash, D. et al. (2020, December 14). Dark Halo Leverages SolarWinds Compromise to Breach Organizations. Retrieved December 29, 2020.",
"url": "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/"
},
{
"source_name": "CrowdStrike SUNSPOT Implant January 2021",
"description": "CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021.",
"url": "https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/"
},
{
"source_name": "CrowdStrike StellarParticle January 2022",
"description": "CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022.",
"url": "https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/"
},
{
"source_name": "GRIZZLY STEPPE JAR",
"description": "Department of Homeland Security and Federal Bureau of Investigation. (2016, December 29). GRIZZLY STEPPE \u2013 Russian Malicious Cyber Activity. Retrieved January 11, 2017.",
"url": "https://www.us-cert.gov/sites/default/files/publications/JAR_16-20296A_GRIZZLY%20STEPPE-2016-1229.pdf"
},
{
"source_name": "FireEye APT29 Nov 2018",
"description": "Dunwoody, M., et al. (2018, November 19). Not So Cozy: An Uncomfortable Examination of a Suspected APT29 Phishing Campaign. Retrieved November 27, 2018.",
"url": "https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html"
},
{
"source_name": "F-Secure The Dukes",
"description": "F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.",
"url": "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"
},
{
"source_name": "ESET Dukes October 2019",
"description": "Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.",
"url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
},
{
"source_name": "FireEye SUNBURST Backdoor December 2020",
"description": "FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.",
"url": "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
},
{
"source_name": "SentinelOne NobleBaron June 2021",
"description": "Guerrero-Saade, J. (2021, June 1). NobleBaron | New Poisoned Installers Could Be Used In Supply Chain Attacks. Retrieved August 4, 2021.",
"url": "https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/"
},
{
"source_name": "Mandiant APT29 Eye Spy Email Nov 22",
"description": "Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023.",
"url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft Unidentified Dec 2018",
"description": "Microsoft Defender Research Team. (2018, December 3). Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers. Retrieved April 15, 2019.",
"url": "https://www.microsoft.com/security/blog/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/"
},
{
"source_name": "MSTIC NOBELIUM May 2021",
"description": "Microsoft Threat Intelligence Center (MSTIC). (2021, May 27). New sophisticated email-based attack from NOBELIUM. Retrieved May 28, 2021.",
"url": "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
},
{
"source_name": "MSRC Nobelium June 2021",
"description": "MSRC. (2021, June 25). New Nobelium activity. Retrieved August 4, 2021.",
"url": "https://msrc-blog.microsoft.com/2021/06/25/new-nobelium-activity/"
},
{
"source_name": "MSTIC Nobelium Toolset May 2021",
"description": "MSTIC. (2021, May 28). Breaking down NOBELIUM\u2019s latest early-stage toolset. Retrieved August 4, 2021.",
"url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
},
{
"source_name": "MSTIC NOBELIUM Mar 2021",
"description": "Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM\u2019s layered persistence. Retrieved March 8, 2021.",
"url": "https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"
},
{
"source_name": "NCSC APT29 July 2020",
"description": "National Cyber Security Centre. (2020, July 16). Advisory: APT29 targets COVID-19 vaccine development. Retrieved September 29, 2020.",
"url": "https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf"
},
{
"source_name": "Cybersecurity Advisory SVR TTP May 2021",
"description": "NCSC, CISA, FBI, NSA. (2021, May 7). Further TTPs associated with SVR cyber actors. Retrieved July 29, 2021.",
"url": "https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf"
},
{
"source_name": "NSA Joint Advisory SVR SolarWinds April 2021",
"description": "NSA, FBI, DHS. (2021, April 15). Russian SVR Targets U.S. and Allied Networks. Retrieved April 16, 2021.",
"url": "https://media.defense.gov/2021/Apr/15/2002621240/-1/-1/0/CSA_SVR_TARGETS_US_ALLIES_UOO13234021.PDF/CSA_SVR_TARGETS_US_ALLIES_UOO13234021.PDF"
},
{
"source_name": "PWC WellMess C2 August 2020",
"description": "PWC. (2020, August 17). WellMess malware: analysis of its Command and Control (C2) server. Retrieved September 29, 2020.",
"url": "https://www.pwc.co.uk/issues/cyber-security-services/insights/wellmess-analysis-command-control.html"
},
{
"source_name": "PWC WellMess July 2020",
"description": "PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.",
"url": "https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html"
},
{
"source_name": "Secureworks IRON HEMLOCK Profile",
"description": "Secureworks CTU. (n.d.). IRON HEMLOCK. Retrieved February 22, 2022.",
"url": "http://www.secureworks.com/research/threat-profiles/iron-hemlock"
},
{
"source_name": "Secureworks IRON RITUAL Profile",
"description": "Secureworks CTU. (n.d.). IRON RITUAL. Retrieved February 24, 2022.",
"url": "https://www.sophos.com/en-us/threat-profiles/iron-ritual"
},
{
"source_name": "UK Gov Malign RIS Activity April 2021",
"description": "UK Gov. (2021, April 15). UK and US expose global campaign of malign activity by Russian intelligence services . Retrieved April 16, 2021.",
"url": "https://www.gov.uk/government/news/russia-uk-and-us-expose-global-campaigns-of-malign-activity-by-russian-intelligence-services"
},
{
"source_name": "UK Gov UK Exposes Russia SolarWinds April 2021",
"description": "UK Gov. (2021, April 15). UK exposes Russian involvement in SolarWinds cyber compromise . Retrieved April 16, 2021.",
"url": "https://www.gov.uk/government/news/russia-uk-exposes-russian-involvement-in-solarwinds-cyber-compromise"
},
{
"source_name": "UK NSCS Russia SolarWinds April 2021",
"description": "UK NCSC. (2021, April 15). UK and US call out Russia for SolarWinds compromise. Retrieved April 16, 2021.",
"url": "https://www.ncsc.gov.uk/news/uk-and-us-call-out-russia-for-solarwinds-compromise"
},
{
"source_name": "Unit 42 SolarStorm December 2020",
"description": "Unit 42. (2020, December 23). SolarStorm Supply Chain Attack Timeline. Retrieved March 24, 2023.",
"url": "https://unit42.paloaltonetworks.com/solarstorm-supply-chain-attack-timeline/"
},
{
"source_name": "White House Imposing Costs RU Gov April 2021",
"description": "White House. (2021, April 15). Imposing Costs for Harmful Foreign Activities by the Russian Government. Retrieved April 16, 2021.",
"url": "https://www.whitehouse.gov/briefing-room/statements-releases/2021/04/15/fact-sheet-imposing-costs-for-harmful-foreign-activities-by-the-russian-government/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Daniyal Naeem, BT Security",
"Matt Brenton, Zurich Insurance Group",
"Katie Nickels, Red Canary",
"Joe Gumke, U.S. Bank",
"Liran Ravich, CardinalOps",
"Vicky Ray, RayvenX"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "6.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:06.517000+00:00\", \"old_value\": \"2026-01-20 16:22:04.140000+00:00\"}}}",
"previous_version": "6.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--0bbdf25b-30ff-4894-a1cd-49260d0dd2d9",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:55.853000+00:00",
"modified": "2026-07-31 18:47:36.902000+00:00",
"name": "APT3",
"description": "[APT3](https://attack.mitre.org/groups/G0022) is a China-based threat group that researchers have attributed to China's Ministry of State Security.(Citation: FireEye Clandestine Wolf)(Citation: Recorded Future APT3 May 2017) This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap.(Citation: FireEye Clandestine Wolf)(Citation: FireEye Operation Double Tap) As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.(Citation: Symantec Buckeye)",
"aliases": [
"APT3",
"Gothic Panda",
"Pirpi",
"UPS Team",
"Buckeye",
"Threat Group-0110",
"TG-0110"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0022",
"external_id": "G0022"
},
{
"source_name": "APT3",
"description": "(Citation: FireEye Clandestine Wolf) (Citation: Recorded Future APT3 May 2017) (Citation: Symantec Buckeye)"
},
{
"source_name": "UPS Team",
"description": "(Citation: FireEye Clandestine Wolf) (Citation: Recorded Future APT3 May 2017) (Citation: Symantec Buckeye)"
},
{
"source_name": "Pirpi",
"description": "(Citation: PWC Pirpi Scanbox)"
},
{
"source_name": "Gothic Panda",
"description": "(Citation: PWC Pirpi Scanbox) (Citation: Recorded Future APT3 May 2017) (Citation: Symantec Buckeye)"
},
{
"source_name": "Threat Group-0110",
"description": "(Citation: Recorded Future APT3 May 2017) (Citation: Symantec Buckeye)"
},
{
"source_name": "TG-0110",
"description": "(Citation: Recorded Future APT3 May 2017) (Citation: Symantec Buckeye)"
},
{
"source_name": "Buckeye",
"description": "(Citation: Symantec Buckeye)"
},
{
"source_name": "FireEye Clandestine Wolf",
"description": "Eng, E., Caselden, D.. (2015, June 23). Operation Clandestine Wolf \u2013 Adobe Flash Zero-Day in APT3 Phishing Campaign. Retrieved January 14, 2016.",
"url": "https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-wolf-adobe-flash-zero-day.html"
},
{
"source_name": "Recorded Future APT3 May 2017",
"description": "Insikt Group (Recorded Future). (2017, May 17). Recorded Future Research Concludes Chinese Ministry of State Security Behind APT3. Retrieved September 16, 2024.",
"url": "https://www.recordedfuture.com/research/chinese-mss-behind-apt3"
},
{
"source_name": "PWC Pirpi Scanbox",
"description": "Lancaster, T. (2015, July 25). A tale of Pirpi, Scanbox & CVE-2015-3113. Retrieved March 30, 2016.",
"url": "http://pwc.blogs.com/cyber_security_updates/2015/07/pirpi-scanbox.html"
},
{
"source_name": "FireEye Operation Double Tap",
"description": "Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.",
"url": "https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html"
},
{
"source_name": "Symantec Buckeye",
"description": "Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.",
"url": "https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Patrick Sungbahadoor"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:36.902000+00:00\", \"old_value\": \"2026-01-20 15:46:53.916000+00:00\"}}}",
"previous_version": "1.4"
},
{
"type": "intrusion-set",
"id": "intrusion-set--f047ee18-7985-4946-8bfb-4ed754d3a0dd",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:51.026000+00:00",
"modified": "2026-07-31 18:48:25.451000+00:00",
"name": "APT30",
"description": "[APT30](https://attack.mitre.org/groups/G0013) is a threat group suspected to be associated with the Chinese government. While [Naikon](https://attack.mitre.org/groups/G0019) shares some characteristics with [APT30](https://attack.mitre.org/groups/G0013), the two groups do not appear to be exact matches.(Citation: FireEye APT30)(Citation: Baumgartner Golovkin Naikon 2015)",
"aliases": [
"APT30"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0013",
"external_id": "G0013"
},
{
"source_name": "APT30",
"description": "(Citation: FireEye APT30) (Citation: Baumgartner Golovkin Naikon 2015)"
},
{
"source_name": "Baumgartner Golovkin Naikon 2015",
"description": "Baumgartner, K., Golovkin, M.. (2015, May 14). The Naikon APT. Retrieved January 14, 2015.",
"url": "https://securelist.com/the-naikon-apt/69953/"
},
{
"source_name": "FireEye APT30",
"description": "FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024.",
"url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:25.451000+00:00\", \"old_value\": \"2024-11-17 15:05:25.104000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--247cb30b-955f-42eb-97a5-a89fef69341e",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-12-14 16:46:06.044000+00:00",
"modified": "2026-07-31 18:47:43.271000+00:00",
"name": "APT32",
"description": "[APT32](https://attack.mitre.org/groups/G0050) is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.(Citation: FireEye APT32 May 2017)(Citation: Volexity OceanLotus Nov 2017)(Citation: ESET OceanLotus)",
"aliases": [
"APT32",
"SeaLotus",
"OceanLotus",
"APT-C-00",
"Canvas Cyclone",
"BISMUTH"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0050",
"external_id": "G0050"
},
{
"source_name": "SeaLotus",
"description": "(Citation: Cybereason Oceanlotus May 2017)"
},
{
"source_name": "APT-C-00",
"description": "(Citation: ESET OceanLotus)(Citation: Cybereason Oceanlotus May 2017)(Citation: ESET OceanLotus Mar 2019)(Citation: Amnesty Intl. Ocean Lotus February 2021)"
},
{
"source_name": "APT32",
"description": "(Citation: FireEye APT32 May 2017)(Citation: Volexity OceanLotus Nov 2017)(Citation: Cybereason Oceanlotus May 2017)(Citation: ESET OceanLotus Mar 2019)(Citation: Amnesty Intl. Ocean Lotus February 2021)"
},
{
"source_name": "OceanLotus",
"description": "(Citation: FireEye APT32 May 2017)(Citation: Volexity OceanLotus Nov 2017)(Citation: Cybereason Oceanlotus May 2017)(Citation: ESET OceanLotus Mar 2019)(Citation: Amnesty Intl. Ocean Lotus February 2021)"
},
{
"source_name": "Canvas Cyclone",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "BISMUTH",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Amnesty Intl. Ocean Lotus February 2021",
"description": "Amnesty International. (2021, February 24). Vietnamese activists targeted by notorious hacking group. Retrieved March 1, 2021.",
"url": "https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf"
},
{
"source_name": "FireEye APT32 May 2017",
"description": "Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.",
"url": "https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"
},
{
"source_name": "Cybereason Oceanlotus May 2017",
"description": "Dahan, A. (2017, May 24). OPERATION COBALT KITTY: A LARGE-SCALE APT IN ASIA CARRIED OUT BY THE OCEANLOTUS GROUP. Retrieved November 5, 2018.",
"url": "https://www.cybereason.com/blog/operation-cobalt-kitty-apt"
},
{
"source_name": "ESET OceanLotus Mar 2019",
"description": "Dumont, R. (2019, March 20). Fake or Fake: Keeping up with OceanLotus decoys. Retrieved April 1, 2019.",
"url": "https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"
},
{
"source_name": "ESET OceanLotus",
"description": "Folt\u00fdn, T. (2018, March 13). OceanLotus ships new backdoor using old tricks. Retrieved May 22, 2018.",
"url": "https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/"
},
{
"source_name": "Volexity OceanLotus Nov 2017",
"description": "Lassalle, D., et al. (2017, November 6). OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN, Asian Nations, the Media, Human Rights Groups, and Civil Society. Retrieved November 6, 2017.",
"url": "https://www.volexity.com/blog/2017/11/06/oceanlotus-blossoms-mass-digital-surveillance-and-exploitation-of-asean-nations-the-media-human-rights-and-civil-society/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Romain Dumont, ESET"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:43.271000+00:00\", \"old_value\": \"2024-04-17 22:07:49.430000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "3.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--fbd29c89-18ba-4c2d-b792-51c0adee049f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-04-18 17:59:24.739000+00:00",
"modified": "2026-07-31 20:48:52.730000+00:00",
"name": "APT33",
"description": "[APT33](https://attack.mitre.org/groups/G0064) is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.(Citation: FireEye APT33 Sept 2017)(Citation: FireEye APT33 Webinar Sept 2017)",
"aliases": [
"APT33",
"HOLMIUM",
"Elfin",
"Peach Sandstorm"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0064",
"external_id": "G0064"
},
{
"source_name": "APT33",
"description": "(Citation: FireEye APT33 Sept 2017) (Citation: FireEye APT33 Webinar Sept 2017)"
},
{
"source_name": "HOLMIUM",
"description": "(Citation: Microsoft Holmium June 2020)"
},
{
"source_name": "Peach Sandstorm",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Elfin",
"description": "(Citation: Symantec Elfin Mar 2019)"
},
{
"source_name": "FireEye APT33 Webinar Sept 2017",
"description": "Davis, S. and Carr, N. (2017, September 21). APT33: New Insights into Iranian Cyber Espionage Group. Retrieved February 15, 2018.",
"url": "https://www.brighttalk.com/webcast/10703/275683"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft Holmium June 2020",
"description": "Microsoft Threat Protection Intelligence Team. (2020, June 18). Inside Microsoft Threat Protection: Mapping attack chains from cloud to endpoint. Retrieved June 22, 2020.",
"url": "https://www.microsoft.com/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/"
},
{
"source_name": "FireEye APT33 Sept 2017",
"description": "O'Leary, J., et al. (2017, September 20). Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware. Retrieved February 15, 2018.",
"url": "https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html"
},
{
"source_name": "Symantec Elfin Mar 2019",
"description": "Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019.",
"url": "https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Dragos Threat Intelligence"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:52.730000+00:00\", \"old_value\": \"2024-04-11 16:06:34.700000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--4a2ce82e-1a74-468a-a6fb-bbead541383c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-04-18 17:59:24.739000+00:00",
"modified": "2026-07-31 18:47:54.407000+00:00",
"name": "APT37",
"description": "[APT37](https://attack.mitre.org/groups/G0067) is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. [APT37](https://attack.mitre.org/groups/G0067) has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018.(Citation: FireEye APT37 Feb 2018)(Citation: Securelist ScarCruft Jun 2016)(Citation: Talos Group123)\n\nNorth Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups.",
"aliases": [
"APT37",
"InkySquid",
"ScarCruft",
"Reaper",
"Group123",
"TEMP.Reaper",
"Ricochet Chollima"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0067",
"external_id": "G0067"
},
{
"source_name": "Ricochet Chollima",
"description": "(Citation: CrowdStrike Richochet Chollima September 2021)"
},
{
"source_name": "APT37",
"description": "(Citation: FireEye APT37 Feb 2018)"
},
{
"source_name": "Reaper",
"description": "(Citation: FireEye APT37 Feb 2018)"
},
{
"source_name": "Group123",
"description": "(Citation: FireEye APT37 Feb 2018)"
},
{
"source_name": "TEMP.Reaper",
"description": "(Citation: FireEye APT37 Feb 2018)"
},
{
"source_name": "ScarCruft",
"description": "(Citation: Securelist ScarCruft Jun 2016)(Citation: FireEye APT37 Feb 2018)(Citation: Securelist ScarCruft May 2019)"
},
{
"source_name": "InkySquid",
"description": "(Citation: Volexity InkySquid BLUELIGHT August 2021)"
},
{
"source_name": "Volexity InkySquid BLUELIGHT August 2021",
"description": "Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.",
"url": "https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"
},
{
"source_name": "CrowdStrike Richochet Chollima September 2021",
"description": "CrowdStrike. (2021, September 30). Adversary Profile - Ricochet Chollima. Retrieved September 30, 2021.",
"url": "https://www.crowdstrike.com/adversaries/ricochet-chollima/"
},
{
"source_name": "FireEye APT37 Feb 2018",
"description": "FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.",
"url": "https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"
},
{
"source_name": "Securelist ScarCruft May 2019",
"description": "GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.",
"url": "https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/"
},
{
"source_name": "Talos Group123",
"description": "Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.",
"url": "https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"
},
{
"source_name": "Securelist ScarCruft Jun 2016",
"description": "Raiu, C., and Ivanov, A. (2016, June 17). Operation Daybreak. Retrieved February 15, 2018.",
"url": "https://securelist.com/operation-daybreak/75100/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Valerii Marchuk, Cybersecurity Help s.r.o."
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:54.407000+00:00\", \"old_value\": \"2024-11-17 15:01:33.384000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--00f67a77-86a4-4adf-be26-1a54fc713340",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-01-29 21:27:24.793000+00:00",
"modified": "2026-07-31 20:48:22.752000+00:00",
"name": "APT38",
"description": "[APT38](https://attack.mitre.org/groups/G0082) is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz August 2020) Active since at least 2014, [APT38](https://attack.mitre.org/groups/G0082) has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which [APT38](https://attack.mitre.org/groups/G0082) stole $81 million, as well as attacks against Bancomext (Citation: FireEye APT38 Oct 2018) and Banco de Chile (Citation: FireEye APT38 Oct 2018); some of their attacks have been destructive.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The Hood Blog 2017)\n\nNorth Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups.",
"aliases": [
"APT38",
"NICKEL GLADSTONE",
"BeagleBoyz",
"Bluenoroff",
"Stardust Chollima",
"Sapphire Sleet",
"COPERNICIUM"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0082",
"external_id": "G0082"
},
{
"source_name": "BeagleBoyz",
"description": "(Citation: CISA AA20-239A BeagleBoyz August 2020)"
},
{
"source_name": "Stardust Chollima",
"description": "(Citation: CrowdStrike Stardust Chollima Profile April 2018)(Citation: CrowdStrike GTR 2021 June 2021)"
},
{
"source_name": "APT38",
"description": "(Citation: FireEye APT38 Oct 2018)"
},
{
"source_name": "Bluenoroff",
"description": "(Citation: Kaspersky Lazarus Under The Hood Blog 2017)"
},
{
"source_name": "Sapphire Sleet",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "COPERNICIUM",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "NICKEL GLADSTONE",
"description": "(Citation: SecureWorks NICKEL GLADSTONE profile Sept 2021)"
},
{
"source_name": "CrowdStrike GTR 2021 June 2021",
"description": "CrowdStrike. (2021, June 7). CrowdStrike 2021 Global Threat Report. Retrieved September 29, 2021.",
"url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf"
},
{
"source_name": "DOJ North Korea Indictment Feb 2021",
"description": "Department of Justice. (2021, February 17). Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe. Retrieved June 9, 2021.",
"url": "https://www.justice.gov/opa/pr/three-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyberattacks-and"
},
{
"source_name": "CISA AA20-239A BeagleBoyz August 2020",
"description": "DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.",
"url": "https://us-cert.cisa.gov/ncas/alerts/aa20-239a"
},
{
"source_name": "FireEye APT38 Oct 2018",
"description": "FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.",
"url": "https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"
},
{
"source_name": "Kaspersky Lazarus Under The Hood Blog 2017",
"description": "GReAT. (2017, April 3). Lazarus Under the Hood. Retrieved April 17, 2019.",
"url": "https://securelist.com/lazarus-under-the-hood/77908/"
},
{
"source_name": "CrowdStrike Stardust Chollima Profile April 2018",
"description": "Meyers, Adam. (2018, April 6). Meet CrowdStrike\u2019s Adversary of the Month for April: STARDUST CHOLLIMA. Retrieved September 29, 2021.",
"url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-april-stardust-chollima/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "SecureWorks NICKEL GLADSTONE profile Sept 2021",
"description": "SecureWorks. (2021, September 29). NICKEL GLADSTONE Threat Profile. Retrieved September 29, 2021.",
"url": "https://www.secureworks.com/research/threat-profiles/nickel-gladstone"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Hiroki Nagahama, NEC Corporation",
"Manikantan Srinivasan, NEC Corporation India",
"Pooja Natarajan, NEC Corporation India"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "3.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:22.752000+00:00\", \"old_value\": \"2025-11-13 19:21:05.133000+00:00\"}}}",
"previous_version": "3.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--44e43fad-ffcb-4210-abcf-eaaed9735f80",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-02-19 16:01:38.585000+00:00",
"modified": "2026-07-31 18:47:52.580000+00:00",
"name": "APT39",
"description": "[APT39](https://attack.mitre.org/groups/G0087) is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. [APT39](https://attack.mitre.org/groups/G0087) has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.(Citation: FireEye APT39 Jan 2019)(Citation: Symantec Chafer Dec 2015)(Citation: FBI FLASH APT39 September 2020)(Citation: Dept. of Treasury Iran Sanctions September 2020)(Citation: DOJ Iran Indictments September 2020)",
"aliases": [
"APT39",
"ITG07",
"Chafer",
"Remix Kitten"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0087",
"external_id": "G0087"
},
{
"source_name": "Remix Kitten",
"description": "(Citation: Crowdstrike GTR2020 Mar 2020)"
},
{
"source_name": "ITG07",
"description": "(Citation: FBI FLASH APT39 September 2020)(Citation: Dept. of Treasury Iran Sanctions September 2020)(Citation: DOJ Iran Indictments September 2020)"
},
{
"source_name": "APT39",
"description": "(Citation: FireEye APT39 Jan 2019)(Citation: FBI FLASH APT39 September 2020)(Citation: Dept. of Treasury Iran Sanctions September 2020)(Citation: DOJ Iran Indictments September 2020)"
},
{
"source_name": "Chafer",
"description": "Activities associated with APT39 largely align with a group publicly referred to as Chafer.(Citation: FireEye APT39 Jan 2019)(Citation: Symantec Chafer Dec 2015)(Citation: Dark Reading APT39 JAN 2019)(Citation: FBI FLASH APT39 September 2020)(Citation: Dept. of Treasury Iran Sanctions September 2020)(Citation: DOJ Iran Indictments September 2020)"
},
{
"source_name": "Crowdstrike GTR2020 Mar 2020",
"description": "Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.",
"url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"
},
{
"source_name": "Dept. of Treasury Iran Sanctions September 2020",
"description": "Dept. of Treasury. (2020, September 17). Treasury Sanctions Cyber Actors Backed by Iranian Intelligence. Retrieved December 10, 2020.",
"url": "https://home.treasury.gov/news/press-releases/sm1127"
},
{
"source_name": "DOJ Iran Indictments September 2020",
"description": "DOJ. (2020, September 17). Department of Justice and Partner Departments and Agencies Conduct Coordinated Actions to Disrupt and Deter Iranian Malicious Cyber Activities Targeting the United States and the Broader International Community. Retrieved December 10, 2020.",
"url": "https://www.justice.gov/opa/pr/department-justice-and-partner-departments-and-agencies-conduct-coordinated-actions-disrupt"
},
{
"source_name": "FBI FLASH APT39 September 2020",
"description": "FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020.",
"url": "https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"
},
{
"source_name": "FireEye APT39 Jan 2019",
"description": "Hawley et al. (2019, January 29). APT39: An Iranian Cyber Espionage Group Focused on Personal Information. Retrieved February 19, 2019.",
"url": "https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"
},
{
"source_name": "Dark Reading APT39 JAN 2019",
"description": "Higgins, K. (2019, January 30). Iran Ups its Traditional Cyber Espionage Tradecraft. Retrieved May 22, 2020.",
"url": "https://www.darkreading.com/attacks-breaches/iran-ups-its-traditional-cyber-espionage-tradecraft/d/d-id/1333764"
},
{
"source_name": "Symantec Chafer Dec 2015",
"description": "Symantec Security Response. (2015, December 7). Iran-based attackers use back door threats to spy on Middle Eastern targets. Retrieved April 17, 2019.",
"url": "https://www.symantec.com/connect/blogs/iran-based-attackers-use-back-door-threats-spy-middle-eastern-targets"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "3.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:52.580000+00:00\", \"old_value\": \"2024-04-11 02:59:52.392000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "3.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--18854f55-ac7c-4634-bd9a-352dd07613b7",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-09-23 13:43:36.945000+00:00",
"modified": "2026-07-31 20:48:26.542000+00:00",
"name": "APT41",
"description": "[APT41](https://attack.mitre.org/groups/G0096) is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, [APT41](https://attack.mitre.org/groups/G0096) has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.(Citation: apt41_mandiant) Notable behaviors include using a wide range of malware and tools to complete mission objectives. [APT41](https://attack.mitre.org/groups/G0096) overlaps at least partially with public reporting on groups including BARIUM and [Winnti Group](https://attack.mitre.org/groups/G0044).(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)\n",
"aliases": [
"APT41",
"Wicked Panda",
"Brass Typhoon",
"BARIUM"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0096",
"external_id": "G0096"
},
{
"source_name": "Wicked Panda",
"description": "(Citation: Crowdstrike GTR2020 Mar 2020)"
},
{
"source_name": "APT41",
"description": "(Citation: FireEye APT41 2019)"
},
{
"source_name": "Brass Typhoon",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "BARIUM",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Crowdstrike GTR2020 Mar 2020",
"description": "Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.",
"url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"
},
{
"source_name": "FireEye APT41 2019",
"description": "FireEye. (2019). Double DragonAPT41, a dual espionage andcyber crime operationAPT41. Retrieved September 23, 2019.",
"url": "https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"
},
{
"source_name": "FireEye APT41 Aug 2019",
"description": "Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.",
"url": "https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"
},
{
"source_name": "apt41_mandiant",
"description": "Mandiant. (n.d.). APT41, A DUAL ESPIONAGE AND CYBER CRIME OPERATION. Retrieved June 11, 2024.",
"url": "https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Group IB APT 41 June 2021",
"description": "Rostovcev, N. (2021, June 10). Big airline heist APT41 likely behind a third-party attack on Air India. Retrieved August 26, 2021.",
"url": "https://www.group-ib.com/blog/colunmtk-apt41/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Kyaw Pyiyt Htet, @KyawPyiytHtet",
"Nikita Rostovcev, Group-IB"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "4.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:26.542000+00:00\", \"old_value\": \"2025-06-11 20:13:29.024000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "4.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--c0291346-defe-48d7-9542-9e074ba1bdfb",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-01-08 17:08:26.378000+00:00",
"modified": "2026-07-31 18:48:15.085000+00:00",
"name": "APT42",
"description": "[APT42](https://attack.mitre.org/groups/G1044) is an Iranian-sponsored threat group that conducts cyber espionage and surveillance.(Citation: Mandiant APT42-charms) The group primarily focuses on targets in the Middle East region, but has targeted a variety of industries and countries since at least 2015.(Citation: Mandiant APT42-charms) [APT42](https://attack.mitre.org/groups/G1044) starts cyber operations through spearphishing emails and/or the PINEFLOWER Android malware, then monitors and collects information from the compromised systems and devices.(Citation: Mandiant APT42-charms) Finally, [APT42](https://attack.mitre.org/groups/G1044) exfiltrates data using native features and open-source tools.(Citation: Mandiant APT42-untangling) \n\n[APT42](https://attack.mitre.org/groups/G1044) activities have been linked to [Magic Hound](https://attack.mitre.org/groups/G0059) by other commercial vendors. While there are behavior and software overlaps between [Magic Hound](https://attack.mitre.org/groups/G0059) and [APT42](https://attack.mitre.org/groups/G1044), they appear to be distinct entities and are tracked as separate entities by their originating vendor. ",
"aliases": [
"APT42"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1044",
"external_id": "G1044"
},
{
"source_name": "Mandiant APT42-charms",
"description": "Mandiant. (n.d.). APT42: Crooked Charms, Cons and Compromises. Retrieved October 9, 2024.",
"url": "https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"
},
{
"source_name": "Mandiant APT42-untangling",
"description": "Rozmann, O., et al. (2024, May 1). Uncharmed: Untangling Iran's APT42 Operations. Retrieved October 9, 2024.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Sittikorn Sangrattanapitak"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:15.085000+00:00\", \"old_value\": \"2026-05-12 15:12:00.732000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--c1aab4c9-4c34-4f4f-8541-d529e46a07f9",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-02-05 19:27:35.655000+00:00",
"modified": "2026-07-31 18:48:16.107000+00:00",
"name": "APT5",
"description": "[APT5](https://attack.mitre.org/groups/G1023) is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. [APT5](https://attack.mitre.org/groups/G1023) has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits.(Citation: NSA APT5 Citrix Threat Hunting December 2022)(Citation: Microsoft East Asia Threats September 2023)(Citation: Mandiant Pulse Secure Zero-Day April 2021)(Citation: Mandiant Pulse Secure Update May 2021)(Citation: FireEye Southeast Asia Threat Landscape March 2015)(Citation: Mandiant Advanced Persistent Threats) ",
"aliases": [
"APT5",
"Mulberry Typhoon",
"MANGANESE",
"BRONZE FLEETWOOD",
"Keyhole Panda",
"UNC2630"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1023",
"external_id": "G1023"
},
{
"source_name": "Mulberry Typhoon",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)(Citation: Microsoft East Asia Threats September 2023)"
},
{
"source_name": "MANGANESE",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)(Citation: NSA APT5 Citrix Threat Hunting December 2022)"
},
{
"source_name": "Keyhole Panda",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)(Citation: Secureworks BRONZE FLEETWOOD Profile)"
},
{
"source_name": "UNC2630",
"description": "(Citation: NSA APT5 Citrix Threat Hunting December 2022)"
},
{
"source_name": "BRONZE FLEETWOOD",
"description": "(Citation: Secureworks BRONZE FLEETWOOD Profile)"
},
{
"source_name": "FireEye Southeast Asia Threat Landscape March 2015",
"description": "FireEye. (2015, March). SOUTHEAST ASIA: AN EVOLVING CYBER THREAT LANDSCAPE. Retrieved February 5, 2024.",
"url": "https://web.archive.org/web/20220122121143/https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/rpt-southeast-asia-threat-landscape.pdf"
},
{
"source_name": "Mandiant Advanced Persistent Threats",
"description": "Mandiant. (n.d.). Advanced Persistent Threats (APTs). Retrieved February 14, 2024.",
"url": "https://www.mandiant.com/resources/insights/apt-groups"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft East Asia Threats September 2023",
"description": "Microsoft Threat Intelligence. (2023, September). Digital threats from East Asia increase in breadth and effectiveness. Retrieved February 5, 2024.",
"url": "https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RW1aFyW"
},
{
"source_name": "NSA APT5 Citrix Threat Hunting December 2022",
"description": "National Security Agency. (2022, December). APT5: Citrix ADC Threat Hunting Guidance. Retrieved February 5, 2024.",
"url": "https://media.defense.gov/2022/Dec/13/2003131586/-1/-1/0/CSA-APT5-CITRIXADC-V1.PDF"
},
{
"source_name": "Mandiant Pulse Secure Zero-Day April 2021",
"description": "Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.",
"url": "https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"
},
{
"source_name": "Mandiant Pulse Secure Update May 2021",
"description": "Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.",
"url": "https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"
},
{
"source_name": "Secureworks BRONZE FLEETWOOD Profile",
"description": "Secureworks CTU. (n.d.). BRONZE FLEETWOOD. Retrieved February 5, 2024.",
"url": "https://www.secureworks.com/research/threat-profiles/bronze-fleetwood"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"@_montysecurity"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:16.107000+00:00\", \"old_value\": \"2025-04-04 17:08:23.100000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--b8137919-38cb-4db0-90f3-437be885faba",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-05-21 19:13:23.526000+00:00",
"modified": "2026-07-31 18:48:13.867000+00:00",
"name": "Agrius",
"description": "[Agrius](https://attack.mitre.org/groups/G1030) is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets.(Citation: SentinelOne Agrius 2021)(Citation: CheckPoint Agrius 2023) Public reporting has linked [Agrius](https://attack.mitre.org/groups/G1030) to Iran's Ministry of Intelligence and Security (MOIS).(Citation: Microsoft Iran Cyber 2023)",
"aliases": [
"Agrius",
"Pink Sandstorm",
"AMERICIUM",
"Agonizing Serpens",
"BlackShadow"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1030",
"external_id": "G1030"
},
{
"source_name": "BlackShadow",
"description": "(Citation: CheckPoint Agrius 2023)"
},
{
"source_name": "Pink Sandstorm",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "AMERICIUM",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Agonizing Serpens",
"description": "(Citation: Unit42 Agrius 2023)"
},
{
"source_name": "SentinelOne Agrius 2021",
"description": "Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.",
"url": "https://assets.sentinelone.com/sentinellabs/evol-agrius"
},
{
"source_name": "CheckPoint Agrius 2023",
"description": "Marc Salinas Fernandez & Jiri Vinopal. (2023, May 23). AGRIUS DEPLOYS MONEYBIRD IN TARGETED ATTACKS AGAINST ISRAELI ORGANIZATIONS. Retrieved May 21, 2024.",
"url": "https://research.checkpoint.com/2023/agrius-deploys-moneybird-in-targeted-attacks-against-israeli-organizations/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft Iran Cyber 2023",
"description": "Microsoft Threat Intelligence. (2023, May 2). Iran turning to cyber-enabled influence operations for greater effect. Retrieved May 21, 2024.",
"url": "https://www.microsoft.com/en-us/security/business/security-insider/wp-content/uploads/2023/05/Iran-turning-to-cyber-enabled-influence-operations-for-greater-effect-05022023.pdf"
},
{
"source_name": "Unit42 Agrius 2023",
"description": "Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.",
"url": "https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Asritha Narina"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:13.867000+00:00\", \"old_value\": \"2024-08-29 15:18:44.308000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--fa19de15-6169-428d-9cd6-3ca3d56075b7",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-04-14 13:17:43.941000+00:00",
"modified": "2026-07-31 18:48:27.351000+00:00",
"name": "Ajax Security Team",
"description": "[Ajax Security Team](https://attack.mitre.org/groups/G0130) is a group that has been active since at least 2010 and believed to be operating out of Iran. By 2014 [Ajax Security Team](https://attack.mitre.org/groups/G0130) transitioned from website defacement operations to malware-based cyber espionage campaigns targeting the US defense industrial base and Iranian users of anti-censorship technologies.(Citation: FireEye Operation Saffron Rose 2013)",
"aliases": [
"Ajax Security Team",
"Operation Woolen-Goldfish",
"AjaxTM",
"Rocket Kitten",
"Flying Kitten",
"Operation Saffron Rose"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0130",
"external_id": "G0130"
},
{
"source_name": "Flying Kitten",
"description": "(Citation: CrowdStrike Flying Kitten )"
},
{
"source_name": "AjaxTM",
"description": "(Citation: FireEye Operation Saffron Rose 2013)"
},
{
"source_name": "Operation Saffron Rose",
"description": "(Citation: FireEye Operation Saffron Rose 2013)"
},
{
"source_name": "Rocket Kitten",
"description": "Analysis of infrastructure, tools, and modes of operation revealed a potential relationship between [Ajax Security Team](https://attack.mitre.org/groups/G0130) and Rocket Kitten.(Citation: Check Point Rocket Kitten)(Citation: IranThreats Kittens Dec 2017)"
},
{
"source_name": "Operation Woolen-Goldfish",
"description": "Analysis of infrastructure, tools, and modes of operation revealed a potential relationship between [Ajax Security Team](https://attack.mitre.org/groups/G0130) and the campaign Operation Woolen-Goldfish.(Citation: Check Point Rocket Kitten)(Citation: TrendMicro Operation Woolen Goldfish March 2015)"
},
{
"source_name": "TrendMicro Operation Woolen Goldfish March 2015",
"description": "Cedric Pernet, Kenney Lu. (2015, March 19). Operation Woolen-Goldfish - When Kittens Go phishing. Retrieved April 21, 2021.",
"url": "https://documents.trendmicro.com/assets/wp/wp-operation-woolen-goldfish.pdf"
},
{
"source_name": "Check Point Rocket Kitten",
"description": "Check Point Software Technologies. (2015). ROCKET KITTEN: A CAMPAIGN WITH 9 LIVES. Retrieved March 16, 2018.",
"url": "https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf"
},
{
"source_name": "CrowdStrike Flying Kitten ",
"description": "Dahl, M.. (2014, May 13). Cat Scratch Fever: CrowdStrike Tracks Newly Reported Iranian Actor as FLYING KITTEN. Retrieved May 27, 2020.",
"url": "https://www.crowdstrike.com/blog/cat-scratch-fever-crowdstrike-tracks-newly-reported-iranian-actor-flying-kitten/"
},
{
"source_name": "IranThreats Kittens Dec 2017",
"description": "Iran Threats . (2017, December 5). Flying Kitten to Rocket Kitten, A Case of Ambiguity and Shared Code. Retrieved May 28, 2020.",
"url": "https://iranthreats.github.io/resources/attribution-flying-rocket-kitten/"
},
{
"source_name": "FireEye Operation Saffron Rose 2013",
"description": "Villeneuve, N. et al.. (2013). OPERATION SAFFRON ROSE . Retrieved May 28, 2020.",
"url": "https://www.mandiant.com/sites/default/files/2021-09/rpt-operation-saffron-rose.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:27.351000+00:00\", \"old_value\": \"2023-10-09 16:46:55.719000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--46bb06cb-f2d9-4b37-8c92-a27e224ad90d",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-02-20 23:59:25.966000+00:00",
"modified": "2026-07-31 18:47:54.331000+00:00",
"name": "Akira",
"description": "[Akira](https://attack.mitre.org/groups/G1024) is a ransomware variant and ransomware deployment entity active since at least March 2023.(Citation: Arctic Wolf Akira 2023) [Akira](https://attack.mitre.org/groups/G1024) uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement.(Citation: Arctic Wolf Akira 2023)(Citation: Secureworks GOLD SAHARA) [Akira](https://attack.mitre.org/groups/G1024) operations are associated with \"double extortion\" ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Technical analysis of [Akira](https://attack.mitre.org/software/S1129) ransomware indicates variants capable of targeting Windows or VMWare ESXi hypervisors and multiple overlaps with [Conti](https://attack.mitre.org/software/S0575) ransomware.(Citation: BushidoToken Akira 2023)(Citation: CISA Akira Ransomware APR 2024)(Citation: Cisco Akira Ransomware OCT 2024)",
"aliases": [
"Akira",
"GOLD SAHARA",
"PUNK SPIDER",
"Howling Scorpius"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1024",
"external_id": "G1024"
},
{
"source_name": "PUNK SPIDER",
"description": "(Citation: CrowdStrike PUNK SPIDER)"
},
{
"source_name": "Howling Scorpius",
"description": "(Citation: Palo Alto Howling Scorpius DEC 2024)"
},
{
"source_name": "GOLD SAHARA",
"description": "(Citation: Secureworks GOLD SAHARA)"
},
{
"source_name": "CISA Akira Ransomware APR 2024",
"description": "CISA et al. (2024, April 18). #StopRansomware: Akira Ransomware. Retrieved December 10, 2024.",
"url": "https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf"
},
{
"source_name": "CrowdStrike PUNK SPIDER",
"description": "CrowdStrike. (n.d.). Punk Spider. Retrieved February 20, 2024.",
"url": "https://www.crowdstrike.com/adversaries/punk-spider/"
},
{
"source_name": "Cisco Akira Ransomware OCT 2024",
"description": "Nutland, J. and Szeliga, M. (2024, October 21). Akira ransomware continues to evolve. Retrieved December 10, 2024.",
"url": "https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/"
},
{
"source_name": "Secureworks GOLD SAHARA",
"description": "Secureworks. (n.d.). GOLD SAHARA. Retrieved February 20, 2024.",
"url": "https://www.secureworks.com/research/threat-profiles/gold-sahara"
},
{
"source_name": "Arctic Wolf Akira 2023",
"description": "Steven Campbell, Akshay Suthar, & Connor Belfiorre. (2023, July 26). Conti and Akira: Chained Together. Retrieved February 20, 2024.",
"url": "https://arcticwolf.com/resources/blog/conti-and-akira-chained-together/"
},
{
"source_name": "BushidoToken Akira 2023",
"description": "Will Thomas. (2023, September 15). Tracking Adversaries: Akira, another descendent of Conti. Retrieved February 21, 2024.",
"url": "https://blog.bushidotoken.net/2023/09/tracking-adversaries-akira-another.html"
},
{
"source_name": "Palo Alto Howling Scorpius DEC 2024",
"description": "Zemah, Y. (2024, December 2). Threat Assessment: Howling Scorpius (Akira Ransomware). Retrieved January 8, 2025.",
"url": "https://unit42.paloaltonetworks.com/threat-assessment-howling-scorpius-akira-ransomware/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Jiraput Thamsongkrah"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:54.331000+00:00\", \"old_value\": \"2025-03-11 15:36:38.244000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--39d6890e-7f23-4474-b8ef-e7b0343c5fc8",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-09-29 15:10:19.236000+00:00",
"modified": "2026-07-31 18:47:50.220000+00:00",
"name": "Andariel",
"description": "[Andariel](https://attack.mitre.org/groups/G0138) is a North Korean state-sponsored threat group that has been active since at least 2009. [Andariel](https://attack.mitre.org/groups/G0138) has primarily focused its operations--which have included destructive attacks--against South Korean government agencies, military organizations, and a variety of domestic companies; they have also conducted cyber financial operations against ATMs, banks, and cryptocurrency exchanges. [Andariel](https://attack.mitre.org/groups/G0138)'s notable activity includes Operation Black Mine, Operation GoldenAxe, and Campaign Rifle.(Citation: FSI Andariel Campaign Rifle July 2017)(Citation: IssueMakersLab Andariel GoldenAxe May 2017)(Citation: AhnLab Andariel Subgroup of Lazarus June 2018)(Citation: TrendMicro New Andariel Tactics July 2018)(Citation: CrowdStrike Silent Chollima Adversary September 2021)\n\n[Andariel](https://attack.mitre.org/groups/G0138) is considered a sub-set of [Lazarus Group](https://attack.mitre.org/groups/G0032), and has been attributed to North Korea's Reconnaissance General Bureau.(Citation: Treasury North Korean Cyber Groups September 2019)\n\nNorth Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups.",
"aliases": [
"Andariel",
"Silent Chollima",
"PLUTONIUM",
"Onyx Sleet"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0138",
"external_id": "G0138"
},
{
"source_name": "Silent Chollima",
"description": "(Citation: CrowdStrike Silent Chollima Adversary September 2021)"
},
{
"source_name": "Andariel",
"description": "(Citation: FSI Andariel Campaign Rifle July 2017)"
},
{
"source_name": "PLUTONIUM",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Onyx Sleet",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "AhnLab Andariel Subgroup of Lazarus June 2018",
"description": "AhnLab. (2018, June 23). Targeted attacks by Andariel Threat Group, a subgroup of the Lazarus. Retrieved September 29, 2021.",
"url": "https://web.archive.org/web/20230213154832/http://download.ahnlab.com/global/brochure/%5BAnalysis%5DAndariel_Group.pdf"
},
{
"source_name": "TrendMicro New Andariel Tactics July 2018",
"description": "Chen, Joseph. (2018, July 16). New Andariel Reconnaissance Tactics Uncovered. Retrieved September 29, 2021.",
"url": "https://www.trendmicro.com/en_us/research/18/g/new-andariel-reconnaissance-tactics-hint-at-next-targets.html"
},
{
"source_name": "CrowdStrike Silent Chollima Adversary September 2021",
"description": "CrowdStrike. (2021, September 29). Silent Chollima Adversary Profile. Retrieved September 29, 2021.",
"url": "https://adversary.crowdstrike.com/en-US/adversary/silent-chollima/"
},
{
"source_name": "FSI Andariel Campaign Rifle July 2017",
"description": "FSI. (2017, July 27). Campaign Rifle - Andariel, the Maiden of Anguish. Retrieved September 12, 2024.",
"url": "https://fsiceat.tistory.com/2"
},
{
"source_name": "IssueMakersLab Andariel GoldenAxe May 2017",
"description": "IssueMakersLab. (2017, May 1). Operation GoldenAxe. Retrieved September 12, 2024.",
"url": "http://www.issuemakerslab.com/research3/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Treasury North Korean Cyber Groups September 2019",
"description": "US Treasury . (2019, September 13). Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups. Retrieved September 29, 2021.",
"url": "https://home.treasury.gov/news/press-releases/sm774"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Kyoung-ju Kwak (S2W)"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:50.220000+00:00\", \"old_value\": \"2024-09-12 18:36:06.078000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--64d5f96a-f121-4d19-89f6-6709f5c49faa",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-07-14 14:32:47.582000+00:00",
"modified": "2026-07-31 18:47:58.829000+00:00",
"name": "Aoqin Dragon",
"description": "[Aoqin Dragon](https://attack.mitre.org/groups/G1007) is a suspected Chinese cyber espionage threat group that has been active since at least 2013. [Aoqin Dragon](https://attack.mitre.org/groups/G1007) has primarily targeted government, education, and telecommunication organizations in Australia, Cambodia, Hong Kong, Singapore, and Vietnam. Security researchers noted a potential association between [Aoqin Dragon](https://attack.mitre.org/groups/G1007) and UNC94, based on malware, infrastructure, and targets.(Citation: SentinelOne Aoqin Dragon June 2022)",
"aliases": [
"Aoqin Dragon"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1007",
"external_id": "G1007"
},
{
"source_name": "SentinelOne Aoqin Dragon June 2022",
"description": "Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022.",
"url": "https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Hiroki Nagahama, NEC Corporation",
"Pooja Natarajan, NEC Corporation India",
"Manikantan Srinivasan, NEC Corporation India"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:58.829000+00:00\", \"old_value\": \"2025-04-16 20:37:33.761000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--14225573-63b5-4e50-ba9a-5fdcaf6a7b4c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-08-25 21:13:24.851000+00:00",
"modified": "2026-07-31 18:47:38.399000+00:00",
"name": "AppleJeus",
"description": "[AppleJeus](https://attack.mitre.org/groups/G1049) is a North Korean state-sponsored threat group attributed to the Reconnaissance General Bureau. Associated with the broader [Lazarus Group](https://attack.mitre.org/groups/G0032) umbrella of actors, [AppleJeus](https://attack.mitre.org/groups/G1049) has been active since at least 2018 and is closely aligned in resources with TEMP.hermit, another DPRK-affiliated group under the same umbrella.(Citation: dtex DPRK 2025 structure ITworkers) The group\u2019s primary mission is to generate and launder revenue to provide financial support to the government. [AppleJeus](https://attack.mitre.org/groups/G1049) primarily targets the cryptocurrency industry and is most notably responsible for the [3CX Supply Chain Attack](https://attack.mitre.org/campaigns/C0057).(Citation: Mandiant 3cx UNC4736 2023) The group traditionally deploys malicious cryptocurrency software in combination with [Phishing](https://attack.mitre.org/techniques/T1566). From these compromised environments, it selectively deploys additional backdoors to enable extended operations against high-value financial targets.(Citation: Mandiant DPRK Groups 2023)(Citation: JPCert Blog Laz Subgroups 2025)",
"aliases": [
"AppleJeus",
"Gleaming Pisces",
"Citrine Sleet",
"UNC1720",
"UNC4736"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1049",
"external_id": "G1049"
},
{
"source_name": "UNC4736",
"description": "(Citation: dtex DPRK 2025 structure ITworkers)(Citation: Mandiant 3cx UNC4736 2023)"
},
{
"source_name": "UNC1720",
"description": "(Citation: JPCert Blog Laz Subgroups 2025)(Citation: Mandiant DPRK Groups 2023)"
},
{
"source_name": "Gleaming Pisces",
"description": "(Citation: Unit42 DPRK Threat Groups 2024)"
},
{
"source_name": "Citrine Sleet",
"description": "(Citation: Unit42 DPRK Threat Groups 2024)"
},
{
"source_name": "Mandiant 3cx UNC4736 2023",
"description": "Jeff Johnson, Fred Plan, Adrian Sanchez, Renato Fontana, Jake Nicastro, Dimiter Andonov, Marius Fodoreanu, Daniel Scott. (2023, April 20). 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible. Retrieved August 25, 2025.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise/"
},
{
"source_name": "dtex DPRK 2025 structure ITworkers",
"description": "Michael \u201cBarni\u201d Barnhart, DTEX, and Anonymous SMEs. (2025, May 14). Exposing DPRK's Cyber Syndicate and Hidden IT Workforce. Retrieved September 3, 2025.",
"url": "https://reports.dtexsystems.com/DTEX-Exposing+DPRK+Cyber+Syndicate+and+Hidden+IT+Workforce.pdf"
},
{
"source_name": "Mandiant DPRK Groups 2023",
"description": "Michael Barnhart, Austin Larsen, Jeff Johnson, Taylor Long, Michelle Cantos, Adrian Hernandez. (2023, October 10). Assessed Cyber Structure and Alignments of North Korea in 2023. Retrieved August 25, 2025.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/north-korea-cyber-structure-alignment-2023"
},
{
"source_name": "Unit42 DPRK Threat Groups 2024",
"description": "Unit 42. (2024, September 9). Threat Assessment: North Korean Threat Groups. Retrieved August 25, 2025.",
"url": "https://unit42.paloaltonetworks.com/threat-assessment-north-korean-threat-groups-2024/"
},
{
"source_name": "JPCert Blog Laz Subgroups 2025",
"description": "\u4f50\u3005\u6728\u52c7\u4eba Hayato Sasaki. (2025, March 25). Tempted to Classifying APT Actors: Practical Challenges of Attribution in the Case of Lazarus\u2019s Subgroup. Retrieved August 25, 2025.",
"url": "https://blogs.jpcert.or.jp/en/2025/03/classifying-lazaruss-subgroup.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Michael \u201cBarni\u201d Barnhart, DTEX",
"Austin Larsen and the Google Threat Intelligence Group"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:38.399000+00:00\", \"old_value\": \"2025-10-23 20:42:03.446000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--64b52e7d-b2c4-4a02-9372-08a463f5dc11",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-01-18 14:49:29.505000+00:00",
"modified": "2026-07-31 18:47:58.464000+00:00",
"name": "Aquatic Panda",
"description": "[Aquatic Panda](https://attack.mitre.org/groups/G0143) is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, [Aquatic Panda](https://attack.mitre.org/groups/G0143) has primarily targeted entities in the telecommunications, technology, and government sectors.(Citation: CrowdStrike AQUATIC PANDA December 2021)",
"aliases": [
"Aquatic Panda"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0143",
"external_id": "G0143"
},
{
"source_name": "CrowdStrike AQUATIC PANDA December 2021",
"description": "Wiley, B. et al. (2021, December 29). OverWatch Exposes AQUATIC PANDA in Possession of Log4Shell Exploit Tools During Hands-on Intrusion Attempt. Retrieved January 18, 2022.",
"url": "https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"NST Assure Research Team, NetSentries Technologies",
"Pooja Natarajan, NEC Corporation India",
"Hiroki Nagahama, NEC Corporation",
"Manikantan Srinivasan, NEC Corporation India",
"Jai Minton, CrowdStrike",
"Jennifer Kim Roman, CrowdStrike"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:58.464000+00:00\", \"old_value\": \"2024-10-10 14:31:59.099000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--a0cb9370-e39b-44d5-9f50-ef78e412b973",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:45.629000+00:00",
"modified": "2026-07-31 18:48:11.488000+00:00",
"name": "Axiom",
"description": "[Axiom](https://attack.mitre.org/groups/G0001) is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between [Axiom](https://attack.mitre.org/groups/G0001) and [Winnti Group](https://attack.mitre.org/groups/G0044) but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.(Citation: Kaspersky Winnti April 2013)(Citation: Kaspersky Winnti June 2015)(Citation: Novetta Winnti April 2015)",
"aliases": [
"Axiom",
"Group 72"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0001",
"external_id": "G0001"
},
{
"source_name": "Group 72",
"description": "(Citation: Cisco Group 72)"
},
{
"source_name": "Axiom",
"description": "(Citation: Novetta-Axiom)"
},
{
"source_name": "Cisco Group 72",
"description": "Esler, J., Lee, M., and Williams, C. (2014, October 14). Threat Spotlight: Group 72. Retrieved January 14, 2016.",
"url": "http://blogs.cisco.com/security/talos/threat-spotlight-group-72"
},
{
"source_name": "Kaspersky Winnti April 2013",
"description": "Kaspersky Lab's Global Research and Analysis Team. (2013, April 11). Winnti. More than just a game. Retrieved February 8, 2017.",
"url": "https://securelist.com/winnti-more-than-just-a-game/37029/"
},
{
"source_name": "Novetta Winnti April 2015",
"description": "Novetta Threat Research Group. (2015, April 7). Winnti Analysis. Retrieved February 8, 2017.",
"url": "https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf"
},
{
"source_name": "Novetta-Axiom",
"description": "Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.",
"url": "https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"
},
{
"source_name": "Kaspersky Winnti June 2015",
"description": "Tarakanov, D. (2015, June 22). Games are over: Winnti is now targeting pharmaceutical companies. Retrieved January 14, 2016.",
"url": "https://securelist.com/games-are-over/70991/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:11.488000+00:00\", \"old_value\": \"2025-04-16 20:37:36.790000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--7f848c02-4d1e-4808-a4ae-4670681370a9",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-06-01 20:26:53.880000+00:00",
"modified": "2026-07-31 20:48:39.235000+00:00",
"name": "BITTER",
"description": "[BITTER](https://attack.mitre.org/groups/G1002) is a suspected South Asian cyber espionage threat group that has been active since at least 2013. [BITTER](https://attack.mitre.org/groups/G1002) has targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Citation: Forcepoint BITTER Pakistan Oct 2016)",
"aliases": [
"BITTER",
"T-APT-17"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1002",
"external_id": "G1002"
},
{
"source_name": "T-APT-17",
"description": "(Citation: Cisco Talos Bitter Bangladesh May 2022)"
},
{
"source_name": "Forcepoint BITTER Pakistan Oct 2016",
"description": "Dela Paz, R. (2016, October 21). BITTER: a targeted attack against Pakistan. Retrieved June 1, 2022.",
"url": "https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"
},
{
"source_name": "Cisco Talos Bitter Bangladesh May 2022",
"description": "Raghuprasad, C . (2022, May 11). Bitter APT adds Bangladesh to their targets. Retrieved June 1, 2022.",
"url": "https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:39.235000+00:00\", \"old_value\": \"2024-04-11 02:52:27.131000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--93f52415-0fe4-4d3d-896c-fc9b8e88ab90",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-01-16 16:13:52.465000+00:00",
"modified": "2026-07-31 18:48:09.344000+00:00",
"name": "BRONZE BUTLER",
"description": "[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.(Citation: Trend Micro Daserf Nov 2017)(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)",
"aliases": [
"BRONZE BUTLER",
"REDBALDKNIGHT",
"Tick"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0060",
"external_id": "G0060"
},
{
"source_name": "BRONZE BUTLER",
"description": "(Citation: Trend Micro Daserf Nov 2017)(Citation: Trend Micro Tick November 2019)"
},
{
"source_name": "REDBALDKNIGHT",
"description": "(Citation: Trend Micro Daserf Nov 2017)(Citation: Trend Micro Tick November 2019)"
},
{
"source_name": "Tick",
"description": "(Citation: Trend Micro Daserf Nov 2017)(Citation: Symantec Tick Apr 2016)(Citation: Trend Micro Tick November 2019)"
},
{
"source_name": "Trend Micro Daserf Nov 2017",
"description": "Chen, J. and Hsieh, M. (2017, November 7). REDBALDKNIGHT/BRONZE BUTLER\u2019s Daserf Backdoor Now Using Steganography. Retrieved December 27, 2017.",
"url": "http://blog.trendmicro.com/trendlabs-security-intelligence/redbaldknight-bronze-butler-daserf-backdoor-now-using-steganography/"
},
{
"source_name": "Secureworks BRONZE BUTLER Oct 2017",
"description": "Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.",
"url": "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
},
{
"source_name": "Trend Micro Tick November 2019",
"description": "Chen, J. et al. (2019, November). Operation ENDTRADE: TICK\u2019s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.",
"url": "https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"
},
{
"source_name": "Symantec Tick Apr 2016",
"description": "DiMaggio, J. (2016, April 28). Tick cyberespionage group zeros in on Japan. Retrieved July 16, 2018.",
"url": "https://www.symantec.com/connect/blogs/tick-cyberespionage-group-zeros-japan"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Trend Micro Incorporated"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:09.344000+00:00\", \"old_value\": \"2025-04-25 14:48:57.719000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.3"
},
{
"type": "intrusion-set",
"id": "intrusion-set--9735c036-8ebe-47e9-9c77-b0ae656dab93",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-09-21 14:52:49.596000+00:00",
"modified": "2026-07-31 18:48:10.579000+00:00",
"name": "BackdoorDiplomacy",
"description": "[BackdoorDiplomacy](https://attack.mitre.org/groups/G0135) is a cyber espionage threat group that has been active since at least 2017. [BackdoorDiplomacy](https://attack.mitre.org/groups/G0135) has targeted Ministries of Foreign Affairs and telecommunication companies in Africa, Europe, the Middle East, and Asia.(Citation: ESET BackdoorDiplomacy Jun 2021)",
"aliases": [
"BackdoorDiplomacy"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0135",
"external_id": "G0135"
},
{
"source_name": "ESET BackdoorDiplomacy Jun 2021",
"description": "Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021",
"url": "https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Zaw Min Htun, @Z3TAE"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:10.579000+00:00\", \"old_value\": \"2025-04-25 14:48:58.613000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--02b16bd6-ae88-417a-8a3f-02c5e166175a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-12-16 23:19:40.207000+00:00",
"modified": "2026-07-31 18:47:34.923000+00:00",
"name": "BlackByte",
"description": "[BlackByte](https://attack.mitre.org/groups/G1043) is a ransomware threat actor operating since at least 2021. [BlackByte](https://attack.mitre.org/groups/G1043) is associated with several versions of ransomware also labeled [BlackByte Ransomware](https://attack.mitre.org/software/S1180). [BlackByte](https://attack.mitre.org/groups/G1043) ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as [BlackByte 2.0 Ransomware](https://attack.mitre.org/software/S1181) use more robust encryption mechanisms. [BlackByte](https://attack.mitre.org/groups/G1043) is notable for operations targeting critical infrastructure entities among other targets across North America.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)(Citation: Symantec BlackByte 2022)(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)",
"aliases": [
"BlackByte",
"Hecamede"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1043",
"external_id": "G1043"
},
{
"source_name": "Hecamede",
"description": "(Citation: Symantec BlackByte 2022)"
},
{
"source_name": "Picus BlackByte 2022",
"description": "Huseyin Can Yuceel. (2022, February 21). TTPs used by BlackByte Ransomware Targeting Critical Infrastructure. Retrieved December 16, 2024.",
"url": "https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"
},
{
"source_name": "Cisco BlackByte 2024",
"description": "James Nutland, Craig Jackson, Terryn Valikodath, & Brennan Evans. (2024, August 28). BlackByte blends tried-and-true tradecraft with newly disclosed vulnerabilities to support ongoing attacks. Retrieved December 16, 2024.",
"url": "https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/"
},
{
"source_name": "Microsoft BlackByte 2023",
"description": "Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.",
"url": "https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"
},
{
"source_name": "Symantec BlackByte 2022",
"description": "Symantec Threat Hunter Team. (2022, October 21). Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool. Retrieved December 16, 2024.",
"url": "https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"
},
{
"source_name": "FBI BlackByte 2022",
"description": "US Federal Bureau of Investigation & US Secret Service. (2022, February 11). Indicators of Compromise Associated with BlackByte Ransomware. Retrieved December 16, 2024.",
"url": "https://www.ic3.gov/CSA/2022/220211.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Kaung Zaw Hein"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:34.923000+00:00\", \"old_value\": \"2025-03-09 15:58:36.918000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--da49b9f1-ca99-443f-9728-0a074db66850",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-04-18 17:59:24.739000+00:00",
"modified": "2026-07-31 18:48:22.124000+00:00",
"name": "BlackOasis",
"description": "[BlackOasis](https://attack.mitre.org/groups/G0063) is a Middle Eastern threat group that is believed to be a customer of Gamma Group. The group has shown interest in prominent figures in the United Nations, as well as opposition bloggers, activists, regional news correspondents, and think tanks. (Citation: Securelist BlackOasis Oct 2017) (Citation: Securelist APT Trends Q2 2017) A group known by Microsoft as [NEODYMIUM](https://attack.mitre.org/groups/G0055) is reportedly associated closely with [BlackOasis](https://attack.mitre.org/groups/G0063) operations, but evidence that the group names are aliases has not been identified. (Citation: CyberScoop BlackOasis Oct 2017)",
"aliases": [
"BlackOasis"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0063",
"external_id": "G0063"
},
{
"source_name": "BlackOasis",
"description": "(Citation: Securelist BlackOasis Oct 2017) (Citation: Securelist APT Trends Q2 2017)"
},
{
"source_name": "Securelist BlackOasis Oct 2017",
"description": "Kaspersky Lab's Global Research & Analysis Team. (2017, October 16). BlackOasis APT and new targeted attacks leveraging zero-day exploit. Retrieved February 15, 2018.",
"url": "https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/"
},
{
"source_name": "Securelist APT Trends Q2 2017",
"description": "Kaspersky Lab's Global Research & Analysis Team. (2017, August 8). APT Trends report Q2 2017. Retrieved February 15, 2018.",
"url": "https://securelist.com/apt-trends-report-q2-2017/79332/"
},
{
"source_name": "CyberScoop BlackOasis Oct 2017",
"description": "Bing, C. (2017, October 16). Middle Eastern hacking group is using FinFisher malware to conduct international espionage. Retrieved February 15, 2018.",
"url": "https://www.cyberscoop.com/middle-eastern-hacking-group-using-finfisher-malware-conduct-international-espionage/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:22.124000+00:00\", \"old_value\": \"2025-04-25 14:49:40.224000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--6fe8a2a1-a1b0-4af8-953d-4babd329f8f8",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-05-05 18:36:45.970000+00:00",
"modified": "2026-07-31 18:48:01.102000+00:00",
"name": "BlackTech",
"description": "[BlackTech](https://attack.mitre.org/groups/G0098) is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia--particularly Taiwan, Japan, and Hong Kong--and the US since at least 2013. [BlackTech](https://attack.mitre.org/groups/G0098) has used a combination of custom malware, dual-use tools, and living off the land tactics to compromise media, construction, engineering, electronics, and financial company networks.(Citation: TrendMicro BlackTech June 2017)(Citation: Symantec Palmerworm Sep 2020)(Citation: Reuters Taiwan BlackTech August 2020)",
"aliases": [
"BlackTech",
"Palmerworm"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0098",
"external_id": "G0098"
},
{
"source_name": "Palmerworm",
"description": "(Citation: Symantec Palmerworm Sep 2020)(Citation: IronNet BlackTech Oct 2021)"
},
{
"source_name": "TrendMicro BlackTech June 2017",
"description": "Bermejo, L., et al. (2017, June 22). Following the Trail of BlackTech\u2019s Cyber Espionage Campaigns. Retrieved May 5, 2020.",
"url": "https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"
},
{
"source_name": "IronNet BlackTech Oct 2021",
"description": "Demboski, M., et al. (2021, October 26). China cyber attacks: the current threat landscape. Retrieved March 25, 2022.",
"url": "https://www.ironnet.com/blog/china-cyber-attacks-the-current-threat-landscape"
},
{
"source_name": "Reuters Taiwan BlackTech August 2020",
"description": "Lee, Y. (2020, August 19). Taiwan says China behind cyberattacks on government agencies, emails. Retrieved April 6, 2022.",
"url": "https://www.reuters.com/article/us-taiwan-cyber-china/taiwan-says-china-behind-cyberattacks-on-government-agencies-emails-idUSKCN25F0JK"
},
{
"source_name": "Symantec Palmerworm Sep 2020",
"description": "Threat Intelligence. (2020, September 29). Palmerworm: Espionage Gang Targets the Media, Finance, and Other Sectors. Retrieved March 25, 2022.",
"url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/palmerworm-blacktech-espionage-apt"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Tatsuya Daitoku, Cyber Defense Institute, Inc.",
"Hannah S"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:01.102000+00:00\", \"old_value\": \"2025-04-25 19:03:07.787000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--73a80fab-2aa3-48e0-a4d0-3a4828200aee",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-05-26 20:09:39.139000+00:00",
"modified": "2026-07-31 18:48:01.934000+00:00",
"name": "Blue Mockingbird",
"description": "[Blue Mockingbird](https://attack.mitre.org/groups/G0108) is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in December 2019.(Citation: RedCanary Mockingbird May 2020)",
"aliases": [
"Blue Mockingbird"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0108",
"external_id": "G0108"
},
{
"source_name": "RedCanary Mockingbird May 2020",
"description": "Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved May 26, 2020.",
"url": "https://redcanary.com/blog/blue-mockingbird-cryptominer/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Tony Lambert, Red Canary"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:01.934000+00:00\", \"old_value\": \"2024-07-10 18:53:44.277000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.3"
},
{
"type": "intrusion-set",
"id": "intrusion-set--3ea7add5-5b8f-45d8-b1f1-905d2729d62a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-01-13 20:51:13.494000+00:00",
"modified": "2026-07-31 18:47:50.794000+00:00",
"name": "CURIUM",
"description": "[CURIUM](https://attack.mitre.org/groups/G1012) is an Iranian threat group, first reported in September 2019 and active since at least July 2018, targeting IT service providers in the Middle East.(Citation: Symantec Tortoiseshell 2019) [CURIUM](https://attack.mitre.org/groups/G1012) has since invested in building relationships with potential targets via social media over a period of months to establish trust and confidence before sending malware. Security researchers note [CURIUM](https://attack.mitre.org/groups/G1012) has demonstrated great patience and persistence by chatting with potential targets daily and sending benign files to help lower their security consciousness.(Citation: Microsoft Iranian Threat Actor Trends November 2021)",
"aliases": [
"CURIUM",
"Crimson Sandstorm",
"TA456",
"Tortoise Shell",
"Yellow Liderc"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1012",
"external_id": "G1012"
},
{
"source_name": "Crimson Sandstorm",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Tortoise Shell",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "TA456",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)(Citation: Proofpoint TA456 Defense Contractor July 2021)"
},
{
"source_name": "Yellow Liderc",
"description": "(Citation: PWC Yellow Liderc 2023)"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Proofpoint TA456 Defense Contractor July 2021",
"description": "Miller, J. et. al. (2021, July 28). I Knew You Were Trouble: TA456 Targets Defense Contractor with Alluring Social Media Persona. Retrieved March 11, 2024.",
"url": "https://www.proofpoint.com/us/blog/threat-insight/i-knew-you-were-trouble-ta456-targets-defense-contractor-alluring-social-media"
},
{
"source_name": "Microsoft Iranian Threat Actor Trends November 2021",
"description": "MSTIC. (2021, November 16). Evolving trends in Iranian threat actor activity \u2013 MSTIC presentation at CyberWarCon 2021. Retrieved January 12, 2023.",
"url": "https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"
},
{
"source_name": "PWC Yellow Liderc 2023",
"description": "PwC Threat Intelligence. (2023, October 25). Yellow Liderc ships its scripts and delivers IMAPLoader malware. Retrieved August 14, 2024.",
"url": "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"
},
{
"source_name": "Symantec Tortoiseshell 2019",
"description": "Symantec Threat Hunter Team. (2019, September 18). Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks. Retrieved May 20, 2024.",
"url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Denise Tan",
"Wirapong Petshagun"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:50.794000+00:00\", \"old_value\": \"2024-10-02 12:13:42.278000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "3.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--55033a4d-3ffe-46b2-99b4-2c1541e9ce1c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:49.021000+00:00",
"modified": "2026-07-31 18:47:55.855000+00:00",
"name": "Carbanak",
"description": "[Carbanak](https://attack.mitre.org/groups/G0008) is a cybercriminal group that has used [Carbanak](https://attack.mitre.org/software/S0030) malware to target financial institutions since at least 2013. [Carbanak](https://attack.mitre.org/groups/G0008) may be linked to groups tracked separately as [Cobalt Group](https://attack.mitre.org/groups/G0080) and [FIN7](https://attack.mitre.org/groups/G0046) that have also used [Carbanak](https://attack.mitre.org/software/S0030) malware.(Citation: Kaspersky Carbanak)(Citation: FireEye FIN7 April 2017)(Citation: Europol Cobalt Mar 2018)(Citation: Secureworks GOLD NIAGARA Threat Profile)(Citation: Secureworks GOLD KINGSWOOD Threat Profile)",
"aliases": [
"Carbanak",
"Anunak"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0008",
"external_id": "G0008"
},
{
"source_name": "Carbanak",
"description": "(Citation: Kaspersky Carbanak) (Citation: Fox-It Anunak Feb 2015)"
},
{
"source_name": "Anunak",
"description": "(Citation: Fox-It Anunak Feb 2015)"
},
{
"source_name": "Kaspersky Carbanak",
"description": "Kaspersky Lab's Global Research and Analysis Team. (2015, February). CARBANAK APT THE GREAT BANK ROBBERY. Retrieved August 23, 2018.",
"url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf"
},
{
"source_name": "FireEye FIN7 April 2017",
"description": "Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017.",
"url": "https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"
},
{
"source_name": "Europol Cobalt Mar 2018",
"description": "Europol. (2018, March 26). Mastermind Behind EUR 1 Billion Cyber Bank Robbery Arrested in Spain. Retrieved October 10, 2018.",
"url": "https://www.europol.europa.eu/newsroom/news/mastermind-behind-eur-1-billion-cyber-bank-robbery-arrested-in-spain"
},
{
"source_name": "Secureworks GOLD NIAGARA Threat Profile",
"description": "CTU. (n.d.). GOLD NIAGARA. Retrieved September 21, 2021.",
"url": "https://www.secureworks.com/research/threat-profiles/gold-niagara"
},
{
"source_name": "Secureworks GOLD KINGSWOOD Threat Profile",
"description": "Secureworks. (n.d.). GOLD KINGSWOOD. Retrieved October 18, 2021.",
"url": "https://www.secureworks.com/research/threat-profiles/gold-kingswood?filter=item-financial-gain"
},
{
"source_name": "Fox-It Anunak Feb 2015",
"description": "Prins, R. (2015, February 16). Anunak (aka Carbanak) Update. Retrieved January 20, 2017.",
"url": "https://www.fox-it.com/en/news/blog/anunak-aka-carbanak-update/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Anastasios Pingios"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:55.855000+00:00\", \"old_value\": \"2025-04-25 14:49:30.378000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--8c1f0187-0826-4320-bddc-5f326cfcfe2c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-08-24 17:01:55.842000+00:00",
"modified": "2026-07-31 20:48:40.932000+00:00",
"name": "Chimera",
"description": "[Chimera](https://attack.mitre.org/groups/G0114) is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry.(Citation: Cycraft Chimera April 2020)(Citation: NCC Group Chimera January 2021)",
"aliases": [
"Chimera"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0114",
"external_id": "G0114"
},
{
"source_name": "Chimera",
"description": "(Citation: NCC Group Chimera January 2021) "
},
{
"source_name": "Cycraft Chimera April 2020",
"description": "Cycraft. (2020, April 15). APT Group Chimera - APT Operation Skeleton key Targets Taiwan Semiconductor Vendors. Retrieved August 24, 2020..",
"url": "https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"
},
{
"source_name": "NCC Group Chimera January 2021",
"description": "Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.",
"url": "https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:40.932000+00:00\", \"old_value\": \"2024-09-12 19:24:40.416000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--8b1e16f6-e7c8-4b7a-a5df-f81232c13e2f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-12-06 19:53:04.988000+00:00",
"modified": "2026-07-31 18:48:07.234000+00:00",
"name": "Cinnamon Tempest",
"description": "[Cinnamon Tempest](https://attack.mitre.org/groups/G1021) is a China-based threat group that has been active since at least 2021 deploying multiple strains of ransomware based on the leaked [Babuk](https://attack.mitre.org/software/S0638) source code. [Cinnamon Tempest](https://attack.mitre.org/groups/G1021) does not operate their ransomware on an affiliate model or purchase access but appears to act independently in all stages of the attack lifecycle. Based on victimology, the short lifespan of each ransomware variant, and use of malware attributed to government-sponsored threat groups, [Cinnamon Tempest](https://attack.mitre.org/groups/G1021) may be motivated by intellectual property theft or cyberespionage rather than financial gain.(Citation: Microsoft Ransomware as a Service)(Citation: Microsoft Threat Actor Naming July 2023)(Citation: Trend Micro Cheerscrypt May 2022)(Citation: SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022)",
"aliases": [
"Cinnamon Tempest",
"DEV-0401",
"Emperor Dragonfly",
"BRONZE STARLIGHT"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1021",
"external_id": "G1021"
},
{
"source_name": "BRONZE STARLIGHT",
"description": "(Citation: Dell SecureWorks BRONZE STARLIGHT Profile)"
},
{
"source_name": "DEV-0401",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Emperor Dragonfly",
"description": "(Citation: Sygnia Emperor Dragonfly October 2022)"
},
{
"source_name": "Sygnia Emperor Dragonfly October 2022",
"description": "Biderman, O. et al. (2022, October 3). REVEALING EMPEROR DRAGONFLY: NIGHT SKY AND CHEERSCRYPT - A SINGLE RANSOMWARE GROUP. Retrieved December 6, 2023.",
"url": "https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"
},
{
"source_name": "SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022",
"description": "Counter Threat Unit Research Team . (2022, June 23). BRONZE STARLIGHT RANSOMWARE OPERATIONS USE HUI LOADER. Retrieved December 7, 2023.",
"url": "https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader"
},
{
"source_name": "Trend Micro Cheerscrypt May 2022",
"description": "Dela Cruz, A. et al. (2022, May 25). New Linux-Based Ransomware Cheerscrypt Targeting ESXi Devices Linked to Leaked Babuk Source Code. Retrieved December 19, 2023.",
"url": "https://www.trendmicro.com/en_se/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft Ransomware as a Service",
"description": "Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.",
"url": "https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"
},
{
"source_name": "Dell SecureWorks BRONZE STARLIGHT Profile",
"description": "SecureWorks. (n.d.). BRONZE STARLIGHT. Retrieved December 6, 2023.",
"url": "https://www.secureworks.com/research/threat-profiles/bronze-starlight"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:07.234000+00:00\", \"old_value\": \"2024-04-04 23:27:22.311000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--8f5e8dc7-739d-4f5e-a8a1-a66e004d7063",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:46.390000+00:00",
"modified": "2026-07-31 18:48:08.140000+00:00",
"name": "Cleaver",
"description": "[Cleaver](https://attack.mitre.org/groups/G0003) is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. (Citation: Cylance Cleaver) Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 (TG-2889). (Citation: Dell Threat Group 2889)",
"aliases": [
"Cleaver",
"Threat Group 2889",
"TG-2889"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0003",
"external_id": "G0003"
},
{
"source_name": "Cleaver",
"description": "(Citation: Cylance Cleaver)"
},
{
"source_name": "Threat Group 2889",
"description": "(Citation: Dell Threat Group 2889)"
},
{
"source_name": "TG-2889",
"description": "(Citation: Dell Threat Group 2889)"
},
{
"source_name": "Cylance Cleaver",
"description": "Cylance. (2014, December). Operation Cleaver. Retrieved September 14, 2017.",
"url": "https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf"
},
{
"source_name": "Dell Threat Group 2889",
"description": "Dell SecureWorks. (2015, October 7). Suspected Iran-Based Hacker Group Creates Network of Fake LinkedIn Profiles. Retrieved January 14, 2016.",
"url": "http://www.secureworks.com/cyber-threat-intelligence/threats/suspected-iran-based-hacker-group-creates-network-of-fake-linkedin-profiles/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:08.140000+00:00\", \"old_value\": \"2025-04-16 20:37:38.869000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.3"
},
{
"type": "intrusion-set",
"id": "intrusion-set--dc6fe6ee-04c2-49be-ba3d-f38d2463c02a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-10-17 00:14:20.652000+00:00",
"modified": "2026-07-31 18:48:22.149000+00:00",
"name": "Cobalt Group",
"description": "[Cobalt Group](https://attack.mitre.org/groups/G0080) is a financially motivated threat group that has primarily targeted financial institutions since at least 2016. The group has conducted intrusions to steal money via targeting ATM systems, card processing, payment systems and SWIFT systems. [Cobalt Group](https://attack.mitre.org/groups/G0080) has mainly targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. The group has been known to target organizations in order to use their access to then compromise additional victims.(Citation: Talos Cobalt Group July 2018)(Citation: PTSecurity Cobalt Group Aug 2017)(Citation: PTSecurity Cobalt Dec 2016)(Citation: Group IB Cobalt Aug 2017)(Citation: Proofpoint Cobalt June 2017)(Citation: RiskIQ Cobalt Nov 2017)(Citation: RiskIQ Cobalt Jan 2018) Reporting indicates there may be links between [Cobalt Group](https://attack.mitre.org/groups/G0080) and both the malware [Carbanak](https://attack.mitre.org/software/S0030) and the group [Carbanak](https://attack.mitre.org/groups/G0008).(Citation: Europol Cobalt Mar 2018)",
"aliases": [
"Cobalt Group",
"GOLD KINGSWOOD",
"Cobalt Gang",
"Cobalt Spider"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0080",
"external_id": "G0080"
},
{
"source_name": "Cobalt Spider",
"description": "(Citation: Crowdstrike Global Threat Report Feb 2018)"
},
{
"source_name": "GOLD KINGSWOOD",
"description": "(Citation: Secureworks GOLD KINGSWOOD September 2018)"
},
{
"source_name": "Cobalt Gang",
"description": "(Citation: Talos Cobalt Group July 2018) (Citation: Crowdstrike Global Threat Report Feb 2018)(Citation: Morphisec Cobalt Gang Oct 2018)"
},
{
"source_name": "Cobalt Group",
"description": "(Citation: Talos Cobalt Group July 2018) (Citation: PTSecurity Cobalt Group Aug 2017) (Citation: PTSecurity Cobalt Dec 2016) (Citation: Proofpoint Cobalt June 2017) (Citation: RiskIQ Cobalt Nov 2017) (Citation: RiskIQ Cobalt Jan 2018)"
},
{
"source_name": "Crowdstrike Global Threat Report Feb 2018",
"description": "CrowdStrike. (2018, February 26). CrowdStrike 2018 Global Threat Report. Retrieved October 10, 2018.",
"url": "https://crowdstrike.lookbookhq.com/global-threat-report-2018-web/cs-2018-global-threat-report"
},
{
"source_name": "Secureworks GOLD KINGSWOOD September 2018",
"description": "CTU. (2018, September 27). Cybercriminals Increasingly Trying to Ensnare the Big Financial Fish. Retrieved September 20, 2021.",
"url": "https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish"
},
{
"source_name": "Europol Cobalt Mar 2018",
"description": "Europol. (2018, March 26). Mastermind Behind EUR 1 Billion Cyber Bank Robbery Arrested in Spain. Retrieved October 10, 2018.",
"url": "https://www.europol.europa.eu/newsroom/news/mastermind-behind-eur-1-billion-cyber-bank-robbery-arrested-in-spain"
},
{
"source_name": "Morphisec Cobalt Gang Oct 2018",
"description": "Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.",
"url": "https://blog.morphisec.com/cobalt-gang-2.0"
},
{
"source_name": "RiskIQ Cobalt Nov 2017",
"description": "Klijnsma, Y.. (2017, November 28). Gaffe Reveals Full List of Targets in Spear Phishing Attack Using Cobalt Strike Against Financial Institutions. Retrieved October 10, 2018.",
"url": "https://web.archive.org/web/20190508170630/https://www.riskiq.com/blog/labs/cobalt-strike/"
},
{
"source_name": "RiskIQ Cobalt Jan 2018",
"description": "Klijnsma, Y.. (2018, January 16). First Activities of Cobalt Group in 2018: Spear Phishing Russian Banks. Retrieved October 10, 2018.",
"url": "https://web.archive.org/web/20190508170147/https://www.riskiq.com/blog/labs/cobalt-group-spear-phishing-russian-banks/"
},
{
"source_name": "Group IB Cobalt Aug 2017",
"description": "Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.",
"url": "https://www.group-ib.com/blog/cobalt"
},
{
"source_name": "Proofpoint Cobalt June 2017",
"description": "Mesa, M, et al. (2017, June 1). Microsoft Word Intruder Integrates CVE-2017-0199, Utilized by Cobalt Group to Target Financial Institutions. Retrieved October 10, 2018.",
"url": "https://www.proofpoint.com/us/threat-insight/post/microsoft-word-intruder-integrates-cve-2017-0199-utilized-cobalt-group-target"
},
{
"source_name": "PTSecurity Cobalt Dec 2016",
"description": "Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.",
"url": "https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf"
},
{
"source_name": "PTSecurity Cobalt Group Aug 2017",
"description": "Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.",
"url": "https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-2017-eng.pdf"
},
{
"source_name": "Talos Cobalt Group July 2018",
"description": "Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.",
"url": "https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:22.149000+00:00\", \"old_value\": \"2025-04-16 20:37:34.214000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--6eded342-33e5-4451-b6b2-e1c62863129f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-12-26 23:11:39.442000+00:00",
"modified": "2026-07-31 20:48:37.252000+00:00",
"name": "Confucius",
"description": "[Confucius](https://attack.mitre.org/groups/G0142) is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. Security researchers have noted similarities between [Confucius](https://attack.mitre.org/groups/G0142) and [Patchwork](https://attack.mitre.org/groups/G0040), particularly in their respective custom malware code and targets.(Citation: TrendMicro Confucius APT Feb 2018)(Citation: TrendMicro Confucius APT Aug 2021)(Citation: Uptycs Confucius APT Jan 2021)",
"aliases": [
"Confucius",
"Confucius APT"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0142",
"external_id": "G0142"
},
{
"source_name": "TrendMicro Confucius APT Feb 2018",
"description": "Lunghi, D and Horejsi, J. (2018, February 13). Deciphering Confucius: A Look at the Group's Cyberespionage Operations. Retrieved December 26, 2021.",
"url": "https://www.trendmicro.com/en_us/research/18/b/deciphering-confucius-cyberespionage-operations.html"
},
{
"source_name": "TrendMicro Confucius APT Aug 2021",
"description": "Lunghi, D. (2021, August 17). Confucius Uses Pegasus Spyware-related Lures to Target Pakistani Military. Retrieved December 26, 2021.",
"url": "https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html"
},
{
"source_name": "Uptycs Confucius APT Jan 2021",
"description": "Uptycs Threat Research Team. (2021, January 12). Confucius APT deploys Warzone RAT. Retrieved December 17, 2021.",
"url": "https://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:37.252000+00:00\", \"old_value\": \"2025-04-16 20:37:36.476000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--46599a4a-77ee-4697-9474-2683b6464859",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-10-19 17:04:30.994000+00:00",
"modified": "2026-07-31 18:47:53.854000+00:00",
"name": "Contagious Interview",
"description": "[Contagious Interview](https://attack.mitre.org/groups/G1052) is a North Korea\u2013aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. [Contagious Interview](https://attack.mitre.org/groups/G1052) targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities. (Citation: Validin Contagious Interview North Korea ClickFix January 2025)(Citation: Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: Datadog Contagious Interview Tenacious Pungsan October 2024)(Citation: Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025)(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)(Citation: Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023)(Citation: PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024)",
"aliases": [
"Contagious Interview",
"DeceptiveDevelopment",
"Gwisin Gang",
"Tenacious Pungsan",
"DEV#POPPER",
"PurpleBravo",
"TAG-121"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1052",
"external_id": "G1052"
},
{
"source_name": "Tenacious Pungsan",
"description": "(Citation: Datadog Contagious Interview Tenacious Pungsan October 2024)"
},
{
"source_name": "DeceptiveDevelopment",
"description": "(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)"
},
{
"source_name": "PurpleBravo",
"description": "(Citation: Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025)"
},
{
"source_name": "TAG-121",
"description": "(Citation: Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025)"
},
{
"source_name": "DEV#POPPER",
"description": "(Citation: Securonix Contagious Interview DEVPOPPER April 2024)"
},
{
"source_name": "Gwisin Gang",
"description": "(Citation: Sentinel One Contagious Interview ClickFix September 2025)(Citation: dtex DPRK 2025 structure ITworkers)"
},
{
"source_name": "Sentinel One Contagious Interview ClickFix September 2025",
"description": "Aleksandar Milenkoski, Sreekar Madabushi, Kenneth Kinion. (2025, September 4). Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms. Retrieved October 20, 2025.",
"url": "https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/"
},
{
"source_name": "Validin Contagious Interview North Korea ClickFix January 2025",
"description": "Efstratios Lontzetidis. (2025, January 16). Lazarus APT: Techniques for Hunting Contagious Interview. Retrieved October 20, 2025.",
"url": "https://www.validin.com/blog/inoculating_contagious_interview_with_validin/"
},
{
"source_name": "Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024",
"description": "eSentire Threat Response Unit (TRU). (2024, November 14). Bored BeaverTail & InvisibleFerret Yacht Club \u2013 A Lazarus Lure Pt.2. Retrieved October 17, 2025.",
"url": "https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"
},
{
"source_name": "Datadog Contagious Interview Tenacious Pungsan October 2024",
"description": "Ian Kretz, Sebastian Obregoso, Datadog Security Research Team. (2024, October 24). Tenacious Pungsan: A DPRK threat actor linked to Contagious Interview. Retrieved October 20, 2025.",
"url": "https://securitylabs.datadoghq.com/articles/tenacious-pungsan-dprk-threat-actor-contagious-interview/"
},
{
"source_name": "Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025",
"description": "Insikt Group. (2025, February 13). Inside the Scam: North Korea\u2019s IT Worker Threat. Retrieved October 17, 2025.",
"url": "https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat"
},
{
"source_name": "ESET Contagious Interview BeaverTail InvisibleFerret February 2025",
"description": "Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025.",
"url": "https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"
},
{
"source_name": "dtex DPRK 2025 structure ITworkers",
"description": "Michael \u201cBarni\u201d Barnhart, DTEX, and Anonymous SMEs. (2025, May 14). Exposing DPRK's Cyber Syndicate and Hidden IT Workforce. Retrieved September 3, 2025.",
"url": "https://reports.dtexsystems.com/DTEX-Exposing+DPRK+Cyber+Syndicate+and+Hidden+IT+Workforce.pdf"
},
{
"source_name": "Securonix Contagious Interview DEVPOPPER April 2024",
"description": "Securonix Threat Research, D.Iuzvyk, T. Peck, O.Kolesnikov. (2024, April 24). Analysis of DEV#POPPER: New Attack Campaign Targeting Software Developers Likely Associated With North Korean Threat Actors. Retrieved October 20, 2025.",
"url": "https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/"
},
{
"source_name": "Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024",
"description": "Seongsu Park. (2024, November 4). From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West. Retrieved October 17, 2025.",
"url": "https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"
},
{
"source_name": "PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023",
"description": "Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025.",
"url": "https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"
},
{
"source_name": "PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024",
"description": "Unit42. (2024, October 9). Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware. Retrieved October 17, 2025.",
"url": "https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:53.854000+00:00\", \"old_value\": \"2026-05-12 15:12:00.732000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--dcd81c6e-ebf7-4a16-93e0-9a97fa49c88a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-01-16 16:13:52.465000+00:00",
"modified": "2026-07-31 18:48:22.254000+00:00",
"name": "CopyKittens",
"description": "[CopyKittens](https://attack.mitre.org/groups/G0052) is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip.(Citation: ClearSky CopyKittens March 2017)(Citation: ClearSky Wilted Tulip July 2017)(Citation: CopyKittens Nov 2015)",
"aliases": [
"CopyKittens"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0052",
"external_id": "G0052"
},
{
"source_name": "CopyKittens",
"description": "(Citation: ClearSky CopyKittens March 2017) (Citation: ClearSky Wilted Tulip July 2017) (Citation: CopyKittens Nov 2015)"
},
{
"source_name": "ClearSky Wilted Tulip July 2017",
"description": "ClearSky Cyber Security and Trend Micro. (2017, July). Operation Wilted Tulip: Exposing a cyber espionage apparatus. Retrieved August 21, 2017.",
"url": "http://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf"
},
{
"source_name": "ClearSky CopyKittens March 2017",
"description": "ClearSky Cyber Security. (2017, March 30). Jerusalem Post and other Israeli websites compromised by Iranian threat agent CopyKitten. Retrieved August 21, 2017.",
"url": "http://www.clearskysec.com/copykitten-jpost/"
},
{
"source_name": "CopyKittens Nov 2015",
"description": "Minerva Labs LTD and ClearSky Cyber Security. (2015, November 23). CopyKittens Attack Group. Retrieved November 17, 2024.",
"url": "https://cdn2.hubspot.net/hubfs/1903456/Whitepapers/CopyKittens.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.6",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:22.254000+00:00\", \"old_value\": \"2024-11-17 12:44:07.637000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.6"
},
{
"type": "intrusion-set",
"id": "intrusion-set--f3be6240-f68e-47e1-90d2-ad8f3b3bb8a6",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-07-25 17:13:06.098000+00:00",
"modified": "2026-07-31 18:48:26.166000+00:00",
"name": "Daggerfly",
"description": "[Daggerfly](https://attack.mitre.org/groups/G1034) is a People's Republic of China-linked APT entity active since at least 2012. [Daggerfly](https://attack.mitre.org/groups/G1034) has targeted individuals, government and NGO entities, and telecommunication companies in Asia and Africa. [Daggerfly](https://attack.mitre.org/groups/G1034) is associated with exclusive use of [MgBot](https://attack.mitre.org/software/S1146) malware and is noted for several potential supply chain infection campaigns.(Citation: Symantec Daggerfly 2023)(Citation: ESET EvasivePanda 2023)(Citation: Symantec Daggerfly 2024)(Citation: ESET EvasivePanda 2024)",
"aliases": [
"Daggerfly",
"Evasive Panda",
"BRONZE HIGHLAND"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1034",
"external_id": "G1034"
},
{
"source_name": "Evasive Panda",
"description": "(Citation: Symantec Daggerfly 2023)(Citation: ESET EvasivePanda 2024)"
},
{
"source_name": "BRONZE HIGHLAND",
"description": "(Citation: Symantec Daggerfly 2023)(Citation: ESET EvasivePanda 2024)"
},
{
"source_name": "ESET EvasivePanda 2024",
"description": "Ahn Ho, Facundo Mu\u00f1oz, & Marc-Etienne M.L\u00e9veill\u00e9. (2024, March 7). Evasive Panda leverages Monlam Festival to target Tibetans. Retrieved July 25, 2024.",
"url": "https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"
},
{
"source_name": "ESET EvasivePanda 2023",
"description": "Facundo Mu\u00f1oz. (2023, April 26). Evasive Panda APT group delivers malware via updates for popular Chinese software. Retrieved July 25, 2024.",
"url": "https://www.welivesecurity.com/2023/04/26/evasive-panda-apt-group-malware-updates-popular-chinese-software/"
},
{
"source_name": "Symantec Daggerfly 2023",
"description": "Threat Hunter Team. (2023, April 20). Daggerfly: APT Actor Targets Telecoms Company in Africa. Retrieved July 25, 2024.",
"url": "https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"
},
{
"source_name": "Symantec Daggerfly 2024",
"description": "Threat Hunter Team. (2024, July 23). Daggerfly: Espionage Group Makes Major Update to Toolset. Retrieved July 25, 2024.",
"url": "https://symantec-enterprise-blogs.security.com/threat-intelligence/daggerfly-espionage-updated-toolset"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Furkan Celik, PURE7"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:26.166000+00:00\", \"old_value\": \"2024-10-31 18:33:10.434000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--8a831aaa-f3e0-47a3-bed8-a9ced744dd12",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-10-17 00:14:20.652000+00:00",
"modified": "2026-07-31 20:48:40.500000+00:00",
"name": "Dark Caracal",
"description": "[Dark Caracal](https://attack.mitre.org/groups/G0070) is threat group that has been attributed to the Lebanese General Directorate of General Security (GDGS) and has operated since at least 2012. (Citation: Lookout Dark Caracal Jan 2018)",
"aliases": [
"Dark Caracal"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0070",
"external_id": "G0070"
},
{
"source_name": "Dark Caracal",
"description": "(Citation: Lookout Dark Caracal Jan 2018)"
},
{
"source_name": "Lookout Dark Caracal Jan 2018",
"description": "Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.",
"url": "https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:40.500000+00:00\", \"old_value\": \"2024-04-11 02:42:07.325000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.4"
},
{
"type": "intrusion-set",
"id": "intrusion-set--6b9ebeb5-20bf-48b0-afb7-988d769a2f01",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-10-17 00:14:20.652000+00:00",
"modified": "2026-07-31 20:48:36.928000+00:00",
"name": "DarkHydrus",
"description": "[DarkHydrus](https://attack.mitre.org/groups/G0079) is a threat group that has targeted government agencies and educational institutions in the Middle East since at least 2016. The group heavily leverages open-source tools and custom payloads for carrying out attacks. (Citation: Unit 42 DarkHydrus July 2018) (Citation: Unit 42 Playbook Dec 2017)",
"aliases": [
"DarkHydrus"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0079",
"external_id": "G0079"
},
{
"source_name": "DarkHydrus",
"description": "(Citation: Unit 42 DarkHydrus July 2018)"
},
{
"source_name": "Unit 42 DarkHydrus July 2018",
"description": "Falcone, R., et al. (2018, July 27). New Threat Actor Group DarkHydrus Targets Middle East Government. Retrieved August 2, 2018.",
"url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
},
{
"source_name": "Unit 42 Playbook Dec 2017",
"description": "Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.",
"url": "https://pan-unit42.github.io/playbook_viewer/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Oleg Skulkin, Group-IB"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:36.928000+00:00\", \"old_value\": \"2025-04-25 14:49:28.547000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.3"
},
{
"type": "intrusion-set",
"id": "intrusion-set--813636db-3939-4a45-bea9-6113e970c029",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-05-15 13:07:26.651000+00:00",
"modified": "2026-07-31 18:48:04.496000+00:00",
"name": "DarkVishnya",
"description": "[DarkVishnya](https://attack.mitre.org/groups/G0105) is a financially motivated threat actor targeting financial institutions in Eastern Europe. In 2017-2018 the group attacked at least 8 banks in this region.(Citation: Securelist DarkVishnya Dec 2018)",
"aliases": [
"DarkVishnya"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0105",
"external_id": "G0105"
},
{
"source_name": "DarkVishnya",
"description": "(Citation: Securelist DarkVishnya Dec 2018)"
},
{
"source_name": "Securelist DarkVishnya Dec 2018",
"description": "Golovanov, S. (2018, December 6). DarkVishnya: Banks attacked through direct connection to local network. Retrieved May 15, 2020.",
"url": "https://securelist.com/darkvishnya/89169/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:04.496000+00:00\", \"old_value\": \"2025-04-25 14:49:05.248000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--9e729a7e-0dd6-4097-95bf-db8d64911383",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:50.624000+00:00",
"modified": "2026-07-31 18:48:11.260000+00:00",
"name": "Darkhotel",
"description": "[Darkhotel](https://attack.mitre.org/groups/G0012) is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. [Darkhotel](https://attack.mitre.org/groups/G0012) has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks.(Citation: Kaspersky Darkhotel)(Citation: Securelist Darkhotel Aug 2015)(Citation: Microsoft Digital Defense FY20 Sept 2020)",
"aliases": [
"Darkhotel",
"DUBNIUM",
"Zigzag Hail"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0012",
"external_id": "G0012"
},
{
"source_name": "Darkhotel",
"description": "(Citation: Kaspersky Darkhotel)"
},
{
"source_name": "DUBNIUM",
"description": "(Citation: Microsoft Digital Defense FY20 Sept 2020)(Citation: Microsoft DUBNIUM June 2016)(Citation: Microsoft DUBNIUM Flash June 2016)(Citation: Microsoft DUBNIUM July 2016)"
},
{
"source_name": "Zigzag Hail",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Securelist Darkhotel Aug 2015",
"description": "Kaspersky Lab's Global Research & Analysis Team. (2015, August 10). Darkhotel's attacks in 2015. Retrieved November 2, 2018.",
"url": "https://securelist.com/darkhotels-attacks-in-2015/71713/"
},
{
"source_name": "Kaspersky Darkhotel",
"description": "Kaspersky Lab's Global Research and Analysis Team. (2014, November). The Darkhotel APT A Story of Unusual Hospitality. Retrieved November 12, 2014.",
"url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070903/darkhotel_kl_07.11.pdf"
},
{
"source_name": "Microsoft Digital Defense FY20 Sept 2020",
"description": "Microsoft . (2020, September 29). Microsoft Digital Defense Report FY20. Retrieved April 21, 2021.",
"url": "https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWxPuf"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft DUBNIUM July 2016",
"description": "Microsoft. (2016, July 14). Reverse engineering DUBNIUM \u2013 Stage 2 payload analysis . Retrieved March 31, 2021.",
"url": "https://www.microsoft.com/security/blog/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/"
},
{
"source_name": "Microsoft DUBNIUM Flash June 2016",
"description": "Microsoft. (2016, June 20). Reverse-engineering DUBNIUM\u2019s Flash-targeting exploit. Retrieved March 31, 2021.",
"url": "https://www.microsoft.com/security/blog/2016/06/20/reverse-engineering-dubniums-flash-targeting-exploit/"
},
{
"source_name": "Microsoft DUBNIUM June 2016",
"description": "Microsoft. (2016, June 9). Reverse-engineering DUBNIUM. Retrieved March 31, 2021.",
"url": "https://www.microsoft.com/security/blog/2016/06/09/reverse-engineering-dubnium-2/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Harry Kim, CODEMIZE"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:11.260000+00:00\", \"old_value\": \"2024-01-08 20:27:56.707000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "3.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--a653431d-6a5e-4600-8ad3-609b5af57064",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:49.412000+00:00",
"modified": "2026-07-31 18:48:11.915000+00:00",
"name": "Deep Panda",
"description": "[Deep Panda](https://attack.mitre.org/groups/G0009) is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications. (Citation: Alperovitch 2014) The intrusion into healthcare company Anthem has been attributed to [Deep Panda](https://attack.mitre.org/groups/G0009). (Citation: ThreatConnect Anthem) This group is also known as Shell Crew, WebMasters, KungFu Kittens, and PinkPanther. (Citation: RSA Shell Crew) [Deep Panda](https://attack.mitre.org/groups/G0009) also appears to be known as Black Vine based on the attribution of both group names to the Anthem intrusion. (Citation: Symantec Black Vine) Some analysts track [Deep Panda](https://attack.mitre.org/groups/G0009) and [APT19](https://attack.mitre.org/groups/G0073) as the same group, but it is unclear from open source information if the groups are the same. (Citation: ICIT China's Espionage Jul 2016)",
"aliases": [
"Deep Panda",
"Shell Crew",
"WebMasters",
"KungFu Kittens",
"PinkPanther",
"Black Vine"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0009",
"external_id": "G0009"
},
{
"source_name": "Deep Panda",
"description": "(Citation: Alperovitch 2014)"
},
{
"source_name": "Shell Crew",
"description": "(Citation: RSA Shell Crew)"
},
{
"source_name": "WebMasters",
"description": "(Citation: RSA Shell Crew)"
},
{
"source_name": "KungFu Kittens",
"description": "(Citation: RSA Shell Crew)"
},
{
"source_name": "PinkPanther",
"description": "(Citation: RSA Shell Crew)"
},
{
"source_name": "Black Vine",
"description": "(Citation: Symantec Black Vine)"
},
{
"source_name": "Alperovitch 2014",
"description": "Alperovitch, D. (2014, July 7). Deep in Thought: Chinese Targeting of National Security Think Tanks. Retrieved November 12, 2014.",
"url": "https://web.archive.org/web/20200424075623/https:/www.crowdstrike.com/blog/deep-thought-chinese-targeting-national-security-think-tanks/"
},
{
"source_name": "Symantec Black Vine",
"description": "DiMaggio, J.. (2015, August 6). The Black Vine cyberespionage group. Retrieved January 26, 2016.",
"url": "https://web.archive.org/web/20170823094836/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-black-vine-cyberespionage-group.pdf"
},
{
"source_name": "RSA Shell Crew",
"description": "RSA Incident Response. (2014, January). RSA Incident Response Emerging Threat Profile: Shell Crew. Retrieved January 14, 2016.",
"url": "https://www.rsa.com/content/dam/en/white-paper/rsa-incident-response-emerging-threat-profile-shell-crew.pdf"
},
{
"source_name": "ICIT China's Espionage Jul 2016",
"description": "Scott, J. and Spaniel, D. (2016, July 28). ICIT Brief - China\u2019s Espionage Dynasty: Economic Death by a Thousand Cuts. Retrieved June 7, 2018.",
"url": "https://web.archive.org/web/20171017072306/https://icitech.org/icit-brief-chinas-espionage-dynasty-economic-death-by-a-thousand-cuts/"
},
{
"source_name": "ThreatConnect Anthem",
"description": "ThreatConnect Research Team. (2015, February 27). The Anthem Hack: All Roads Lead to China. Retrieved January 26, 2016.",
"url": "https://www.threatconnect.com/the-anthem-hack-all-roads-lead-to-china/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Andrew Smith, @jakx_"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:11.915000+00:00\", \"old_value\": \"2025-04-16 20:37:39.486000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--f3bdec95-3d62-42d9-a840-29630f6cdc1a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:53.197000+00:00",
"modified": "2026-07-31 18:48:26.131000+00:00",
"name": "DragonOK",
"description": "[DragonOK](https://attack.mitre.org/groups/G0017) is a threat group that has targeted Japanese organizations with phishing emails. Due to overlapping TTPs, including similar custom tools, [DragonOK](https://attack.mitre.org/groups/G0017) is thought to have a direct or indirect relationship with the threat group [Moafee](https://attack.mitre.org/groups/G0002). (Citation: Operation Quantum Entanglement) It is known to use a variety of malware, including Sysget/HelloBridge, PlugX, PoisonIvy, FormerFirstRat, NFlog, and NewCT. (Citation: New DragonOK)",
"aliases": [
"DragonOK"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0017",
"external_id": "G0017"
},
{
"source_name": "DragonOK",
"description": "(Citation: Operation Quantum Entanglement) (Citation: New DragonOK)"
},
{
"source_name": "Operation Quantum Entanglement",
"description": "Haq, T., Moran, N., Vashisht, S., Scott, M. (2014, September). OPERATION QUANTUM ENTANGLEMENT. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20210920193513/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-quantum-entanglement.pdf"
},
{
"source_name": "New DragonOK",
"description": "Miller-Osborn, J., Grunzweig, J.. (2015, April). Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese Targets. Retrieved November 4, 2015.",
"url": "http://researchcenter.paloaltonetworks.com/2015/04/unit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:26.131000+00:00\", \"old_value\": \"2024-11-17 16:27:34.666000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--1c63d4ec-0a75-4daa-b1df-0d11af3d3cc1",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:05.217000+00:00",
"modified": "2026-07-31 20:48:28.048000+00:00",
"name": "Dragonfly",
"description": "[Dragonfly](https://attack.mitre.org/groups/G0035) is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022) Active since at least 2010, [Dragonfly](https://attack.mitre.org/groups/G0035) has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.(Citation: Symantec Dragonfly)(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Symantec Dragonfly Sept 2017)(Citation: Fortune Dragonfly 2.0 Sept 2017)(Citation: Gigamon Berserk Bear October 2021)(Citation: CISA AA20-296A Berserk Bear December 2020)(Citation: Symantec Dragonfly 2.0 October 2017)",
"aliases": [
"Dragonfly",
"TEMP.Isotope",
"DYMALLOY",
"Berserk Bear",
"TG-4192",
"Crouching Yeti",
"IRON LIBERTY",
"Energetic Bear",
"Ghost Blizzard",
"BROMINE"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0035",
"external_id": "G0035"
},
{
"source_name": "DYMALLOY",
"description": "(Citation: Dragos DYMALLOY )(Citation: UK GOV FSB Factsheet April 2022)"
},
{
"source_name": "Berserk Bear",
"description": "(Citation: Gigamon Berserk Bear October 2021)(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022)"
},
{
"source_name": "TEMP.Isotope",
"description": "(Citation: Mandiant Ukraine Cyber Threats January 2022)(Citation: Gigamon Berserk Bear October 2021)"
},
{
"source_name": "Ghost Blizzard",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "BROMINE",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Crouching Yeti",
"description": "(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Gigamon Berserk Bear October 2021)(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022)"
},
{
"source_name": "IRON LIBERTY",
"description": "(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Secureworks MCMD July 2019)(Citation: Secureworks Karagany July 2019)(Citation: UK GOV FSB Factsheet April 2022)"
},
{
"source_name": "TG-4192",
"description": "(Citation: Secureworks IRON LIBERTY July 2019)(Citation: UK GOV FSB Factsheet April 2022)"
},
{
"source_name": "Dragonfly",
"description": "(Citation: Symantec Dragonfly)(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Gigamon Berserk Bear October 2021)(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022)"
},
{
"source_name": "Energetic Bear",
"description": "(Citation: Symantec Dragonfly)(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Secureworks MCMD July 2019)(Citation: Secureworks Karagany July 2019)(Citation: Gigamon Berserk Bear October 2021)(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022)"
},
{
"source_name": "CISA AA20-296A Berserk Bear December 2020",
"description": "CISA. (2020, December 1). Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets. Retrieved December 9, 2021.",
"url": "https://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions"
},
{
"source_name": "DOJ Russia Targeting Critical Infrastructure March 2022",
"description": "Department of Justice. (2022, March 24). Four Russian Government Employees Charged in Two Historical Hacking Campaigns Targeting Critical Infrastructure Worldwide. Retrieved April 5, 2022.",
"url": "https://www.justice.gov/opa/pr/four-russian-government-employees-charged-two-historical-hacking-campaigns-targeting-critical"
},
{
"source_name": "Dragos DYMALLOY ",
"description": "Dragos. (n.d.). DYMALLOY. Retrieved August 20, 2020.",
"url": "https://www.dragos.com/threat/dymalloy/"
},
{
"source_name": "Fortune Dragonfly 2.0 Sept 2017",
"description": "Hackett, R. (2017, September 6). Hackers Have Penetrated Energy Grid, Symantec Warns. Retrieved June 6, 2018.",
"url": "http://fortune.com/2017/09/06/hack-energy-grid-symantec/"
},
{
"source_name": "Mandiant Ukraine Cyber Threats January 2022",
"description": "Hultquist, J. (2022, January 20). Anticipating Cyber Threats as the Ukraine Crisis Escalates. Retrieved January 24, 2022.",
"url": "https://www.mandiant.com/resources/ukraine-crisis-cyber-threats"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Secureworks MCMD July 2019",
"description": "Secureworks. (2019, July 24). MCMD Malware Analysis. Retrieved August 13, 2020.",
"url": "https://www.secureworks.com/research/mcmd-malware-analysis"
},
{
"source_name": "Secureworks IRON LIBERTY July 2019",
"description": "Secureworks. (2019, July 24). Resurgent Iron Liberty Targeting Energy Sector. Retrieved August 12, 2020.",
"url": "https://www.secureworks.com/research/resurgent-iron-liberty-targeting-energy-sector"
},
{
"source_name": "Secureworks Karagany July 2019",
"description": "Secureworks. (2019, July 24). Updated Karagany Malware Targets Energy Sector. Retrieved August 12, 2020.",
"url": "https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector"
},
{
"source_name": "Gigamon Berserk Bear October 2021",
"description": "Slowik, J. (2021, October). THE BAFFLING BERSERK BEAR: A DECADE\u2019S ACTIVITY TARGETING CRITICAL INFRASTRUCTURE. Retrieved December 6, 2021.",
"url": "https://vblocalhost.com/uploads/VB2021-Slowik.pdf"
},
{
"source_name": "Symantec Dragonfly Sept 2017",
"description": "Symantec Security Response. (2014, July 7). Dragonfly: Western energy sector targeted by sophisticated attack group. Retrieved September 9, 2017.",
"url": "https://docs.broadcom.com/doc/dragonfly_threat_against_western_energy_suppliers"
},
{
"source_name": "Symantec Dragonfly",
"description": "Symantec Security Response. (2014, June 30). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.",
"url": "https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"
},
{
"source_name": "Symantec Dragonfly 2.0 October 2017",
"description": "Symantec. (2017, October 7). Dragonfly: Western energy sector targeted by sophisticated attack group. Retrieved April 19, 2022.",
"url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/dragonfly-energy-sector-cyber-attacks"
},
{
"source_name": "UK GOV FSB Factsheet April 2022",
"description": "UK Gov. (2022, April 5). Russia's FSB malign activity: factsheet. Retrieved April 5, 2022.",
"url": "https://www.gov.uk/government/publications/russias-fsb-malign-cyber-activity-factsheet/russias-fsb-malign-activity-factsheet"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Dragos Threat Intelligence"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "4.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:28.048000+00:00\", \"old_value\": \"2024-01-08 20:40:31.822000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "4.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--129f2f77-1ab2-4c35-bd5e-21260cee92af",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-08-18 15:25:59.689000+00:00",
"modified": "2026-07-31 18:47:37.990000+00:00",
"name": "EXOTIC LILY",
"description": "[EXOTIC LILY](https://attack.mitre.org/groups/G1011) is a financially motivated group that has been closely linked with [Wizard Spider](https://attack.mitre.org/groups/G0102) and the deployment of ransomware including [Conti](https://attack.mitre.org/software/S0575) and [Diavol](https://attack.mitre.org/software/S0659). [EXOTIC LILY](https://attack.mitre.org/groups/G1011) may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.(Citation: Google EXOTIC LILY March 2022)",
"aliases": [
"EXOTIC LILY"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1011",
"external_id": "G1011"
},
{
"source_name": "Google EXOTIC LILY March 2022",
"description": "Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022.",
"url": "https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Phill Taylor, BT Security"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:37.990000+00:00\", \"old_value\": \"2025-04-16 20:37:34.060000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--cc613a49-9bfa-4e22-98d1-15ffbb03f034",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-07-01 20:12:30.184000+00:00",
"modified": "2026-07-31 20:48:47.844000+00:00",
"name": "Earth Lusca",
"description": "[Earth Lusca](https://attack.mitre.org/groups/G1006) is a suspected China-based cyber espionage group that has been active since at least April 2019. [Earth Lusca](https://attack.mitre.org/groups/G1006) has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some [Earth Lusca](https://attack.mitre.org/groups/G1006) operations may be financially motivated.(Citation: TrendMicro EarthLusca 2022)\n\n[Earth Lusca](https://attack.mitre.org/groups/G1006) has used malware commonly used by other Chinese threat groups, including [APT41](https://attack.mitre.org/groups/G0096) and the [Winnti Group](https://attack.mitre.org/groups/G0044) cluster, however security researchers assess [Earth Lusca](https://attack.mitre.org/groups/G1006)'s techniques and infrastructure are separate.(Citation: TrendMicro EarthLusca 2022)",
"aliases": [
"Earth Lusca",
"TAG-22",
"Charcoal Typhoon",
"CHROMIUM",
"ControlX"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1006",
"external_id": "G1006"
},
{
"source_name": "Charcoal Typhoon",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "ControlX",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "CHROMIUM",
"description": "(Citation: Microsoft Threat Actor Naming July 2023) (Citation: Recorded Future RedHotel August 2023)"
},
{
"source_name": "TAG-22",
"description": "(Citation: Recorded Future TAG-22 July 2021)"
},
{
"source_name": "TrendMicro EarthLusca 2022",
"description": "Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca\u2019s Operations. Retrieved July 1, 2022.",
"url": "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"
},
{
"source_name": "Recorded Future TAG-22 July 2021",
"description": "INSIKT GROUP. (2021, July 8). Chinese State-Sponsored Activity Group TAG-22 Targets Nepal, the Philippines, and Taiwan Using Winnti and Other Tooling. Retrieved September 16, 2024.",
"url": "https://www.recordedfuture.com/research/chinese-group-tag-22-targets-nepal-philippines-taiwan"
},
{
"source_name": "Recorded Future RedHotel August 2023",
"description": "Insikt Group. (2023, August 8). RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale. Retrieved March 11, 2024.",
"url": "https://go.recordedfuture.com/hubfs/reports/cta-2023-0808.pdf"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:47.844000+00:00\", \"old_value\": \"2025-06-06 14:55:18.144000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--03506554-5f37-4f8f-9ce4-0e9f01a1b484",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-04-18 17:59:24.739000+00:00",
"modified": "2026-07-31 18:47:35.392000+00:00",
"name": "Elderwood",
"description": "[Elderwood](https://attack.mitre.org/groups/G0066) is a suspected Chinese cyber espionage group that was reportedly responsible for the 2009 Google intrusion known as Operation Aurora. (Citation: Security Affairs Elderwood Sept 2012) The group has targeted defense organizations, supply chain manufacturers, human rights and nongovernmental organizations (NGOs), and IT service providers. (Citation: Symantec Elderwood Sept 2012) (Citation: CSM Elderwood Sept 2012)",
"aliases": [
"Elderwood",
"Elderwood Gang",
"Beijing Group",
"Sneaky Panda"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0066",
"external_id": "G0066"
},
{
"source_name": "Beijing Group",
"description": "(Citation: CSM Elderwood Sept 2012)"
},
{
"source_name": "Sneaky Panda",
"description": "(Citation: CSM Elderwood Sept 2012)"
},
{
"source_name": "Elderwood",
"description": "(Citation: Security Affairs Elderwood Sept 2012) (Citation: Symantec Elderwood Sept 2012) (Citation: CSM Elderwood Sept 2012)"
},
{
"source_name": "Elderwood Gang",
"description": "(Citation: Symantec Elderwood Sept 2012) (Citation: CSM Elderwood Sept 2012)"
},
{
"source_name": "CSM Elderwood Sept 2012",
"description": "Clayton, M.. (2012, September 14). Stealing US business secrets: Experts ID two huge cyber 'gangs' in China. Retrieved February 15, 2018.",
"url": "https://www.csmonitor.com/USA/2012/0914/Stealing-US-business-secrets-Experts-ID-two-huge-cyber-gangs-in-China"
},
{
"source_name": "Symantec Elderwood Sept 2012",
"description": "O'Gorman, G., and McDonald, G.. (2012, September 6). The Elderwood Project. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf"
},
{
"source_name": "Security Affairs Elderwood Sept 2012",
"description": "Paganini, P. (2012, September 9). Elderwood project, who is behind Op. Aurora and ongoing attacks?. Retrieved February 13, 2018.",
"url": "http://securityaffairs.co/wordpress/8528/hacking/elderwood-project-who-is-behind-op-aurora-and-ongoing-attacks.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Valerii Marchuk, Cybersecurity Help s.r.o."
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:35.392000+00:00\", \"old_value\": \"2024-11-17 19:55:07.587000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.3"
},
{
"type": "intrusion-set",
"id": "intrusion-set--a7f57cc1-4540-4429-823f-f4e56b8473c9",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-06-09 14:49:57.704000+00:00",
"modified": "2026-07-31 18:48:12.127000+00:00",
"name": "Ember Bear",
"description": "[Ember Bear](https://attack.mitre.org/groups/G1003) is a Russian state-sponsored cyber espionage group that has been active since at least 2020, linked to Russia's General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155).(Citation: CISA GRU29155 2024) [Ember Bear](https://attack.mitre.org/groups/G1003) has primarily focused operations against Ukrainian government and telecommunication entities, but has also operated against critical infrastructure entities in Europe and the Americas.(Citation: Cadet Blizzard emerges as novel threat actor) [Ember Bear](https://attack.mitre.org/groups/G1003) conducted the [WhisperGate](https://attack.mitre.org/software/S0689) destructive wiper attacks against Ukraine in early 2022.(Citation: CrowdStrike Ember Bear Profile March 2022)(Citation: Mandiant UNC2589 March 2022)(Citation: CISA GRU29155 2024) There is some confusion as to whether [Ember Bear](https://attack.mitre.org/groups/G1003) overlaps with another Russian-linked entity referred to as [Saint Bear](https://attack.mitre.org/groups/G1031). At present available evidence strongly suggests these are distinct activities with different behavioral profiles.(Citation: Cadet Blizzard emerges as novel threat actor)(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )",
"aliases": [
"Ember Bear",
"UNC2589",
"Bleeding Bear",
"DEV-0586",
"Cadet Blizzard",
"Frozenvista",
"UAC-0056"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1003",
"external_id": "G1003"
},
{
"source_name": "DEV-0586",
"description": "(Citation: Cadet Blizzard emerges as novel threat actor)"
},
{
"source_name": "Cadet Blizzard",
"description": "(Citation: Cadet Blizzard emerges as novel threat actor)"
},
{
"source_name": "Frozenvista",
"description": "(Citation: CISA GRU29155 2024)"
},
{
"source_name": "UAC-0056",
"description": "(Citation: CISA GRU29155 2024)"
},
{
"source_name": "Bleeding Bear",
"description": "(Citation: CrowdStrike Ember Bear Profile March 2022)"
},
{
"source_name": "UNC2589",
"description": "(Citation: Mandiant UNC2589 March 2022)"
},
{
"source_name": "CrowdStrike Ember Bear Profile March 2022",
"description": "CrowdStrike. (2022, March 30). Who is EMBER BEAR?. Retrieved June 9, 2022.",
"url": "https://www.crowdstrike.com/blog/who-is-ember-bear/"
},
{
"source_name": "Cadet Blizzard emerges as novel threat actor",
"description": "Microsoft Threat Intelligence. (2023, June 14). Cadet Blizzard emerges as a novel and distinct Russian threat actor. Retrieved July 10, 2023.",
"url": "https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"
},
{
"source_name": "Mandiant UNC2589 March 2022",
"description": "Sadowski, J; Hall, R. (2022, March 4). Responses to Russia's Invasion of Ukraine Likely to Spur Retaliation. Retrieved June 9, 2022.",
"url": "https://www.mandiant.com/resources/russia-invasion-ukraine-retaliation"
},
{
"source_name": "Palo Alto Unit 42 OutSteel SaintBot February 2022 ",
"description": "Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.",
"url": "https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"
},
{
"source_name": "CISA GRU29155 2024",
"description": "US Cybersecurity & Infrastructure Security Agency et al. (2024, September 5). Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Retrieved September 6, 2024.",
"url": "https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Hannah S"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:12.127000+00:00\", \"old_value\": \"2025-04-25 19:03:38.177000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--96e239be-ad99-49eb-b127-3007b8c1bec9",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:54.697000+00:00",
"modified": "2026-07-31 18:48:10.359000+00:00",
"name": "Equation",
"description": "[Equation](https://attack.mitre.org/groups/G0020) is a sophisticated threat group that employs multiple remote access tools. The group is known to use zero-day exploits and has developed the capability to overwrite the firmware of hard disk drives. (Citation: Kaspersky Equation QA)",
"aliases": [
"Equation"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0020",
"external_id": "G0020"
},
{
"source_name": "Equation",
"description": "(Citation: Kaspersky Equation QA)"
},
{
"source_name": "Kaspersky Equation QA",
"description": "Kaspersky Lab's Global Research and Analysis Team. (2015, February). Equation Group: Questions and Answers. Retrieved December 21, 2015.",
"url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:10.359000+00:00\", \"old_value\": \"2025-04-25 14:48:45.400000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--1f0f9a14-11aa-49aa-9174-bcd0eaa979de",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-01-22 16:46:17.790000+00:00",
"modified": "2026-07-31 18:47:41.686000+00:00",
"name": "Evilnum",
"description": "[Evilnum](https://attack.mitre.org/groups/G0120) is a financially motivated threat group that has been active since at least 2018.(Citation: ESET EvilNum July 2020)",
"aliases": [
"Evilnum"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0120",
"external_id": "G0120"
},
{
"source_name": "Evilnum",
"description": "(Citation: ESET EvilNum July 2020)"
},
{
"source_name": "ESET EvilNum July 2020",
"description": "Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.",
"url": "https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:41.686000+00:00\", \"old_value\": \"2025-04-25 14:49:26.766000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--fbe9387f-34e6-4828-ac28-3080020c597b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-12-14 16:46:06.044000+00:00",
"modified": "2026-07-31 18:48:28.130000+00:00",
"name": "FIN10",
"description": "[FIN10](https://attack.mitre.org/groups/G0051) is a financially motivated threat group that has targeted organizations in North America since at least 2013 through 2016. The group uses stolen data exfiltrated from victims to extort organizations. (Citation: FireEye FIN10 June 2017)",
"aliases": [
"FIN10"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0051",
"external_id": "G0051"
},
{
"source_name": "FIN10",
"description": "(Citation: FireEye FIN10 June 2017)"
},
{
"source_name": "FireEye FIN10 June 2017",
"description": "FireEye iSIGHT Intelligence. (2017, June 16). FIN10: Anatomy of a Cyber Extortion Operation. Retrieved November 17, 2024.",
"url": "https://services.google.com/fh/files/misc/rpt-fin-10-anatomy-of-a-cyber-en.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:28.130000+00:00\", \"old_value\": \"2024-11-17 14:57:09.164000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.3"
},
{
"type": "intrusion-set",
"id": "intrusion-set--fd66436e-4d33-450e-ac4c-f7810f1c85f4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-07-27 15:24:02.162000+00:00",
"modified": "2026-07-31 18:48:29.757000+00:00",
"name": "FIN13",
"description": "[FIN13](https://attack.mitre.org/groups/G1016) is a financially motivated cyber threat group that has targeted the financial, retail, and hospitality industries in Mexico and Latin America, as early as 2016. [FIN13](https://attack.mitre.org/groups/G1016) achieves its objectives by stealing intellectual property, financial data, mergers and acquisition information, or PII.(Citation: Mandiant FIN13 Aug 2022)(Citation: Sygnia Elephant Beetle Jan 2022)",
"aliases": [
"FIN13",
"Elephant Beetle"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1016",
"external_id": "G1016"
},
{
"source_name": "Elephant Beetle",
"description": "(Citation: Sygnia Elephant Beetle Jan 2022)"
},
{
"source_name": "Sygnia Elephant Beetle Jan 2022",
"description": "Sygnia Incident Response Team. (2022, January 5). TG2003: ELEPHANT BEETLE UNCOVERING AN ORGANIZED FINANCIAL-THEFT OPERATION. Retrieved February 9, 2023.",
"url": "https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"
},
{
"source_name": "Mandiant FIN13 Aug 2022",
"description": "Ta, V., et al. (2022, August 8). FIN13: A Cybercriminal Threat Actor Focused on Mexico. Retrieved February 9, 2023.",
"url": "https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Oren Biderman, Sygnia",
"Noam Lifshitz, Sygnia"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:29.757000+00:00\", \"old_value\": \"2026-01-20 15:10:22.473000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--d0b3393b-3bec-4ba3-bda9-199d30db47b6",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-01-31 02:01:45.129000+00:00",
"modified": "2026-07-31 20:48:48.493000+00:00",
"name": "FIN4",
"description": "[FIN4](https://attack.mitre.org/groups/G0085) is a financially-motivated threat group that has targeted confidential information related to the public financial market, particularly regarding healthcare and pharmaceutical companies, since at least 2013.(Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye FIN4 Stealing Insider NOV 2014) [FIN4](https://attack.mitre.org/groups/G0085) is unique in that they do not infect victims with typical persistent malware, but rather they focus on capturing credentials authorized to access email and other non-public correspondence.(Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye Hacking FIN4 Video Dec 2014)",
"aliases": [
"FIN4"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0085",
"external_id": "G0085"
},
{
"source_name": "FIN4",
"description": "(Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye FIN4 Stealing Insider NOV 2014)(Citation: FireEye Hacking FIN4 Video Dec 2014)"
},
{
"source_name": "FireEye FIN4 Stealing Insider NOV 2014",
"description": "Dennesen, K. et al.. (2014, November 30). FIN4: Stealing Insider Information for an Advantage in Stock Trading?. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20190508171649/https://www.fireeye.com/blog/threat-research/2014/11/fin4_stealing_insid.html"
},
{
"source_name": "FireEye Hacking FIN4 Video Dec 2014",
"description": "Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.",
"url": "https://www2.fireeye.com/WBNR-14Q4NAMFIN4.html"
},
{
"source_name": "FireEye Hacking FIN4 Dec 2014",
"description": "Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.",
"url": "https://www.mandiant.com/sites/default/files/2021-09/rpt-fin4.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:48.493000+00:00\", \"old_value\": \"2024-11-17 15:57:47.485000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--85403903-15e0-4f9f-9be4-a259ecad4022",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-01-16 16:13:52.465000+00:00",
"modified": "2026-07-31 20:48:39.976000+00:00",
"name": "FIN5",
"description": "[FIN5](https://attack.mitre.org/groups/G0053) is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries. The group is made up of actors who likely speak Russian. (Citation: FireEye Respond Webinar July 2017) (Citation: Mandiant FIN5 GrrCON Oct 2016) (Citation: DarkReading FireEye FIN5 Oct 2015)",
"aliases": [
"FIN5"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0053",
"external_id": "G0053"
},
{
"source_name": "FIN5",
"description": "(Citation: FireEye Respond Webinar July 2017) (Citation: Mandiant FIN5 GrrCON Oct 2016) (Citation: DarkReading FireEye FIN5 Oct 2015)"
},
{
"source_name": "FireEye Respond Webinar July 2017",
"description": "Scavella, T. and Rifki, A. (2017, July 20). Are you Ready to Respond? (Webinar). Retrieved October 4, 2017.",
"url": "https://www2.fireeye.com/WBNR-Are-you-ready-to-respond.html"
},
{
"source_name": "Mandiant FIN5 GrrCON Oct 2016",
"description": "Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017.",
"url": "https://www.youtube.com/watch?v=fevGZs0EQu8"
},
{
"source_name": "DarkReading FireEye FIN5 Oct 2015",
"description": "Higgins, K. (2015, October 13). Prolific Cybercrime Gang Favors Legit Login Credentials. Retrieved October 4, 2017.",
"url": "https://www.darkreading.com/analytics/prolific-cybercrime-gang-favors-legit-login-credentials/d/d-id/1322645?"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Walker Johnson"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:39.976000+00:00\", \"old_value\": \"2025-04-25 14:49:23.588000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--2a7914cf-dff3-428d-ab0f-1014d1c28aeb",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:06.015000+00:00",
"modified": "2026-07-31 20:48:30.435000+00:00",
"name": "FIN6",
"description": "[FIN6](https://attack.mitre.org/groups/G0037) is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)",
"aliases": [
"FIN6",
"Magecart Group 6",
"ITG08",
"Skeleton Spider",
"TAAL",
"Camouflage Tempest"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0037",
"external_id": "G0037"
},
{
"source_name": "Skeleton Spider",
"description": "(Citation: Crowdstrike Global Threat Report Feb 2018)"
},
{
"source_name": "FIN6",
"description": "(Citation: FireEye FIN6 April 2016)"
},
{
"source_name": "TAAL",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Camouflage Tempest",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Magecart Group 6",
"description": "(Citation: Security Intelligence ITG08 April 2020)"
},
{
"source_name": "ITG08",
"description": "(Citation: Security Intelligence More Eggs Aug 2019)"
},
{
"source_name": "Crowdstrike Global Threat Report Feb 2018",
"description": "CrowdStrike. (2018, February 26). CrowdStrike 2018 Global Threat Report. Retrieved October 10, 2018.",
"url": "https://crowdstrike.lookbookhq.com/global-threat-report-2018-web/cs-2018-global-threat-report"
},
{
"source_name": "FireEye FIN6 April 2016",
"description": "FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"
},
{
"source_name": "FireEye FIN6 Apr 2019",
"description": "McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019.",
"url": "https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Security Intelligence ITG08 April 2020",
"description": "Villadsen, O. (2020, April 7). ITG08 (aka FIN6) Partners With TrickBot Gang, Uses Anchor Framework. Retrieved October 8, 2020.",
"url": "https://securityintelligence.com/posts/itg08-aka-fin6-partners-with-trickbot-gang-uses-anchor-framework/"
},
{
"source_name": "Security Intelligence More Eggs Aug 2019",
"description": "Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.",
"url": "https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Center for Threat-Informed Defense (CTID)",
"Drew Church, Splunk"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "4.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:30.435000+00:00\", \"old_value\": \"2024-11-17 14:59:25.749000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "4.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--3753cc21-2dae-4dfb-8481-d004e74502cc",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:09.460000+00:00",
"modified": "2026-07-31 20:48:31.412000+00:00",
"name": "FIN7",
"description": "[FIN7](https://attack.mitre.org/groups/G0046) is a financially-motivated threat group that has been active since 2013. [FIN7](https://attack.mitre.org/groups/G0046) has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of [FIN7](https://attack.mitre.org/groups/G0046) was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, [FIN7](https://attack.mitre.org/groups/G0046) shifted operations to big game hunting (BGH), including use of [REvil](https://attack.mitre.org/software/S0496) ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the [Carbanak](https://attack.mitre.org/groups/G0008) Group, but multiple threat groups have been observed using [Carbanak](https://attack.mitre.org/software/S0030), leading these groups to be tracked separately.(Citation: FireEye FIN7 March 2017)(Citation: FireEye FIN7 April 2017)(Citation: FireEye CARBANAK June 2017)(Citation: FireEye FIN7 Aug 2018)(Citation: CrowdStrike Carbon Spider August 2021)(Citation: Mandiant FIN7 Apr 2022)(Citation: BiZone Lizar May 2021)",
"aliases": [
"FIN7",
"GOLD NIAGARA",
"ITG14",
"Carbon Spider",
"ELBRUS",
"Sangria Tempest"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0046",
"external_id": "G0046"
},
{
"source_name": "Carbon Spider",
"description": "(Citation: CrowdStrike Carbon Spider August 2021)"
},
{
"source_name": "FIN7",
"description": "(Citation: FireEye FIN7 March 2017) (Citation: FireEye FIN7 April 2017) (Citation: Morphisec FIN7 June 2017) (Citation: FireEye FIN7 Shim Databases) (Citation: FireEye FIN7 Aug 2018)"
},
{
"source_name": "ELBRUS",
"description": "(Citation: Microsoft Ransomware as a Service)"
},
{
"source_name": "Sangria Tempest",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "GOLD NIAGARA",
"description": "(Citation: Secureworks GOLD NIAGARA Threat Profile)"
},
{
"source_name": "Mandiant FIN7 Apr 2022",
"description": "Abdo, B., et al. (2022, April 4). FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7. Retrieved April 5, 2022.",
"url": "https://www.mandiant.com/resources/evolution-of-fin7"
},
{
"source_name": "FireEye CARBANAK June 2017",
"description": "Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018.",
"url": "https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html"
},
{
"source_name": "BiZone Lizar May 2021",
"description": "BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker\u2019s toolkit. Retrieved February 2, 2022.",
"url": "https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"
},
{
"source_name": "FireEye FIN7 April 2017",
"description": "Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017.",
"url": "https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"
},
{
"source_name": "FireEye FIN7 Aug 2018",
"description": "Carr, N., et al. (2018, August 01). On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation. Retrieved August 23, 2018.",
"url": "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
},
{
"source_name": "Secureworks GOLD NIAGARA Threat Profile",
"description": "CTU. (n.d.). GOLD NIAGARA. Retrieved September 21, 2021.",
"url": "https://www.secureworks.com/research/threat-profiles/gold-niagara"
},
{
"source_name": "FireEye FIN7 Shim Databases",
"description": "Erickson, J., McWhirt, M., Palombo, D. (2017, May 3). To SDB, Or Not To SDB: FIN7 Leveraging Shim Databases for Persistence. Retrieved July 18, 2017.",
"url": "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html"
},
{
"source_name": "Morphisec FIN7 June 2017",
"description": "Gorelik, M.. (2017, June 9). FIN7 Takes Another Bite at the Restaurant Industry. Retrieved July 13, 2017.",
"url": "http://blog.morphisec.com/fin7-attacks-restaurant-industry"
},
{
"source_name": "ITG14",
"description": "ITG14 shares campaign overlap with [FIN7](https://attack.mitre.org/groups/G0046).(Citation: IBM Ransomware Trends September 2020)"
},
{
"source_name": "CrowdStrike Carbon Spider August 2021",
"description": "Loui, E. and Reynolds, J. (2021, August 30). CARBON SPIDER Embraces Big Game Hunting, Part 1. Retrieved September 20, 2021.",
"url": "https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft Ransomware as a Service",
"description": "Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.",
"url": "https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"
},
{
"source_name": "FireEye FIN7 March 2017",
"description": "Miller, S., et al. (2017, March 7). FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings. Retrieved March 8, 2017.",
"url": "https://web.archive.org/web/20180808125108/https:/www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html"
},
{
"source_name": "IBM Ransomware Trends September 2020",
"description": "Singleton, C. and Kiefer, C. (2020, September 28). Ransomware 2020: Attack Trends Affecting Organizations Worldwide. Retrieved September 20, 2021.",
"url": "https://securityintelligence.com/posts/ransomware-2020-attack-trends-new-techniques-affecting-organizations-worldwide/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Edward Millington",
"Eric Loui, CrowdStrike Intelligence",
"Serhii Melnyk, Trustwave SpiderLabs"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "4.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:31.412000+00:00\", \"old_value\": \"2026-05-12 15:12:00.732000+00:00\"}}}",
"previous_version": "4.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--fd19bd82-1b14-49a1-a176-6cdc46b8a826",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-04-18 17:59:24.739000+00:00",
"modified": "2026-07-31 18:48:28.923000+00:00",
"name": "FIN8",
"description": "[FIN8](https://attack.mitre.org/groups/G0061) is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected [FIN8](https://attack.mitre.org/groups/G0061) switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Fin8 May 2016)(Citation: Bitdefender Sardonic Aug 2021)(Citation: Symantec FIN8 Jul 2023)",
"aliases": [
"FIN8",
"Syssphinx"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0061",
"external_id": "G0061"
},
{
"source_name": "FIN8",
"description": "(Citation: FireEye Obfuscation June 2017)"
},
{
"source_name": "Syssphinx",
"description": "(Citation: Symantec FIN8 Jul 2023)"
},
{
"source_name": "FireEye Obfuscation June 2017",
"description": "Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.",
"url": "https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html"
},
{
"source_name": "Bitdefender Sardonic Aug 2021",
"description": "Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.",
"url": "https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"
},
{
"source_name": "FireEye Fin8 May 2016",
"description": "Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.",
"url": "https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html"
},
{
"source_name": "Symantec FIN8 Jul 2023",
"description": "Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.",
"url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Daniyal Naeem, BT Security",
"Serhii Melnyk, Trustwave SpiderLabs"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:28.923000+00:00\", \"old_value\": \"2025-04-16 20:37:35.846000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--6566aac9-dad8-4332-ae73-20c23bad7f02",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-09-28 17:41:12.950000+00:00",
"modified": "2026-07-31 18:47:58.927000+00:00",
"name": "Ferocious Kitten",
"description": "[Ferocious Kitten](https://attack.mitre.org/groups/G0137) is a threat group that has primarily targeted Persian-speaking individuals in Iran since at least 2015.(Citation: Kaspersky Ferocious Kitten Jun 2021)",
"aliases": [
"Ferocious Kitten"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0137",
"external_id": "G0137"
},
{
"source_name": "Kaspersky Ferocious Kitten Jun 2021",
"description": "GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.",
"url": "https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Pooja Natarajan, NEC Corporation India",
"Manikantan Srinivasan, NEC Corporation India",
"Hiroki Nagahama, NEC Corporation"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:58.927000+00:00\", \"old_value\": \"2025-04-25 14:49:38.455000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--c21dd6f1-1364-4a70-a1f7-783080ec34ee",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-12-21 21:49:47.307000+00:00",
"modified": "2026-07-31 18:48:16.208000+00:00",
"name": "Fox Kitten",
"description": "[Fox Kitten](https://attack.mitre.org/groups/G0117) is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. [Fox Kitten](https://attack.mitre.org/groups/G0117) has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.(Citation: ClearkSky Fox Kitten February 2020)(Citation: CrowdStrike PIONEER KITTEN August 2020)(Citation: Dragos PARISITE )(Citation: ClearSky Pay2Kitten December 2020)",
"aliases": [
"Fox Kitten",
"UNC757",
"Parisite",
"Pioneer Kitten",
"RUBIDIUM",
"Lemon Sandstorm"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0117",
"external_id": "G0117"
},
{
"source_name": "UNC757",
"description": "(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: CrowdStrike PIONEER KITTEN August 2020)"
},
{
"source_name": "Pioneer Kitten",
"description": "(Citation: CrowdStrike PIONEER KITTEN August 2020)(Citation: CISA AA20-259A Iran-Based Actor September 2020)"
},
{
"source_name": "Parisite",
"description": "(Citation: Dragos PARISITE )(Citation: ClearkSky Fox Kitten February 2020)(Citation: CrowdStrike PIONEER KITTEN August 2020)"
},
{
"source_name": "RUBIDIUM",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Lemon Sandstorm",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "CISA AA20-259A Iran-Based Actor September 2020",
"description": "CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.",
"url": "https://us-cert.cisa.gov/ncas/alerts/aa20-259a"
},
{
"source_name": "ClearSky Pay2Kitten December 2020",
"description": "ClearSky. (2020, December 17). Pay2Key Ransomware \u2013 A New Campaign by Fox Kitten. Retrieved December 21, 2020.",
"url": "https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"
},
{
"source_name": "ClearkSky Fox Kitten February 2020",
"description": "ClearSky. (2020, February 16). Fox Kitten \u2013 Widespread Iranian Espionage-Offensive Campaign. Retrieved December 21, 2020.",
"url": "https://www.clearskysec.com/fox-kitten/"
},
{
"source_name": "Dragos PARISITE ",
"description": "Dragos. (n.d.). PARISITE. Retrieved December 21, 2020.",
"url": "https://www.dragos.com/threat/parisite/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "CrowdStrike PIONEER KITTEN August 2020",
"description": "Orleans, A. (2020, August 31). Who Is PIONEER KITTEN?. Retrieved December 21, 2020.",
"url": "https://www.crowdstrike.com/blog/who-is-pioneer-kitten/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:16.208000+00:00\", \"old_value\": \"2026-05-12 15:12:00.732000+00:00\"}}}",
"previous_version": "2.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--06a11b7e-2a36-47fe-8d3e-82c265df3258",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-07-18 20:47:50.050000+00:00",
"modified": "2026-07-31 18:47:36.314000+00:00",
"name": "GALLIUM",
"description": "[GALLIUM](https://attack.mitre.org/groups/G0093) is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. This group is particularly known for launching Operation Soft Cell, a long-term campaign targeting telecommunications providers.(Citation: Cybereason Soft Cell June 2019) Security researchers have identified [GALLIUM](https://attack.mitre.org/groups/G0093) as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019)(Citation: Unit 42 PingPull Jun 2022)",
"aliases": [
"GALLIUM",
"Granite Typhoon"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0093",
"external_id": "G0093"
},
{
"source_name": "GALLIUM",
"description": "(Citation: Microsoft GALLIUM December 2019)"
},
{
"source_name": "Granite Typhoon",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Cybereason Soft Cell June 2019",
"description": "Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019.",
"url": "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft GALLIUM December 2019",
"description": "MSTIC. (2019, December 12). GALLIUM: Targeting global telecom. Retrieved January 13, 2021.",
"url": "https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"
},
{
"source_name": "Unit 42 PingPull Jun 2022",
"description": "Unit 42. (2022, June 13). GALLIUM Expands Targeting Across Telecommunications, Government and Finance Sectors With New PingPull Tool. Retrieved August 7, 2022.",
"url": "https://unit42.paloaltonetworks.com/pingpull-gallium/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Daniyal Naeem, BT Security",
"Cybereason Nocturnus, @nocturnus"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "4.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:36.314000+00:00\", \"old_value\": \"2024-04-17 22:10:27.139000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "4.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--0ea72cd5-ca30-46ba-bc04-378f701c658f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:05.611000+00:00",
"modified": "2026-07-31 18:47:37.385000+00:00",
"name": "GCMAN",
"description": "[GCMAN](https://attack.mitre.org/groups/G0036) is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency services. (Citation: Securelist GCMAN)",
"aliases": [
"GCMAN"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0036",
"external_id": "G0036"
},
{
"source_name": "GCMAN",
"description": "(Citation: Securelist GCMAN)"
},
{
"source_name": "Securelist GCMAN",
"description": "Kaspersky Lab's Global Research & Analysis Team. (2016, February 8). APT-style bank robberies increase with Metel, GCMAN and Carbanak 2.0 attacks. Retrieved April 20, 2016.",
"url": "https://securelist.com/apt-style-bank-robberies-increase-with-metel-gcman-and-carbanak-2-0-attacks/73638/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:37.385000+00:00\", \"old_value\": \"2025-04-25 14:49:37.572000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--c77c5576-ca19-42ed-a36f-4b4486a84133",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-09-22 19:41:27.845000+00:00",
"modified": "2026-07-31 20:48:45.767000+00:00",
"name": "GOLD SOUTHFIELD",
"description": "[GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) is a financially motivated threat group active since at least 2018 that operates the [REvil](https://attack.mitre.org/software/S0496) Ransomware-as-a Service (RaaS). [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments. By early 2020, [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) started capitalizing on the new trend of stealing data and further extorting the victim to pay for their data to not get publicly leaked.(Citation: Secureworks REvil September 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: Secureworks GOLD SOUTHFIELD)(Citation: CrowdStrike Evolution of Pinchy Spider July 2021)",
"aliases": [
"GOLD SOUTHFIELD",
"Pinchy Spider"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0115",
"external_id": "G0115"
},
{
"source_name": "Pinchy Spider",
"description": "(Citation: CrowdStrike Evolution of Pinchy Spider July 2021)"
},
{
"source_name": "Secureworks REvil September 2019",
"description": "Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.",
"url": "https://www.secureworks.com/research/revil-sodinokibi-ransomware"
},
{
"source_name": "CrowdStrike Evolution of Pinchy Spider July 2021",
"description": "Meyers, Adam. (2021, July 6). The Evolution of PINCHY SPIDER from GandCrab to REvil. Retrieved March 28, 2023.",
"url": "https://www.crowdstrike.com/blog/the-evolution-of-revil-ransomware-and-pinchy-spider/"
},
{
"source_name": "Secureworks GandCrab and REvil September 2019",
"description": "Secureworks . (2019, September 24). REvil: The GandCrab Connection. Retrieved August 4, 2020.",
"url": "https://www.secureworks.com/blog/revil-the-gandcrab-connection"
},
{
"source_name": "Secureworks GOLD SOUTHFIELD",
"description": "Secureworks. (n.d.). GOLD SOUTHFIELD. Retrieved October 6, 2020.",
"url": "https://www.secureworks.com/research/threat-profiles/gold-southfield"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Thijn Bukkems, Amazon"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:45.767000+00:00\", \"old_value\": \"2025-04-16 20:37:38.397000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--2fd2be6a-d3a2-4a65-b499-05ea2693abee",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-01-30 14:26:42.897000+00:00",
"modified": "2026-07-31 18:47:47.052000+00:00",
"name": "Gallmaker",
"description": "[Gallmaker](https://attack.mitre.org/groups/G0084) is a cyberespionage group that has targeted victims in the Middle East and has been active since at least December 2017. The group has mainly targeted victims in the defense, military, and government sectors.(Citation: Symantec Gallmaker Oct 2018)",
"aliases": [
"Gallmaker"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0084",
"external_id": "G0084"
},
{
"source_name": "Gallmaker",
"description": "(Citation: Symantec Gallmaker Oct 2018)"
},
{
"source_name": "Symantec Gallmaker Oct 2018",
"description": "Symantec Security Response. (2018, October 10). Gallmaker: New Attack Group Eschews Malware to Live off the Land. Retrieved November 27, 2018.",
"url": "https://www.symantec.com/blogs/threat-intelligence/gallmaker-attack-group"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:47.052000+00:00\", \"old_value\": \"2025-04-25 14:49:34.304000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--2e290bfe-93b5-48ce-97d6-edcd6d32b7cf",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:09.849000+00:00",
"modified": "2026-07-31 18:47:46.487000+00:00",
"name": "Gamaredon Group",
"description": "[Gamaredon Group](https://attack.mitre.org/groups/G0047) is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name [Gamaredon Group](https://attack.mitre.org/groups/G0047) derives from a misspelling of the word \"Armageddon,\" found in early campaigns.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: Symantec Shuckworm January 2022)(Citation: Microsoft Actinium February 2022)\n\nIn November 2021, the Ukrainian government publicly attributed [Gamaredon Group](https://attack.mitre.org/groups/G0047) to Russia\u2019s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. (Citation: Bleepingcomputer Gamardeon FSB November 2021)(Citation: Microsoft Actinium February 2022)",
"aliases": [
"Gamaredon Group",
"IRON TILDEN",
"Primitive Bear",
"ACTINIUM",
"Armageddon",
"Shuckworm",
"DEV-0157",
"Aqua Blizzard",
"NastyShrew"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0047",
"external_id": "G0047"
},
{
"source_name": "Cloudflare 2026 Threat Report New Threat Actors March 2026",
"description": " Cloudflare. (2026, March 3). Introducing the 2026 Cloudflare Threat Report. Retrieved April 18, 2026.",
"url": "https://blog.cloudflare.com/2026-threat-report/"
},
{
"source_name": "NastyShrew",
"description": "(Citation: Cloudflare 2026 Threat Report New Threat Actors March 2026)"
},
{
"source_name": "ACTINIUM",
"description": "(Citation: Microsoft Actinium February 2022)"
},
{
"source_name": "DEV-0157",
"description": "(Citation: Microsoft Actinium February 2022)"
},
{
"source_name": "Aqua Blizzard",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Gamaredon Group",
"description": "(Citation: Palo Alto Gamaredon Feb 2017)"
},
{
"source_name": "IRON TILDEN",
"description": "(Citation: Secureworks IRON TILDEN Profile)"
},
{
"source_name": "Armageddon",
"description": "(Citation: Symantec Shuckworm January 2022)"
},
{
"source_name": "Shuckworm",
"description": "(Citation: Symantec Shuckworm January 2022)"
},
{
"source_name": "Primitive Bear",
"description": "(Citation: Unit 42 Gamaredon February 2022)"
},
{
"source_name": "ESET Gamaredon June 2020",
"description": "Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.",
"url": "https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"
},
{
"source_name": "TrendMicro Gamaredon April 2020",
"description": "Kakara, H., Maruyama, E. (2020, April 17). Gamaredon APT Group Use Covid-19 Lure in Campaigns. Retrieved May 19, 2020.",
"url": "https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/"
},
{
"source_name": "Palo Alto Gamaredon Feb 2017",
"description": "Kasza, A. and Reichel, D. (2017, February 27). The Gamaredon Group Toolset Evolution. Retrieved March 1, 2017.",
"url": "https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft Actinium February 2022",
"description": "Microsoft Threat Intelligence Center. (2022, February 4). ACTINIUM targets Ukrainian organizations. Retrieved February 18, 2022.",
"url": "https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"
},
{
"source_name": "Secureworks IRON TILDEN Profile",
"description": "Secureworks CTU. (n.d.). IRON TILDEN. Retrieved February 24, 2022.",
"url": "https://www.secureworks.com/research/threat-profiles/iron-tilden"
},
{
"source_name": "Symantec Shuckworm January 2022",
"description": "Symantec. (2022, January 31). Shuckworm Continues Cyber-Espionage Attacks Against Ukraine. Retrieved February 17, 2022.",
"url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine"
},
{
"source_name": "Bleepingcomputer Gamardeon FSB November 2021",
"description": "Toulas, B. (2018, November 4). Ukraine links members of Gamaredon hacker group to Russian FSB. Retrieved April 15, 2022.",
"url": "https://www.bleepingcomputer.com/news/security/ukraine-links-members-of-gamaredon-hacker-group-to-russian-fsb/"
},
{
"source_name": "Unit 42 Gamaredon February 2022",
"description": "Unit 42. (2022, February 3). Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine. Retrieved February 21, 2022.",
"url": "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"ESET",
"Trend Micro Incorporated",
"Yoshihiro Kori, NEC Corporation",
"Manikantan Srinivasan, NEC Corporation India",
"Pooja Natarajan, NEC Corporation India"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "3.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:46.487000+00:00\", \"old_value\": \"2026-05-12 15:12:00.731000+00:00\"}}}",
"previous_version": "3.3"
},
{
"type": "intrusion-set",
"id": "intrusion-set--1f21da59-6a13-455b-afd0-d58d0a5a7d27",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-10-17 00:14:20.652000+00:00",
"modified": "2026-07-31 18:47:42.035000+00:00",
"name": "Gorgon Group",
"description": "[Gorgon Group](https://attack.mitre.org/groups/G0078) is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. (Citation: Unit 42 Gorgon Group Aug 2018)",
"aliases": [
"Gorgon Group"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0078",
"external_id": "G0078"
},
{
"source_name": "Gorgon Group",
"description": "(Citation: Unit 42 Gorgon Group Aug 2018)"
},
{
"source_name": "Unit 42 Gorgon Group Aug 2018",
"description": "Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.",
"url": "https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.5",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:42.035000+00:00\", \"old_value\": \"2026-05-12 15:12:00.731000+00:00\"}}}",
"previous_version": "1.5"
},
{
"type": "intrusion-set",
"id": "intrusion-set--7331c66a-5601-4d3f-acf6-ad9e3035eb40",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:08.304000+00:00",
"modified": "2026-07-31 18:48:01.862000+00:00",
"name": "Group5",
"description": "[Group5](https://attack.mitre.org/groups/G0043) is a threat group with a suspected Iranian nexus, though this attribution is not definite. The group has targeted individuals connected to the Syrian opposition via spearphishing and watering holes, normally using Syrian and Iranian themes. [Group5](https://attack.mitre.org/groups/G0043) has used two commonly available remote access tools (RATs), [njRAT](https://attack.mitre.org/software/S0385) and [NanoCore](https://attack.mitre.org/software/S0336), as well as an Android RAT, DroidJack. (Citation: Citizen Lab Group5)",
"aliases": [
"Group5"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0043",
"external_id": "G0043"
},
{
"source_name": "Group5",
"description": "(Citation: Citizen Lab Group5)"
},
{
"source_name": "Citizen Lab Group5",
"description": "Scott-Railton, J., et al. (2016, August 2). Group5: Syria and the Iranian Connection. Retrieved September 26, 2016.",
"url": "https://citizenlab.ca/2016/08/group5-syria/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:01.862000+00:00\", \"old_value\": \"2024-04-11 02:23:59.598000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.3"
},
{
"type": "intrusion-set",
"id": "intrusion-set--2688b13e-8e71-405a-9c40-0dee94bddf87",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-03-03 19:40:47.280000+00:00",
"modified": "2026-07-31 18:47:43.478000+00:00",
"name": "HAFNIUM",
"description": "[HAFNIUM](https://attack.mitre.org/groups/G0125) is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. [HAFNIUM](https://attack.mitre.org/groups/G0125) primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. [HAFNIUM](https://attack.mitre.org/groups/G0125) has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.(Citation: Microsoft HAFNIUM March 2020)(Citation: Volexity Exchange Marauder March 2021)(Citation: Microsoft Silk Typhoon MAR 2025)",
"aliases": [
"HAFNIUM",
"Operation Exchange Marauder",
"Silk Typhoon"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0125",
"external_id": "G0125"
},
{
"source_name": "Silk Typhoon",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)(Citation: Microsoft Silk Typhoon MAR 2025)"
},
{
"source_name": "Operation Exchange Marauder",
"description": "(Citation: Volexity Exchange Marauder March 2021)"
},
{
"source_name": "Volexity Exchange Marauder March 2021",
"description": "Gruzweig, J. et al. (2021, March 2). Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities. Retrieved March 3, 2021.",
"url": "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft Silk Typhoon MAR 2025",
"description": "Microsoft Threat Intelligence . (2025, March 5). Silk Typhoon targeting IT supply chain. Retrieved March 20, 2025.",
"url": "https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"
},
{
"source_name": "Microsoft HAFNIUM March 2020",
"description": "MSTIC. (2021, March 2). HAFNIUM targeting Exchange Servers with 0-day exploits. Retrieved March 3, 2021.",
"url": "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Daniyal Naeem, BT Security",
"Matt Brenton, Zurich Insurance Group",
"Mayuresh Dani, Qualys",
"Harshal Tupsamudre, Qualys",
"Vinayak Wadhwa, SAFE Security"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:43.478000+00:00\", \"old_value\": \"2025-03-25 18:04:13.368000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "3.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--f29b7c5e-2439-42ad-a86f-9f8984fafae3",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-10-17 00:14:20.652000+00:00",
"modified": "2026-07-31 20:48:51.374000+00:00",
"name": "HEXANE",
"description": "[HEXANE](https://attack.mitre.org/groups/G1001) is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. [HEXANE](https://attack.mitre.org/groups/G1001)'s TTPs appear similar to [APT33](https://attack.mitre.org/groups/G0064) and [OilRig](https://attack.mitre.org/groups/G0049) but due to differences in victims and tools it is tracked as a separate entity.(Citation: Dragos Hexane)(Citation: Kaspersky Lyceum October 2021)(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)",
"aliases": [
"HEXANE",
"Lyceum",
"Siamesekitten",
"Spirlin"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1001",
"external_id": "G1001"
},
{
"source_name": "Spirlin",
"description": "(Citation: Accenture Lyceum Targets November 2021)"
},
{
"source_name": "Siamesekitten",
"description": "(Citation: ClearSky Siamesekitten August 2021)"
},
{
"source_name": "Lyceum",
"description": "(Citation: SecureWorks August 2019)"
},
{
"source_name": "Accenture Lyceum Targets November 2021",
"description": "Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.",
"url": "https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns"
},
{
"source_name": "ClearSky Siamesekitten August 2021",
"description": "ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By \u201cSiamesekitten\u201d - Lyceum. Retrieved June 6, 2022.",
"url": "https://www.clearskysec.com/siamesekitten/"
},
{
"source_name": "Dragos Hexane",
"description": "Dragos. (n.d.). Hexane. Retrieved October 27, 2019.",
"url": "https://dragos.com/resource/hexane/"
},
{
"source_name": "Kaspersky Lyceum October 2021",
"description": "Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.",
"url": "https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"
},
{
"source_name": "SecureWorks August 2019",
"description": "SecureWorks 2019, August 27 LYCEUM Takes Center Stage in Middle East Campaign Retrieved. 2019/11/19 ",
"url": "https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Dragos Threat Intelligence",
"Mindaugas Gudzis, BT Security"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:51.374000+00:00\", \"old_value\": \"2026-05-12 15:12:00.732000+00:00\"}}}",
"previous_version": "2.3"
},
{
"type": "intrusion-set",
"id": "intrusion-set--54dfec3e-6464-4f74-9d69-b7c817b7e5a3",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-03-05 18:54:56.267000+00:00",
"modified": "2026-07-31 18:47:55.735000+00:00",
"name": "Higaisa",
"description": "[Higaisa](https://attack.mitre.org/groups/G0126) is a threat group suspected to have South Korean origins. [Higaisa](https://attack.mitre.org/groups/G0126) has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. [Higaisa](https://attack.mitre.org/groups/G0126) was first disclosed in early 2019 but is assessed to have operated as early as 2009.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)(Citation: PTSecurity Higaisa 2020)",
"aliases": [
"Higaisa"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0126",
"external_id": "G0126"
},
{
"source_name": "Malwarebytes Higaisa 2020",
"description": "Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.",
"url": "https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"
},
{
"source_name": "PTSecurity Higaisa 2020",
"description": "PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.",
"url": "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-and-new-year-greetings-the-higaisa-group/"
},
{
"source_name": "Zscaler Higaisa 2020",
"description": "Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.",
"url": "https://www.zscaler.com/blogs/security-research/return-higaisa-apt"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Daniyal Naeem, BT Security"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:55.735000+00:00\", \"old_value\": \"2025-10-22 02:54:00.893000+00:00\"}}}",
"previous_version": "1.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--cb41e991-65f4-4668-a65f-f4200545b5a1",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-06-06 17:16:38.704000+00:00",
"modified": "2026-07-31 20:48:47.333000+00:00",
"name": "INC Ransom",
"description": "[INC Ransom](https://attack.mitre.org/groups/G1032) is a ransomware and data extortion threat group associated with the deployment of [INC Ransomware](https://attack.mitre.org/software/S1139) that has been active since at least July 2023. [INC Ransom](https://attack.mitre.org/groups/G1032) has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.(Citation: Bleeping Computer INC Ransomware March 2024)(Citation: Cybereason INC Ransomware November 2023)(Citation: Secureworks GOLD IONIC April 2024)(Citation: SentinelOne INC Ransomware)",
"aliases": [
"INC Ransom",
"GOLD IONIC"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1032",
"external_id": "G1032"
},
{
"source_name": "GOLD IONIC",
"description": "(Citation: Secureworks GOLD IONIC April 2024)"
},
{
"source_name": "Secureworks GOLD IONIC April 2024",
"description": "Counter Threat Unit Research Team. (2024, April 15). GOLD IONIC DEPLOYS INC RANSOMWARE. Retrieved June 5, 2024.",
"url": "https://www.secureworks.com/blog/gold-ionic-deploys-inc-ransomware"
},
{
"source_name": "Cybereason INC Ransomware November 2023",
"description": "Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.",
"url": "https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"
},
{
"source_name": "SentinelOne INC Ransomware",
"description": "SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024.",
"url": "https://www.sentinelone.com/anthology/inc-ransom/"
},
{
"source_name": "Bleeping Computer INC Ransomware March 2024",
"description": "Toulas, B. (2024, March 27). INC Ransom threatens to leak 3TB of NHS Scotland stolen data. Retrieved June 5, 2024.",
"url": "https://www.bleepingcomputer.com/news/security/inc-ransom-threatens-to-leak-3tb-of-nhs-scotland-stolen-data/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Matt Anderson, @\u200cnosecurething, Huntress"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:47.333000+00:00\", \"old_value\": \"2024-10-28 19:03:08.838000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--ead23196-d7b6-4ce6-a124-4ab4b67d81bd",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-05-08 17:01:04.058000+00:00",
"modified": "2026-07-31 18:48:24.355000+00:00",
"name": "Inception",
"description": "[Inception](https://attack.mitre.org/groups/G0100) is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East.(Citation: Unit 42 Inception November 2018)(Citation: Symantec Inception Framework March 2018)(Citation: Kaspersky Cloud Atlas December 2014)",
"aliases": [
"Inception",
"Inception Framework",
"Cloud Atlas"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0100",
"external_id": "G0100"
},
{
"source_name": "Cloud Atlas",
"description": "(Citation: Kaspersky Cloud Atlas December 2014)"
},
{
"source_name": "Inception",
"description": "(Citation: Symantec Inception Framework March 2018)"
},
{
"source_name": "Inception Framework",
"description": "(Citation: Symantec Inception Framework March 2018)"
},
{
"source_name": "Kaspersky Cloud Atlas December 2014",
"description": "GReAT. (2014, December 10). Cloud Atlas: RedOctober APT is back in style. Retrieved May 8, 2020.",
"url": "https://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083/"
},
{
"source_name": "Unit 42 Inception November 2018",
"description": "Lancaster, T. (2018, November 5). Inception Attackers Target Europe with Year-old Office Vulnerability. Retrieved May 8, 2020.",
"url": "https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/"
},
{
"source_name": "Symantec Inception Framework March 2018",
"description": "Symantec. (2018, March 14). Inception Framework: Alive and Well, and Hiding Behind Proxies. Retrieved May 8, 2020.",
"url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Oleg Skulkin, Group-IB"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:24.355000+00:00\", \"old_value\": \"2024-04-11 02:15:23.096000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--e5603ea8-4c36-40e7-b7af-a077d24fedc1",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-09-24 21:41:34.797000+00:00",
"modified": "2026-07-31 18:48:23.936000+00:00",
"name": "IndigoZebra",
"description": "[IndigoZebra](https://attack.mitre.org/groups/G0136) is a suspected Chinese cyber espionage group that has been targeting Central Asian governments since at least 2014.(Citation: HackerNews IndigoZebra July 2021)(Citation: Checkpoint IndigoZebra July 2021)(Citation: Securelist APT Trends Q2 2017)",
"aliases": [
"IndigoZebra"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0136",
"external_id": "G0136"
},
{
"source_name": "IndigoZebra",
"description": "(Citation: HackerNews IndigoZebra July 2021)(Citation: Checkpoint IndigoZebra July 2021)(Citation: Securelist APT Trends Q2 2017)"
},
{
"source_name": "HackerNews IndigoZebra July 2021",
"description": "Lakshmanan, R.. (2021, July 1). IndigoZebra APT Hacking Campaign Targets the Afghan Government. Retrieved September 24, 2021.",
"url": "https://thehackernews.com/2021/07/indigozebra-apt-hacking-campaign.html"
},
{
"source_name": "Checkpoint IndigoZebra July 2021",
"description": "CheckPoint Research. (2021, July 1). IndigoZebra APT continues to attack Central Asia with evolving tools. Retrieved September 24, 2021.",
"url": "https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"
},
{
"source_name": "Securelist APT Trends Q2 2017",
"description": "Kaspersky Lab's Global Research & Analysis Team. (2017, August 8). APT Trends report Q2 2017. Retrieved February 15, 2018.",
"url": "https://securelist.com/apt-trends-report-q2-2017/79332/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Pooja Natarajan, NEC Corporation India",
"Yoshihiro Kori, NEC Corporation",
"Manikantan Srinivasan, NEC Corporation India"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:23.936000+00:00\", \"old_value\": \"2025-04-25 14:49:40.589000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--01e28736-2ffc-455b-9880-ed4d1407ae07",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-01-06 17:46:35.134000+00:00",
"modified": "2026-07-31 18:47:34.523000+00:00",
"name": "Indrik Spider",
"description": "[Indrik Spider](https://attack.mitre.org/groups/G0119) is a Russia-based cybercriminal group that has been active since at least 2014. [Indrik Spider](https://attack.mitre.org/groups/G0119) initially started with the [Dridex](https://attack.mitre.org/software/S0384) banking Trojan, and then by 2017 they began running ransomware operations using [BitPaymer](https://attack.mitre.org/software/S0570), [WastedLocker](https://attack.mitre.org/software/S0612), and Hades ransomware. Following U.S. sanctions and an indictment in 2019, [Indrik Spider](https://attack.mitre.org/groups/G0119) changed their tactics and diversified their toolset.(Citation: Crowdstrike Indrik November 2018)(Citation: Crowdstrike EvilCorp March 2021)(Citation: Treasury EvilCorp Dec 2019)",
"aliases": [
"Indrik Spider",
"Evil Corp",
"Manatee Tempest",
"DEV-0243",
"UNC2165"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0119",
"external_id": "G0119"
},
{
"source_name": "Evil Corp",
"description": "(Citation: Crowdstrike EvilCorp March 2021)(Citation: Treasury EvilCorp Dec 2019)"
},
{
"source_name": "UNC2165",
"description": "(Citation: Mandiant_UNC2165)"
},
{
"source_name": "Manatee Tempest",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "DEV-0243",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Crowdstrike Indrik November 2018",
"description": "Frankoff, S., Hartley, B. (2018, November 14). Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware. Retrieved January 6, 2021.",
"url": "https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"
},
{
"source_name": "Mandiant_UNC2165",
"description": "Mandiant Intelligence. (2022, June 2). To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions. Retrieved July 29, 2024.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Crowdstrike EvilCorp March 2021",
"description": "Podlosky, A., Feeley, B. (2021, March 17). INDRIK SPIDER Supersedes WastedLocker with Hades Ransomware to Circumvent OFAC Sanctions. Retrieved September 15, 2021.",
"url": "https://www.crowdstrike.com/blog/hades-ransomware-successor-to-indrik-spiders-wastedlocker/"
},
{
"source_name": "Treasury EvilCorp Dec 2019",
"description": "U.S. Department of Treasury. (2019, December 5). Treasury Sanctions Evil Corp, the Russia-Based Cybercriminal Group Behind Dridex Malware. Retrieved September 15, 2021.",
"url": "https://home.treasury.gov/news/press-releases/sm845"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Jennifer Kim Roman, CrowdStrike",
"Liran Ravich, CardinalOps"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "4.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:34.523000+00:00\", \"old_value\": \"2024-10-28 19:11:56.485000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "4.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--6713ab67-e25b-49cc-808d-2b36d4fbc35c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:47.177000+00:00",
"modified": "2026-07-31 18:47:59.619000+00:00",
"name": "Ke3chang",
"description": "[Ke3chang](https://attack.mitre.org/groups/G0004) is a threat group attributed to actors operating out of China. [Ke3chang](https://attack.mitre.org/groups/G0004) has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)(Citation: APT15 Intezer June 2018)(Citation: Microsoft NICKEL December 2021)",
"aliases": [
"Ke3chang",
"APT15",
"Mirage",
"Vixen Panda",
"GREF",
"Playful Dragon",
"RoyalAPT",
"NICKEL",
"Nylon Typhoon"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0004",
"external_id": "G0004"
},
{
"source_name": "RoyalAPT",
"description": "(Citation: APT15 Intezer June 2018)"
},
{
"source_name": "NICKEL",
"description": "(Citation: Microsoft NICKEL December 2021)"
},
{
"source_name": "Nylon Typhoon",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "APT15",
"description": "(Citation: NCC Group APT15 Alive and Strong)"
},
{
"source_name": "Mirage",
"description": "(Citation: NCC Group APT15 Alive and Strong)"
},
{
"source_name": "GREF",
"description": "(Citation: NCC Group APT15 Alive and Strong)"
},
{
"source_name": "Vixen Panda",
"description": "(Citation: NCC Group APT15 Alive and Strong)(Citation: APT15 Intezer June 2018)"
},
{
"source_name": "Playful Dragon",
"description": "(Citation: NCC Group APT15 Alive and Strong)(Citation: APT15 Intezer June 2018)"
},
{
"source_name": "Ke3chang",
"description": "(Citation: Villeneuve et al 2014) (Citation: NCC Group APT15 Alive and Strong) (Citation: APT15 Intezer June 2018)"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft NICKEL December 2021",
"description": "MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022.",
"url": "https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"
},
{
"source_name": "APT15 Intezer June 2018",
"description": "Rosenberg, J. (2018, June 14). MirageFox: APT15 Resurfaces With New Tools Based On Old Ones. Retrieved September 21, 2018.",
"url": "https://web.archive.org/web/20180615122133/https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/"
},
{
"source_name": "NCC Group APT15 Alive and Strong",
"description": "Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.",
"url": "https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"
},
{
"source_name": "Mandiant Operation Ke3chang November 2014",
"description": "Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION \u201cKE3CHANG\u201d: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.",
"url": "https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"
},
{
"source_name": "Villeneuve et al 2014",
"description": "Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION \u201cKE3CHANG\u201d: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.",
"url": "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-ke3chang.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Pooja Natarajan, NEC Corporation India",
"Manikantan Srinivasan, NEC Corporation India",
"Hiroki Nagahama, NEC Corporation"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "3.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:59.619000+00:00\", \"old_value\": \"2025-04-04 17:08:55.617000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "3.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--0ec2f388-bf0f-4b5c-97b1-fc736d26c25f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-08-26 15:03:02.577000+00:00",
"modified": "2026-07-31 20:48:24.117000+00:00",
"name": "Kimsuky",
"description": "[Kimsuky](https://attack.mitre.org/groups/G0094) is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. [Kimsuky](https://attack.mitre.org/groups/G0094) has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. [Kimsuky](https://attack.mitre.org/groups/G0094) operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing.(Citation: EST Kimsuky April 2019)(Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)(Citation: CISA AA20-301A Kimsuky)(Citation: Mandiant APT43 March 2024)(Citation: Proofpoint TA427 April 2024) \n\n[Kimsuky](https://attack.mitre.org/groups/G0094) was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).(Citation: Netscout Stolen Pencil Dec 2018)(Citation: EST Kimsuky SmokeScreen April 2019)(Citation: AhnLab Kimsuky Kabar Cobra Feb 2019) In 2023, [Kimsuky](https://attack.mitre.org/groups/G0094) was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance.(Citation: MSFT-AI)\n\nDPRK threat actor cluster boundaries overlap in open source reporting, with some security researchers consolidating all attributed North Korean state-sponsored cyber activity under [Lazarus Group](https://attack.mitre.org/groups/G0032), rather than tracking operationally distinct subgroups.",
"aliases": [
"Kimsuky",
"Black Banshee",
"Velvet Chollima",
"Emerald Sleet",
"THALLIUM",
"APT43",
"TA427",
"Springtail",
"Earth Kumiho",
"PatheticSlug"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0094",
"external_id": "G0094"
},
{
"source_name": "Cloudflare 2026 Threat Report New Threat Actors March 2026",
"description": " Cloudflare. (2026, March 3). Introducing the 2026 Cloudflare Threat Report. Retrieved April 18, 2026.",
"url": "https://blog.cloudflare.com/2026-threat-report/"
},
{
"source_name": "PatheticSlug",
"description": "(Citation: Cloudflare 2026 Threat Report New Threat Actors March 2026)"
},
{
"source_name": "Black Banshee",
"description": "(Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)"
},
{
"source_name": "THALLIUM",
"description": "(Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)(Citation: Mandiant APT43 March 2024)(Citation: Proofpoint TA427 April 2024)"
},
{
"source_name": "APT43",
"description": "(Citation: Mandiant APT43 March 2024)(Citation: Proofpoint TA427 April 2024)"
},
{
"source_name": "Emerald Sleet",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)(Citation: Proofpoint TA427 April 2024)"
},
{
"source_name": "TA427",
"description": "(Citation: Proofpoint TA427 April 2024)"
},
{
"source_name": "Earth Kumiho",
"description": "(Citation: Rapid7 Threat Landscape Actors March 2026)"
},
{
"source_name": "Kimsuky",
"description": "(Citation: Securelist Kimsuky Sept 2013)(Citation: Malwarebytes Kimsuky June 2021)"
},
{
"source_name": "Springtail",
"description": "(Citation: Symantec Troll Stealer 2024)"
},
{
"source_name": "Velvet Chollima",
"description": "(Citation: Zdnet Kimsuky Dec 2018)(Citation: ThreatConnect Kimsuky September 2020)(Citation: Malwarebytes Kimsuky June 2021)"
},
{
"source_name": "AhnLab Kimsuky Kabar Cobra Feb 2019",
"description": "AhnLab. (2019, February 28). Operation Kabar Cobra - Tenacious cyber-espionage campaign by Kimsuky Group. Retrieved September 29, 2021.",
"url": "https://global.ahnlab.com/global/upload/download/techreport/%5BAnalysis_Report%5DOperation%20Kabar%20Cobra.pdf"
},
{
"source_name": "EST Kimsuky April 2019",
"description": "Alyac. (2019, April 3). Kimsuky Organization Steals Operation Stealth Power. Retrieved August 13, 2019.",
"url": "https://blog.alyac.co.kr/2234"
},
{
"source_name": "Netscout Stolen Pencil Dec 2018",
"description": "ASERT team. (2018, December 5). STOLEN PENCIL Campaign Targets Academia. Retrieved February 5, 2019.",
"url": "https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/"
},
{
"source_name": "Zdnet Kimsuky Dec 2018",
"description": "Cimpanu, C.. (2018, December 5). Cyber-espionage group uses Chrome extension to infect victims. Retrieved August 26, 2019.",
"url": "https://www.zdnet.com/article/cyber-espionage-group-uses-chrome-extension-to-infect-victims/"
},
{
"source_name": "CISA AA20-301A Kimsuky",
"description": "CISA, FBI, CNMF. (2020, October 27). https://us-cert.cisa.gov/ncas/alerts/aa20-301a. Retrieved November 4, 2020.",
"url": "https://us-cert.cisa.gov/ncas/alerts/aa20-301a"
},
{
"source_name": "Cybereason Kimsuky November 2020",
"description": "Dahan, A. et al. (2020, November 2). Back to the Future: Inside the Kimsuky KGH Spyware Suite. Retrieved November 6, 2020.",
"url": "https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"
},
{
"source_name": "EST Kimsuky SmokeScreen April 2019",
"description": "ESTSecurity. (2019, April 17). Analysis of the APT Campaign \u2018Smoke Screen\u2019 targeting to Korea and US \ucd9c\ucc98: https://blog.alyac.co.kr/2243 [\uc774\uc2a4\ud2b8\uc2dc\ud050\ub9ac\ud2f0 \uc54c\uc57d \ube14\ub85c\uadf8]. Retrieved September 29, 2021.",
"url": "https://blog.alyac.co.kr/attachment/cfile5.uf@99A0CD415CB67E210DCEB3.pdf"
},
{
"source_name": "Malwarebytes Kimsuky June 2021",
"description": "Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.",
"url": "https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"
},
{
"source_name": "Proofpoint TA427 April 2024",
"description": "Lesnewich, G. et al. (2024, April 16). From Social Engineering to DMARC Abuse: TA427\u2019s Art of Information Gathering. Retrieved May 3, 2024.",
"url": "https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering"
},
{
"source_name": "Mandiant APT43 March 2024",
"description": "Mandiant. (2024, March 14). APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations. Retrieved May 3, 2024.",
"url": "https://services.google.com/fh/files/misc/apt43-report-en.pdf"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "MSFT-AI",
"description": "Microsoft Threat Intelligence. (2024, February 14). Staying ahead of threat actors in the age of AI. Retrieved March 11, 2024.",
"url": "https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/"
},
{
"source_name": "Rapid7 Threat Landscape Actors March 2026",
"description": "Rapid7. (2026, March 18). 2026 GLOBAL THREAT LANDSCAPE REPORT: Decoding the Accelerated Cyber Attack Cycle. Retrieved April 18, 2026.",
"url": "https://www.rapid7.com/cdn/assets/bltc1ddd6561ab54a26/69ba67de50ca691edcd3f5b7/rapid7-threat-landscape-report-2026.pdf"
},
{
"source_name": "Symantec Troll Stealer 2024",
"description": "Symantec Threat Hunter Team. (2024, May 16). Springtail: New Linux Backdoor Added to Toolkit. Retrieved January 17, 2025.",
"url": "https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage"
},
{
"source_name": "Securelist Kimsuky Sept 2013",
"description": "Tarakanov , D.. (2013, September 11). The \u201cKimsuky\u201d Operation: A North Korean APT?. Retrieved August 13, 2019.",
"url": "https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"
},
{
"source_name": "ThreatConnect Kimsuky September 2020",
"description": "ThreatConnect. (2020, September 28). Kimsuky Phishing Operations Putting In Work. Retrieved October 30, 2020.",
"url": "https://threatconnect.com/blog/kimsuky-phishing-operations-putting-in-work/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Dongwook Kim, KISA",
"Jaesang Oh, KC7 Foundation",
"Taewoo Lee, KISA",
"Wai Linn Oo, Kernellix Co.,Ltd."
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "5.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:24.117000+00:00\", \"old_value\": \"2026-04-23 18:46:50.938000+00:00\"}}}",
"previous_version": "5.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--d8bc9788-4f7d-41a9-9e9d-ee1ea18a8cf7",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-06-09 19:14:31.327000+00:00",
"modified": "2026-07-31 20:48:49.009000+00:00",
"name": "LAPSUS$",
"description": "[LAPSUS$](https://attack.mitre.org/groups/G1004) is cyber criminal threat group that has been active since at least mid-2021. [LAPSUS$](https://attack.mitre.org/groups/G1004) specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.(Citation: BBC LAPSUS Apr 2022)(Citation: MSTIC DEV-0537 Mar 2022)(Citation: UNIT 42 LAPSUS Mar 2022)",
"aliases": [
"LAPSUS$",
"DEV-0537",
"Strawberry Tempest"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1004",
"external_id": "G1004"
},
{
"source_name": "Strawberry Tempest",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "DEV-0537",
"description": "(Citation: MSTIC DEV-0537 Mar 2022)"
},
{
"source_name": "BBC LAPSUS Apr 2022",
"description": "BBC. (2022, April 1). LAPSUS: Two UK Teenagers Charged with Hacking for Gang. Retrieved June 9, 2022.",
"url": "https://www.bbc.com/news/technology-60953527"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "MSTIC DEV-0537 Mar 2022",
"description": "MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022.",
"url": "https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"
},
{
"source_name": "UNIT 42 LAPSUS Mar 2022",
"description": "UNIT 42. (2022, March 24). Threat Brief: Lapsus$ Group. Retrieved May 17, 2022.",
"url": "https://unit42.paloaltonetworks.com/lapsus-group/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"David Hughes, BT Security",
"Matt Brenton, Zurich Insurance Group",
"Fl\u00e1vio Costa, @Seguran\u00e7a Descomplicada",
"Caio Silva"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:49.009000+00:00\", \"old_value\": \"2025-04-21 19:40:47.538000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--c93fccb1-e8e8-42cf-ae33-2ad1d183913a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:03.807000+00:00",
"modified": "2026-07-31 20:48:46.106000+00:00",
"name": "Lazarus Group",
"description": "[Lazarus Group](https://attack.mitre.org/groups/G0032) is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). (Citation: US-CERT HIDDEN COBRA June 2017) (Citation: Treasury North Korean Cyber Groups September 2019) [Lazarus Group](https://attack.mitre.org/groups/G0032) has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by [Lazarus Group](https://attack.mitre.org/groups/G0032) correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.(Citation: Novetta Blockbuster)\n\nNorth Korea\u2019s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses \u201cLazarus Group\u201d as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.(Citation: Mandiant DPRK Laz Org Breakdown 2022)(Citation: Mandiant DPRK Groups 2023)(Citation: JPCert Blog Laz Subgroups 2025)\n\n",
"aliases": [
"Lazarus Group",
"Labyrinth Chollima",
"HIDDEN COBRA",
"Guardians of Peace",
"ZINC",
"NICKEL ACADEMY",
"Diamond Sleet"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0032",
"external_id": "G0032"
},
{
"source_name": "Labyrinth Chollima",
"description": "(Citation: CrowdStrike Labyrinth Chollima Feb 2022)"
},
{
"source_name": "Diamond Sleet",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "ZINC",
"description": "(Citation: Microsoft ZINC disruption Dec 2017)"
},
{
"source_name": "Lazarus Group",
"description": "(Citation: Novetta Blockbuster)"
},
{
"source_name": "NICKEL ACADEMY",
"description": "(Citation: Secureworks NICKEL ACADEMY Dec 2017)"
},
{
"source_name": "Guardians of Peace",
"description": "(Citation: US-CERT HIDDEN COBRA June 2017)"
},
{
"source_name": "CrowdStrike Labyrinth Chollima Feb 2022",
"description": "CrowdStrike. (2022, February 1). CrowdStrike Adversary Labyrinth Chollima. Retrieved February 1, 2022.",
"url": "https://web.archive.org/web/20210723190317/https://adversary.crowdstrike.com/en-US/adversary/labyrinth-chollima/"
},
{
"source_name": "Mandiant DPRK Groups 2023",
"description": "Michael Barnhart, Austin Larsen, Jeff Johnson, Taylor Long, Michelle Cantos, Adrian Hernandez. (2023, October 10). Assessed Cyber Structure and Alignments of North Korea in 2023. Retrieved August 25, 2025.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/north-korea-cyber-structure-alignment-2023"
},
{
"source_name": "Mandiant DPRK Laz Org Breakdown 2022",
"description": "Michael Barnhart, Michelle Cantos, Jeffery Johnson, Elias fox, Gary Freas, Dan Scott. (2022, March 23). Not So Lazarus: Mapping DPRK Cyber Threat Groups to Government Organizations. Retrieved September 9, 2025.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/mapping-dprk-groups-to-government/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Novetta Blockbuster",
"description": "Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.",
"url": "https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"
},
{
"source_name": "Secureworks NICKEL ACADEMY Dec 2017",
"description": "Secureworks. (2017, December 15). Media Alert - Secureworks Discovers North Korean Cyber Threat Group, Lazarus, Spearphishing Financial Executives of Cryptocurrency Companies. Retrieved December 27, 2017.",
"url": "https://www.secureworks.com/about/press/media-alert-secureworks-discovers-north-korean-cyber-threat-group-lazarus-spearphishing"
},
{
"source_name": "Microsoft ZINC disruption Dec 2017",
"description": "Smith, B. (2017, December 19). Microsoft and Facebook disrupt ZINC malware attack to protect customers and the internet from ongoing cyberthreats. Retrieved December 20, 2017.",
"url": "https://blogs.microsoft.com/on-the-issues/2017/12/19/microsoft-facebook-disrupt-zinc-malware-attack-protect-customers-internet-ongoing-cyberthreats/"
},
{
"source_name": "HIDDEN COBRA",
"description": "The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA.(Citation: US-CERT HIDDEN COBRA June 2017)(Citation: US-CERT HOPLIGHT Apr 2019)"
},
{
"source_name": "Treasury North Korean Cyber Groups September 2019",
"description": "US Treasury . (2019, September 13). Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups. Retrieved September 29, 2021.",
"url": "https://home.treasury.gov/news/press-releases/sm774"
},
{
"source_name": "US-CERT HIDDEN COBRA June 2017",
"description": "US-CERT. (2017, June 13). Alert (TA17-164A) HIDDEN COBRA \u2013 North Korea\u2019s DDoS Botnet Infrastructure. Retrieved July 13, 2017.",
"url": "https://www.us-cert.gov/ncas/alerts/TA17-164A"
},
{
"source_name": "US-CERT HOPLIGHT Apr 2019",
"description": "US-CERT. (2019, April 10). MAR-10135536-8 \u2013 North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019.",
"url": "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
},
{
"source_name": "JPCert Blog Laz Subgroups 2025",
"description": "\u4f50\u3005\u6728\u52c7\u4eba Hayato Sasaki. (2025, March 25). Tempted to Classifying APT Actors: Practical Challenges of Attribution in the Case of Lazarus\u2019s Subgroup. Retrieved August 25, 2025.",
"url": "https://blogs.jpcert.or.jp/en/2025/03/classifying-lazaruss-subgroup.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Kyaw Pyiyt Htet, @KyawPyiytHtet",
"Dragos Threat Intelligence",
"MyungUk Han, ASEC",
"Jun Hirata, NEC Corporation",
"Manikantan Srinivasan, NEC Corporation India",
"Pooja Natarajan, NEC Corporation India"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "5.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:46.106000+00:00\", \"old_value\": \"2026-05-12 15:12:00.732000+00:00\"}}}",
"previous_version": "5.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--abc5a1d4-f0dc-49d1-88a1-4a80e478bb03",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-11-24 19:26:27.305000+00:00",
"modified": "2026-07-31 18:48:12.417000+00:00",
"name": "LazyScripter",
"description": "[LazyScripter](https://attack.mitre.org/groups/G0140) is threat group that has mainly targeted the airlines industry since at least 2018, primarily using open-source toolsets.(Citation: MalwareBytes LazyScripter Feb 2021)",
"aliases": [
"LazyScripter"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0140",
"external_id": "G0140"
},
{
"source_name": "LazyScripter",
"description": "(Citation: MalwareBytes LazyScripter Feb 2021)"
},
{
"source_name": "MalwareBytes LazyScripter Feb 2021",
"description": "Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Manikantan Srinivasan, NEC Corporation India",
"Pooja Natarajan, NEC Corporation India",
"Hiroki Nagahama, NEC Corporation"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:12.417000+00:00\", \"old_value\": \"2026-05-12 15:12:00.732000+00:00\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--32bca8ff-d900-4877-aa65-d70baa041b74",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-10-17 00:14:20.652000+00:00",
"modified": "2026-07-31 18:47:48.258000+00:00",
"name": "Leafminer",
"description": "[Leafminer](https://attack.mitre.org/groups/G0077) is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017. (Citation: Symantec Leafminer July 2018)",
"aliases": [
"Leafminer",
"Raspite"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0077",
"external_id": "G0077"
},
{
"source_name": "Raspite",
"description": "(Citation: Dragos Raspite Aug 2018)"
},
{
"source_name": "Leafminer",
"description": "(Citation: Symantec Leafminer July 2018)"
},
{
"source_name": "Dragos Raspite Aug 2018",
"description": "Dragos, Inc. (2018, August 2). RASPITE. Retrieved November 26, 2018.",
"url": "https://www.dragos.com/blog/20180802Raspite.html"
},
{
"source_name": "Symantec Leafminer July 2018",
"description": "Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.",
"url": "https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:48.258000+00:00\", \"old_value\": \"2025-04-16 20:37:33.912000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.4"
},
{
"type": "intrusion-set",
"id": "intrusion-set--7113eaa5-ba79-4fb3-b68a-398ee9cd698e",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-04-18 17:59:24.739000+00:00",
"modified": "2026-07-31 20:48:37.749000+00:00",
"name": "Leviathan",
"description": "[Leviathan](https://attack.mitre.org/groups/G0065) is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.(Citation: CISA AA21-200A APT40 July 2021) Active since at least 2009, [Leviathan](https://attack.mitre.org/groups/G0065) has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.(Citation: CISA AA21-200A APT40 July 2021)(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)(Citation: CISA Leviathan 2024)",
"aliases": [
"Leviathan",
"MUDCARP",
"Kryptonite Panda",
"Gadolinium",
"BRONZE MOHAWK",
"TEMP.Jumper",
"APT40",
"TEMP.Periscope",
"Gingham Typhoon"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0065",
"external_id": "G0065"
},
{
"source_name": "MUDCARP",
"description": "(Citation: CISA AA21-200A APT40 July 2021)(Citation: Accenture MUDCARP March 2019)"
},
{
"source_name": "Kryptonite Panda",
"description": "(Citation: CISA AA21-200A APT40 July 2021)(Citation: Crowdstrike KRYPTONITE PANDA August 2018)"
},
{
"source_name": "Gadolinium",
"description": "(Citation: CISA AA21-200A APT40 July 2021)(Citation: MSTIC GADOLINIUM September 2020)"
},
{
"source_name": "BRONZE MOHAWK",
"description": "(Citation: CISA AA21-200A APT40 July 2021)(Citation: SecureWorks BRONZE MOHAWK n.d.)"
},
{
"source_name": "Gingham Typhoon",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Leviathan",
"description": "(Citation: Proofpoint Leviathan Oct 2017)"
},
{
"source_name": "TEMP.Jumper",
"description": "[Leviathan](https://attack.mitre.org/groups/G0065) was previously reported upon by FireEye as TEMP.Periscope and TEMP.Jumper.(Citation: CISA AA21-200A APT40 July 2021)(Citation: FireEye APT40 March 2019)"
},
{
"source_name": "TEMP.Periscope",
"description": "[Leviathan](https://attack.mitre.org/groups/G0065) was previously reported upon by FireEye as TEMP.Periscope and TEMP.Jumper.(Citation: CISA AA21-200A APT40 July 2021)(Citation: FireEye Periscope March 2018)(Citation: FireEye APT40 March 2019)"
},
{
"source_name": "Accenture MUDCARP March 2019",
"description": "Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.",
"url": "https://www.accenture.com/us-en/blogs/cyber-defense/mudcarps-focus-on-submarine-technologies"
},
{
"source_name": "Crowdstrike KRYPTONITE PANDA August 2018",
"description": "Adam Kozy. (2018, August 30). Two Birds, One Stone Panda. Retrieved August 24, 2021.",
"url": "https://www.crowdstrike.com/blog/two-birds-one-stone-panda/"
},
{
"source_name": "Proofpoint Leviathan Oct 2017",
"description": "Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.",
"url": "https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"
},
{
"source_name": "MSTIC GADOLINIUM September 2020",
"description": "Ben Koehl, Joe Hannon. (2020, September 24). Microsoft Security - Detecting Empires in the Cloud. Retrieved August 24, 2021.",
"url": "https://www.microsoft.com/security/blog/2020/09/24/gadolinium-detecting-empires-cloud/"
},
{
"source_name": "CISA Leviathan 2024",
"description": "CISA et al. (2024, July 8). People\u2019s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action. Retrieved February 3, 2025.",
"url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a"
},
{
"source_name": "CISA AA21-200A APT40 July 2021",
"description": "CISA. (2021, July 19). (AA21-200A) Joint Cybersecurity Advisory \u2013 Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China\u2019s MSS Hainan State Security Department. Retrieved August 12, 2021.",
"url": "https://us-cert.cisa.gov/ncas/alerts/aa21-200a"
},
{
"source_name": "APT40",
"description": "FireEye reporting on TEMP.Periscope (which was combined into APT40) indicated TEMP.Periscope was reported upon as Leviathan.(Citation: CISA AA21-200A APT40 July 2021)(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)(Citation: FireEye APT40 March 2019)"
},
{
"source_name": "FireEye Periscope March 2018",
"description": "FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.",
"url": "https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "FireEye APT40 March 2019",
"description": "Plan, F., et al. (2019, March 4). APT40: Examining a China-Nexus Espionage Actor. Retrieved March 18, 2019.",
"url": "https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html"
},
{
"source_name": "SecureWorks BRONZE MOHAWK n.d.",
"description": "SecureWorks. (n.d.). Threat Profile - BRONZE MOHAWK. Retrieved August 24, 2021.",
"url": "https://www.secureworks.com/research/threat-profiles/bronze-mohawk"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Valerii Marchuk, Cybersecurity Help s.r.o."
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "4.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:37.749000+00:00\", \"old_value\": \"2025-02-03 21:55:54.314000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "4.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--88b7dbc2-32d3-4e31-af2f-3fc24e1582d7",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:01.092000+00:00",
"modified": "2026-07-31 18:48:06.109000+00:00",
"name": "Lotus Blossom",
"description": "[Lotus Blossom](https://attack.mitre.org/groups/G0030) is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, [Lotus Blossom](https://attack.mitre.org/groups/G0030) has also targeted entities such as digital certificate issuers.(Citation: Lotus Blossom Jun 2015)(Citation: Symantec Bilbug 2022)(Citation: Cisco LotusBlossom 2025)",
"aliases": [
"Lotus Blossom",
"DRAGONFISH",
"Spring Dragon",
"RADIUM",
"Raspberry Typhoon",
"Bilbug",
"Thrip"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0030",
"external_id": "G0030"
},
{
"source_name": "DRAGONFISH",
"description": "(Citation: Accenture Dragonfish Jan 2018)"
},
{
"source_name": "Thrip",
"description": "(Citation: Cisco LotusBlossom 2025)"
},
{
"source_name": "Lotus Blossom",
"description": "(Citation: Lotus Blossom Jun 2015)(Citation: Accenture Dragonfish Jan 2018)"
},
{
"source_name": "RADIUM",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Raspberry Typhoon",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Spring Dragon",
"description": "(Citation: Spring Dragon Jun 2015)(Citation: Accenture Dragonfish Jan 2018)"
},
{
"source_name": "Bilbug",
"description": "(Citation: Symantec Bilbug 2022)"
},
{
"source_name": "Accenture Dragonfish Jan 2018",
"description": "Accenture Security. (2018, January 27). DRAGONFISH DELIVERS NEW FORM OF ELISE MALWARE TARGETING ASEAN DEFENCE MINISTERS\u2019 MEETING AND ASSOCIATES. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20190508165226/https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf"
},
{
"source_name": "Spring Dragon Jun 2015",
"description": "Baumgartner, K.. (2015, June 17). The Spring Dragon APT. Retrieved February 15, 2016.",
"url": "https://securelist.com/the-spring-dragon-apt/70726/"
},
{
"source_name": "Lotus Blossom Jun 2015",
"description": "Falcone, R., et al.. (2015, June 16). Operation Lotus Blossom. Retrieved February 15, 2016.",
"url": "https://www.paloaltonetworks.com/resources/research/unit42-operation-lotus-blossom.html"
},
{
"source_name": "Cisco LotusBlossom 2025",
"description": "Joey Chen, Cisco Talos. (2025, February 27). Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools. Retrieved March 15, 2025.",
"url": "https://blog.talosintelligence.com/lotus-blossom-espionage-group/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Symantec Bilbug 2022",
"description": "Symntec Threat Hunter Team. (2022, November 12). Billbug: State-sponsored Actor Targets Cert Authority, Government Agencies in Multiple Asian Countries. Retrieved March 15, 2025.",
"url": "https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Prinesha Dobariya"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "4.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:06.109000+00:00\", \"old_value\": \"2025-04-23 21:20:58.367000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "4.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--b7f627e2-0817-4cd5-8d50-e75f8aa85cc6",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-02-23 15:31:38.829000+00:00",
"modified": "2026-07-31 18:48:13.778000+00:00",
"name": "LuminousMoth",
"description": "[LuminousMoth](https://attack.mitre.org/groups/G1014) is a Chinese-speaking cyber espionage group that has been active since at least October 2020. [LuminousMoth](https://attack.mitre.org/groups/G1014) has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, Thailand, and other parts of Southeast Asia. Some security researchers have concluded there is a connection between [LuminousMoth](https://attack.mitre.org/groups/G1014) and [Mustang Panda](https://attack.mitre.org/groups/G0129) based on similar targeting and TTPs, as well as network infrastructure overlaps.(Citation: Kaspersky LuminousMoth July 2021)(Citation: Bitdefender LuminousMoth July 2021)",
"aliases": [
"LuminousMoth"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1014",
"external_id": "G1014"
},
{
"source_name": "Bitdefender LuminousMoth July 2021",
"description": "Botezatu, B and etl. (2021, July 21). LuminousMoth - PlugX, File Exfiltration and Persistence Revisited. Retrieved October 20, 2022.",
"url": "https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"
},
{
"source_name": "Kaspersky LuminousMoth July 2021",
"description": "Lechtik, M, and etl. (2021, July 14). LuminousMoth APT: Sweeping attacks for the chosen few. Retrieved October 20, 2022.",
"url": "https://securelist.com/apt-luminousmoth/103332/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Kyaw Pyiyt Htet, @KyawPyiytHtet",
"Zaw Min Htun, @Z3TAE"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:13.778000+00:00\", \"old_value\": \"2025-04-16 20:37:32.806000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--38863958-a201-4ce1-9dbe-539b0b6804e0",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-09-13 12:37:10.394000+00:00",
"modified": "2026-07-31 18:47:49.445000+00:00",
"name": "Machete",
"description": "[Machete](https://attack.mitre.org/groups/G0095) is a suspected Spanish-speaking cyber espionage group that has been active since at least 2010. It has primarily focused its operations within Latin America, with a particular emphasis on Venezuela, but also in the US, Europe, Russia, and parts of Asia. [Machete](https://attack.mitre.org/groups/G0095) generally targets high-profile organizations such as government institutions, intelligence services, and military units, as well as telecommunications and power companies.(Citation: Cylance Machete Mar 2017)(Citation: Securelist Machete Aug 2014)(Citation: ESET Machete July 2019)(Citation: 360 Machete Sep 2020)",
"aliases": [
"Machete",
"APT-C-43",
"El Machete"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0095",
"external_id": "G0095"
},
{
"source_name": "Machete",
"description": "(Citation: Securelist Machete Aug 2014)(Citation: ESET Machete July 2019)("
},
{
"source_name": "APT-C-43",
"description": "(Citation: 360 Machete Sep 2020)"
},
{
"source_name": "El Machete",
"description": "(Citation: Cylance Machete Mar 2017)"
},
{
"source_name": "Cylance Machete Mar 2017",
"description": "The Cylance Threat Research Team. (2017, March 22). El Machete's Malware Attacks Cut Through LATAM. Retrieved September 13, 2019.",
"url": "https://threatvector.cylance.com/en_us/home/el-machete-malware-attacks-cut-through-latam.html"
},
{
"source_name": "Securelist Machete Aug 2014",
"description": "Kaspersky Global Research and Analysis Team. (2014, August 20). El Machete. Retrieved September 13, 2019.",
"url": "https://securelist.com/el-machete/66108/"
},
{
"source_name": "ESET Machete July 2019",
"description": "ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.",
"url": "https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"
},
{
"source_name": "360 Machete Sep 2020",
"description": "kate. (2020, September 25). APT-C-43 steals Venezuelan military secrets to provide intelligence support for the reactionaries \u2014 HpReact campaign. Retrieved November 20, 2020.",
"url": "https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Matias Nicolas Porolli, ESET"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:49.445000+00:00\", \"old_value\": \"2025-04-25 14:49:22.323000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--f9d6633a-55e6-4adc-9263-6ae080421a13",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-01-16 16:13:52.465000+00:00",
"modified": "2026-07-31 18:48:27.286000+00:00",
"name": "Magic Hound",
"description": "[Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.(Citation: FireEye APT35 2018)(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Certfa Charming Kitten January 2021)(Citation: Secureworks COBALT ILLUSION Threat Profile)(Citation: Proofpoint TA453 July2021)",
"aliases": [
"Magic Hound",
"TA453",
"COBALT ILLUSION",
"Charming Kitten",
"ITG18",
"Phosphorus",
"Newscaster",
"APT35",
"Mint Sandstorm"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0059",
"external_id": "G0059"
},
{
"source_name": "Charming Kitten",
"description": "(Citation: ClearSky Charming Kitten Dec 2017)(Citation: Eweek Newscaster and Charming Kitten May 2014)(Citation: ClearSky Kittens Back 2 Oct 2019)(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Proofpoint TA453 March 2021)(Citation: Check Point APT35 CharmPower January 2022)"
},
{
"source_name": "APT35",
"description": "(Citation: FireEye APT35 2018)(Citation: Certfa Charming Kitten January 2021)(Citation: Check Point APT35 CharmPower January 2022)"
},
{
"source_name": "ITG18",
"description": "(Citation: IBM ITG18 2020)"
},
{
"source_name": "Phosphorus",
"description": "(Citation: Microsoft Phosphorus Mar 2019)(Citation: Microsoft Phosphorus Oct 2020)(Citation: US District Court of DC Phosphorus Complaint 2019)(Citation: Certfa Charming Kitten January 2021)(Citation: Proofpoint TA453 March 2021)(Citation: Check Point APT35 CharmPower January 2022)"
},
{
"source_name": "Mint Sandstorm",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "TA453",
"description": "(Citation: Proofpoint TA453 March 2021)(Citation: Proofpoint TA453 July2021)(Citation: Check Point APT35 CharmPower January 2022)"
},
{
"source_name": "COBALT ILLUSION",
"description": "(Citation: Secureworks COBALT ILLUSION Threat Profile)"
},
{
"source_name": "Magic Hound",
"description": "(Citation: Unit 42 Magic Hound Feb 2017)"
},
{
"source_name": "Microsoft Phosphorus Mar 2019",
"description": "Burt, T. (2019, March 27). New steps to protect customers from hacking. Retrieved May 27, 2020.",
"url": "https://blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customers-from-hacking/"
},
{
"source_name": "Microsoft Phosphorus Oct 2020",
"description": "Burt, T. (2020, October 28). Cyberattacks target international conference attendees. Retrieved March 8, 2021.",
"url": "https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/"
},
{
"source_name": "Certfa Charming Kitten January 2021",
"description": "Certfa Labs. (2021, January 8). Charming Kitten\u2019s Christmas Gift. Retrieved May 3, 2021.",
"url": "https://blog.certfa.com/posts/charming-kitten-christmas-gift/"
},
{
"source_name": "Check Point APT35 CharmPower January 2022",
"description": "Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022.",
"url": "https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"
},
{
"source_name": "ClearSky Charming Kitten Dec 2017",
"description": "ClearSky Cyber Security. (2017, December). Charming Kitten. Retrieved December 27, 2017.",
"url": "http://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf"
},
{
"source_name": "ClearSky Kittens Back 2 Oct 2019",
"description": "ClearSky Research Team. (2019, October 1). The Kittens Are Back in Town2 - Charming Kitten Campaign KeepsGoing on, Using New Impersonation Methods. Retrieved April 21, 2021.",
"url": "https://www.clearskysec.com/wp-content/uploads/2019/10/The-Kittens-Are-Back-in-Town-2-1.pdf"
},
{
"source_name": "ClearSky Kittens Back 3 August 2020",
"description": "ClearSky Research Team. (2020, August 1). The Kittens Are Back in Town 3 - Charming Kitten Campaign Evolved and Deploying Spear-Phishing link by WhatsApp. Retrieved April 21, 2021.",
"url": "https://www.clearskysec.com/wp-content/uploads/2020/08/The-Kittens-are-Back-in-Town-3.pdf"
},
{
"source_name": "Eweek Newscaster and Charming Kitten May 2014",
"description": "Kerner, S. (2014, May 29). Newscaster Threat Uses Social Media for Intelligence Gathering. Retrieved April 14, 2021.",
"url": "https://www.eweek.com/security/newscaster-threat-uses-social-media-for-intelligence-gathering"
},
{
"source_name": "Unit 42 Magic Hound Feb 2017",
"description": "Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017.",
"url": "https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"
},
{
"source_name": "Newscaster",
"description": "Link analysis of infrastructure and tools revealed a potential relationship between Magic Hound and the older attack campaign called Newscaster (aka Newscasters).(Citation: Unit 42 Magic Hound Feb 2017)(Citation: FireEye APT35 2018)"
},
{
"source_name": "FireEye APT35 2018",
"description": "Mandiant. (2018). Mandiant M-Trends 2018. Retrieved November 17, 2024.",
"url": "https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Proofpoint TA453 July2021",
"description": "Miller, J. et al. (2021, July 13). Operation SpoofedScholars: A Conversation with TA453. Retrieved August 18, 2021.",
"url": "https://www.proofpoint.com/us/blog/threat-insight/operation-spoofedscholars-conversation-ta453"
},
{
"source_name": "Proofpoint TA453 March 2021",
"description": "Miller, J. et al. (2021, March 30). BadBlood: TA453 Targets US and Israeli Medical Research Personnel in Credential Phishing Campaigns. Retrieved May 4, 2021.",
"url": "https://www.proofpoint.com/us/blog/threat-insight/badblood-ta453-targets-us-and-israeli-medical-research-personnel-credential"
},
{
"source_name": "Secureworks COBALT ILLUSION Threat Profile",
"description": "Secureworks. (n.d.). COBALT ILLUSION Threat Profile. Retrieved April 14, 2021.",
"url": "https://www.secureworks.com/research/threat-profiles/cobalt-illusion"
},
{
"source_name": "US District Court of DC Phosphorus Complaint 2019",
"description": "US District Court of DC. (2019, March 14). MICROSOFT CORPORATION v. JOHN DOES 1-2, CONTROLLING A COMPUTER NETWORK AND THEREBY INJURING PLAINTIFF AND ITS CUSTOMERS. Retrieved March 8, 2021.",
"url": "https://noticeofpleadings.com/phosphorus/files/Complaint.pdf"
},
{
"source_name": "IBM ITG18 2020",
"description": "Wikoff, A. Emerson, R. (2020, July 16). New Research Exposes Iranian Threat Group Operations. Retrieved March 8, 2021.",
"url": "https://securityintelligence.com/posts/new-research-exposes-iranian-threat-group-operations/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Anastasios Pingios",
"Bryan Lee",
"Daniyal Naeem, BT Security"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "6.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:27.286000+00:00\", \"old_value\": \"2026-05-12 15:12:00.732000+00:00\"}}}",
"previous_version": "6.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--bf668120-e9a6-4017-a014-bfc0f5232656",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-13 20:23:54.698000+00:00",
"modified": "2026-07-31 18:48:14.986000+00:00",
"name": "Malteiro",
"description": "[Malteiro](https://attack.mitre.org/groups/G1026) is a financially motivated criminal group that is likely based in Brazil and has been active since at least November 2019. The group operates and distributes the [Mispadu](https://attack.mitre.org/software/S1122) banking trojan via a Malware-as-a-Service (MaaS) business model. [Malteiro](https://attack.mitre.org/groups/G1026) mainly targets victims throughout Latin America (particularly Mexico) and Europe (particularly Spain and Portugal).(Citation: SCILabs Malteiro 2021)",
"aliases": [
"Malteiro"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1026",
"external_id": "G1026"
},
{
"source_name": "SCILabs Malteiro 2021",
"description": "SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.",
"url": "https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Daniel Fernando Soriano Espinosa",
"SCILabs"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:14.986000+00:00\", \"old_value\": \"2024-03-29 14:10:35.711000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--918da025-04bd-48af-b6c4-f3e4d1b915eb",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-10-15 18:54:55+00:00",
"modified": "2026-07-31 18:48:09.341000+00:00",
"name": "Medusa Group",
"description": "[Medusa Group](https://attack.mitre.org/groups/G1051) has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a Ransomware-as-a-Service (RaaS) operation. Some reporting indicates that certain attacks may still be conducted directly by the ransomware\u2019s core developers. Public sources have also referred to the group as \u201cSpearwing\u201d or \u201cMedusa Actors.\u201d (Citation: CISA Medusa Group Medusa Ransomware March 2025) (Citation: Broadcom Medusa Ransomware Medusa Group March 2025) [Medusa Group](https://attack.mitre.org/groups/G1051) employs living-off-the-land techniques, frequently leveraging publicly available tools and common remote management software to conduct operations. The group engages in double extortion tactics, exfiltrating data prior to encryption and threatening to publish stolen information if ransom demands are not met. (Citation: Security Scorecard Medusa Ransomware January 2024) For initial access, [Medusa Group](https://attack.mitre.org/groups/G1051) has exploited publicly known vulnerabilities, conducted phishing campaigns, and used credentials or access purchased from Initial Access Brokers (IABs). The group is opportunistic and has targeted a wide range of sectors globally. (Citation: Intel471 Medusa Ransomware May 2025)",
"aliases": [
"Medusa Group"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1051",
"external_id": "G1051"
},
{
"source_name": "CISA Medusa Group Medusa Ransomware March 2025",
"description": "Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.",
"url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"
},
{
"source_name": "Intel471 Medusa Ransomware May 2025",
"description": "Intel471. (2025, May 14). Threat hunting case study: Medusa ransomware. Retrieved October 15, 2025.",
"url": "https://www.intel471.com/blog/threat-hunting-case-study-medusa-ransomware"
},
{
"source_name": "Broadcom Medusa Ransomware Medusa Group March 2025",
"description": "Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.",
"url": "https://www.security.com/threat-intelligence/medusa-ransomware-attacks"
},
{
"source_name": "Security Scorecard Medusa Ransomware January 2024",
"description": "Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.",
"url": "https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:09.341000+00:00\", \"old_value\": \"2025-10-24 04:01:48.210000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--bfc5ddb3-4dfb-4278-8928-020e1b3feddd",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-01-25 23:57:51.818000+00:00",
"modified": "2026-07-31 18:48:15.057000+00:00",
"name": "Metador",
"description": "[Metador](https://attack.mitre.org/groups/G1013) is a suspected cyber espionage group that was first reported in September 2022. [Metador](https://attack.mitre.org/groups/G1013) has targeted a limited number of telecommunication companies, internet service providers, and universities in the Middle East and Africa. Security researchers named the group [Metador](https://attack.mitre.org/groups/G1013) based on the \"I am meta\" string in one of the group's malware samples and the expectation of Spanish-language responses from C2 servers.(Citation: SentinelLabs Metador Sept 2022)",
"aliases": [
"Metador"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1013",
"external_id": "G1013"
},
{
"source_name": "SentinelLabs Metador Sept 2022",
"description": "Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.",
"url": "https://assets.sentinelone.com/sentinellabs22/metador#page=1"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Massimiliano Romano, BT Security",
"Sittikorn Sangrattanapitak"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:15.057000+00:00\", \"old_value\": \"2024-04-11 00:46:59.526000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--8cf6e33b-b6ef-4a1f-a77c-0ecdde93161f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-17 12:01:07.688000+00:00",
"modified": "2026-07-31 18:48:07.598000+00:00",
"name": "MirrorFace",
"description": "[MirrorFace](https://attack.mitre.org/groups/G1054) is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the [menuPass](https://attack.mitre.org/groups/G0045) umbrella based on targeting, tools, and infrastructure overlaps. [MirrorFace](https://attack.mitre.org/groups/G1054) has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent [MirrorFace](https://attack.mitre.org/groups/G1054) operations included targets in Central Europe and featured use of [LODEINFO](https://attack.mitre.org/software/S9020), [HiddenFace](https://attack.mitre.org/software/S9023), and [UPPERCUT](https://attack.mitre.org/software/S0275) malware.(Citation: Kaspersky LODEINFO OCT 2022)(Citation: Kaspersky LODEINFO Part II OCT 2022)(Citation: ESET MirrorFace DEC 2022)(Citation: JPCERT MirrorFace JUL 2024)(Citation: Trend Micro Earth Kasha NOV 2024)(Citation: Trend Micro Earth Kasha Updates APR 2025)",
"aliases": [
"MirrorFace",
"Earth Kasha"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1054",
"external_id": "G1054"
},
{
"source_name": "Earth Kasha",
"description": "(Citation: Trend Micro Earth Kasha NOV 2024)(Citation: Trend Micro Earth Kasha Updates APR 2025)"
},
{
"source_name": "ESET MirrorFace DEC 2022",
"description": "Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.",
"url": "https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"
},
{
"source_name": "Trend Micro Earth Kasha Updates APR 2025",
"description": "Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.",
"url": "https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html"
},
{
"source_name": "Kaspersky LODEINFO OCT 2022",
"description": "Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part I. Retrieved April 17, 2026.",
"url": "https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/"
},
{
"source_name": "Kaspersky LODEINFO Part II OCT 2022",
"description": "Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part II. Retrieved April 17, 2026.",
"url": "https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-ii/107745/"
},
{
"source_name": "JPCERT MirrorFace JUL 2024",
"description": "Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.",
"url": "https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"
},
{
"source_name": "Trend Micro Earth Kasha NOV 2024",
"description": "Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.",
"url": "https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Dominik Breitenbacher, ESET"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:07.598000+00:00\", \"old_value\": \"2026-04-24 02:22:57.318000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--2e5d3a83-fe00-41a5-9b60-237efc84832f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:46.025000+00:00",
"modified": "2026-07-31 18:47:46.635000+00:00",
"name": "Moafee",
"description": "[Moafee](https://attack.mitre.org/groups/G0002) is a threat group that appears to operate from the Guandong Province of China. Due to overlapping TTPs, including similar custom tools, Moafee is thought to have a direct or indirect relationship with the threat group [DragonOK](https://attack.mitre.org/groups/G0017). (Citation: Haq 2014)",
"aliases": [
"Moafee"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0002",
"external_id": "G0002"
},
{
"source_name": "Moafee",
"description": "(Citation: Haq 2014)"
},
{
"source_name": "Haq 2014",
"description": "Haq, T., Moran, N., Scott, M., & Vashisht, S. O. (2014, September 10). The Path to Mass-Producing Cyber Attacks [Blog]. Retrieved November 12, 2014.",
"url": "https://www.fireeye.com/blog/threat-research/2014/09/the-path-to-mass-producing-cyber-attacks.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:46.635000+00:00\", \"old_value\": \"2025-04-25 14:49:46.105000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--88489675-d216-4884-a98f-49a89fcc1643",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-05-12 21:23:59.021000+00:00",
"modified": "2026-07-31 18:48:06.005000+00:00",
"name": "Mofang",
"description": "[Mofang](https://attack.mitre.org/groups/G0103) is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure. This adversary has been observed since at least May 2012 conducting focused attacks against government and critical infrastructure in Myanmar, as well as several other countries and sectors including military, automobile, and weapons industries.(Citation: FOX-IT May 2016 Mofang)",
"aliases": [
"Mofang"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0103",
"external_id": "G0103"
},
{
"source_name": "FOX-IT May 2016 Mofang",
"description": "Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.",
"url": "https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:06.005000+00:00\", \"old_value\": \"2024-04-11 00:41:37.453000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--df71bb3b-813c-45eb-a8bc-f2a419837411",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:55.093000+00:00",
"modified": "2026-07-31 18:48:22.843000+00:00",
"name": "Molerats",
"description": "[Molerats](https://attack.mitre.org/groups/G0021) is an Arabic-speaking, politically-motivated threat group that has been operating since 2012. The group's victims have primarily been in the Middle East, Europe, and the United States.(Citation: DustySky)(Citation: DustySky2)(Citation: Kaspersky MoleRATs April 2019)(Citation: Cybereason Molerats Dec 2020)",
"aliases": [
"Molerats",
"Operation Molerats",
"Gaza Cybergang"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0021",
"external_id": "G0021"
},
{
"source_name": "Molerats",
"description": "(Citation: DustySky)"
},
{
"source_name": "Gaza Cybergang",
"description": "(Citation: DustySky)(Citation: Kaspersky MoleRATs April 2019)(Citation: Cybereason Molerats Dec 2020)"
},
{
"source_name": "Operation Molerats",
"description": "(Citation: FireEye Operation Molerats)(Citation: Cybereason Molerats Dec 2020)"
},
{
"source_name": "DustySky2",
"description": "ClearSky Cybersecurity. (2016, June 9). Operation DustySky - Part 2. Retrieved August 3, 2016.",
"url": "http://www.clearskysec.com/wp-content/uploads/2016/06/Operation-DustySky2_-6.2016_TLP_White.pdf"
},
{
"source_name": "DustySky",
"description": "ClearSky. (2016, January 7). Operation DustySky. Retrieved January 8, 2016.",
"url": "https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"
},
{
"source_name": "Cybereason Molerats Dec 2020",
"description": "Cybereason Nocturnus Team. (2020, December 9). MOLERATS IN THE CLOUD: New Malware Arsenal Abuses Cloud Platforms in Middle East Espionage Campaign. Retrieved December 22, 2020.",
"url": "https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf"
},
{
"source_name": "Kaspersky MoleRATs April 2019",
"description": "GReAT. (2019, April 10). Gaza Cybergang Group1, operation SneakyPastes. Retrieved May 13, 2020.",
"url": "https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"
},
{
"source_name": "FireEye Operation Molerats",
"description": "Villeneuve, N., Haq, H., Moran, N. (2013, August 23). OPERATION MOLERATS: MIDDLE EAST CYBER ATTACKS USING POISON IVY. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20201031075438/https://www.fireeye.com/blog/threat-research/2013/08/operation-molerats-middle-east-cyber-attacks-using-poison-ivy.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:22.843000+00:00\", \"old_value\": \"2024-11-17 15:50:27.600000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--e6db1e55-b199-4b6b-8633-989345ee45e0",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-08-26 17:39:06.020000+00:00",
"modified": "2026-07-31 18:48:24.240000+00:00",
"name": "Moonstone Sleet",
"description": "[Moonstone Sleet](https://attack.mitre.org/groups/G1036) is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, [Lazarus Group](https://attack.mitre.org/groups/G0032), but has differentiated its tradecraft since 2023. [Moonstone Sleet](https://attack.mitre.org/groups/G1036) is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game.(Citation: Microsoft Moonstone Sleet 2024)",
"aliases": [
"Moonstone Sleet",
"Storm-1789"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1036",
"external_id": "G1036"
},
{
"source_name": "Storm-1789",
"description": "(Citation: Microsoft Moonstone Sleet 2024)"
},
{
"source_name": "Microsoft Moonstone Sleet 2024",
"description": "Microsoft Threat Intelligence. (2024, May 28). Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks. Retrieved August 26, 2024.",
"url": "https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Aung Kyaw Min Naing, @Nolan"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:24.240000+00:00\", \"old_value\": \"2024-10-01 11:51:31.065000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--4c4a7846-45d5-4761-8eea-725fa989914c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-08-11 22:47:27.686000+00:00",
"modified": "2026-07-31 18:47:55.061000+00:00",
"name": "Moses Staff",
"description": "[Moses Staff](https://attack.mitre.org/groups/G1009) is a suspected Iranian threat group that has primarily targeted Israeli companies since at least September 2021. [Moses Staff](https://attack.mitre.org/groups/G1009) openly stated their motivation in attacking Israeli companies is to cause damage by leaking stolen sensitive data and encrypting the victim's networks without a ransom demand.(Citation: Checkpoint MosesStaff Nov 2021) \n\nSecurity researchers assess [Moses Staff](https://attack.mitre.org/groups/G1009) is politically motivated, and has targeted government, finance, travel, energy, manufacturing, and utility companies outside of Israel as well, including those in Italy, India, Germany, Chile, Turkey, the UAE, and the US.(Citation: Cybereason StrifeWater Feb 2022)",
"aliases": [
"Moses Staff",
"DEV-0500",
"Marigold Sandstorm"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1009",
"external_id": "G1009"
},
{
"source_name": "DEV-0500",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Marigold Sandstorm",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Checkpoint MosesStaff Nov 2021",
"description": "Checkpoint Research. (2021, November 15). Uncovering MosesStaff techniques: Ideology over Money. Retrieved August 11, 2022.",
"url": "https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"
},
{
"source_name": "Cybereason StrifeWater Feb 2022",
"description": "Cybereason Nocturnus. (2022, February 1). StrifeWater RAT: Iranian APT Moses Staff Adds New Trojan to Ransomware Operations. Retrieved August 15, 2022.",
"url": "https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Hiroki Nagahama, NEC Corporation",
"Pooja Natarajan, NEC Corporation India",
"Manikantan Srinivasan, NEC Corporation India"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:55.061000+00:00\", \"old_value\": \"2026-05-12 15:12:00.732000+00:00\"}}}",
"previous_version": "2.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--7251b44b-6072-476c-b8d9-a6e32c355b28",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-09-25 18:11:05.672000+00:00",
"modified": "2026-07-31 20:48:38.550000+00:00",
"name": "MoustachedBouncer",
"description": "[MoustachedBouncer](https://attack.mitre.org/groups/G1019) is a cyberespionage group that has been active since at least 2014 targeting foreign embassies in Belarus.(Citation: MoustachedBouncer ESET August 2023)",
"aliases": [
"MoustachedBouncer"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1019",
"external_id": "G1019"
},
{
"source_name": "MoustachedBouncer ESET August 2023",
"description": "Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.",
"url": "https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:38.550000+00:00\", \"old_value\": \"2025-04-16 20:37:40.255000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--269e8108-68c6-4f99-b911-14b2e765dec2",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-04-18 17:59:24.739000+00:00",
"modified": "2026-07-31 20:48:29.347000+00:00",
"name": "MuddyWater",
"description": "[MuddyWater](https://attack.mitre.org/groups/G0069) is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).(Citation: CYBERCOM Iranian Intel Cyber January 2022) Since at least 2017, [MuddyWater](https://attack.mitre.org/groups/G0069) has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. [MuddyWater](https://attack.mitre.org/groups/G0069) has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, [MuddyWater](https://attack.mitre.org/groups/G0069) used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. (Citation: FalconFeeds_Iran_Mar2026)(Citation: Huntio_IranInfra_Mar2026)(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: ClearSky MuddyWater June 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: Talos MuddyWater Jan 2022)(Citation: NaumaanProofpoint_GlobalClickFix_April2025)(Citation: ESET_MuddyWater_Dec2025)(Citation: SymantecCarbonBlack_Seedworm_Mar2026) ",
"aliases": [
"MuddyWater",
"Earth Vetala",
"MERCURY",
"Static Kitten",
"Seedworm",
"TEMP.Zagros",
"Mango Sandstorm",
"TA450",
"MuddyKrill"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0069",
"external_id": "G0069"
},
{
"source_name": "Cloudflare 2026 Threat Report New Threat Actors March 2026",
"description": " Cloudflare. (2026, March 3). Introducing the 2026 Cloudflare Threat Report. Retrieved April 18, 2026.",
"url": "https://blog.cloudflare.com/2026-threat-report/"
},
{
"source_name": "MERCURY",
"description": "(Citation: Anomali Static Kitten February 2021)"
},
{
"source_name": "Static Kitten",
"description": "(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021)"
},
{
"source_name": "MuddyKrill",
"description": "(Citation: Cloudflare 2026 Threat Report New Threat Actors March 2026)"
},
{
"source_name": "TEMP.Zagros",
"description": "(Citation: FireEye MuddyWater Mar 2018)(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021)"
},
{
"source_name": "Mango Sandstorm",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "TA450",
"description": "(Citation: Proofpoint TA450 Phishing March 2024)"
},
{
"source_name": "Seedworm",
"description": "(Citation: Symantec MuddyWater Dec 2018)(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021)"
},
{
"source_name": "Earth Vetala",
"description": "(Citation: Trend Micro Muddy Water March 2021)"
},
{
"source_name": "MuddyWater",
"description": "(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)"
},
{
"source_name": "ClearSky MuddyWater Nov 2018",
"description": "ClearSky Cyber Security. (2018, November). MuddyWater Operations in Lebanon and Oman: Using an Israeli compromised domain for a two-stage campaign. Retrieved November 29, 2018.",
"url": "https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"
},
{
"source_name": "ClearSky MuddyWater June 2019",
"description": "ClearSky. (2019, June). Iranian APT group \u2018MuddyWater\u2019 Adds Exploits to Their Arsenal. Retrieved May 14, 2020.",
"url": "https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf"
},
{
"source_name": "CYBERCOM Iranian Intel Cyber January 2022",
"description": "Cyber National Mission Force. (2022, January 12). Iranian intel cyber suite of malware uses open source tools. Retrieved September 30, 2022.",
"url": "https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/"
},
{
"source_name": "ESET_MuddyWater_Dec2025",
"description": "ESET Research. (2025, December 2). MuddyWater: Snakes by the riverbank. Retrieved February 17, 2026.",
"url": "https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"
},
{
"source_name": "FalconFeeds_Iran_Mar2026",
"description": "FalconFeeds.io. (2026, March 5). The Digital Redoubt: Iran\u2019s National Information Network and the Asymmetry of Modern Cyber Conflict. Retrieved March 9, 2026.",
"url": "https://falconfeeds.io/blogs/the-digital-redoubt-irans-national-information-network-cyber-conflict"
},
{
"source_name": "DHS CISA AA22-055A MuddyWater February 2022",
"description": "FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.",
"url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"
},
{
"source_name": "Huntio_IranInfra_Mar2026",
"description": "Hunt.io. (2026, March 4). Iranian APT Infrastructure in Focus: Mapping State-Aligned Clusters During Geopolitical Escalation. Retrieved April 16, 2026.",
"url": "https://hunt.io/blog/iranian-apt-infrastructure-state-aligned-clusters"
},
{
"source_name": "Unit 42 MuddyWater Nov 2017",
"description": "Lancaster, T.. (2017, November 14). Muddying the Water: Targeted Attacks in the Middle East. Retrieved March 15, 2018.",
"url": "https://researchcenter.paloaltonetworks.com/2017/11/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/"
},
{
"source_name": "Talos MuddyWater Jan 2022",
"description": "Malhortra, A and Ventura, V. (2022, January 31). Iranian APT MuddyWater targets Turkish users via malicious PDFs, executables. Retrieved June 22, 2022.",
"url": "https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html"
},
{
"source_name": "Anomali Static Kitten February 2021",
"description": "Mele, G. et al. (2021, February 10). Probable Iranian Cyber Actors, Static Kitten, Conducting Cyberespionage Campaign Targeting UAE and Kuwait Government Agencies. Retrieved March 17, 2021.",
"url": "https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Proofpoint TA450 Phishing March 2024",
"description": "Miller, J. et al. (2024, March 21). Security Brief: TA450 Uses Embedded Links in PDF Attachments in Latest Campaign. Retrieved March 27, 2024.",
"url": "https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign"
},
{
"source_name": "NaumaanProofpoint_GlobalClickFix_April2025",
"description": "Naumaan, S., et al. (2025, April 17). Around the World in 90 Days: State-Sponsored Actors Try ClickFix . Retrieved January 21, 2026.",
"url": "https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"
},
{
"source_name": "Trend Micro Muddy Water March 2021",
"description": "Peretz, A. and Theck, E. (2021, March 5). Earth Vetala \u2013 MuddyWater Continues to Target Organizations in the Middle East. Retrieved March 18, 2021.",
"url": "https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"
},
{
"source_name": "Reaqta MuddyWater November 2017",
"description": "Reaqta. (2017, November 22). A dive into MuddyWater APT targeting Middle-East. Retrieved May 18, 2020.",
"url": "https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/"
},
{
"source_name": "FireEye MuddyWater Mar 2018",
"description": "Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018.",
"url": "https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"
},
{
"source_name": "Symantec MuddyWater Dec 2018",
"description": "Symantec DeepSight Adversary Intelligence Team. (2018, December 10). Seedworm: Group Compromises Government Agencies, Oil & Gas, NGOs, Telecoms, and IT Firms. Retrieved December 14, 2018.",
"url": "https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"
},
{
"source_name": "SymantecCarbonBlack_Seedworm_Mar2026",
"description": "Threat Hunter Team. (2026, March 5). Seedworm: Iranian APT on Networks of U.S. Bank, Airport, Software Company. Retrieved March 5, 2026.",
"url": "https://www.security.com/threat-intelligence/iran-cyber-threat-activity-us"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Daniyal Naeem, BT Security",
"Marco Pedrinazzi, @pedrinazziM",
"Ozer Sarilar, @ozersarilar, STM",
"Dragos Threat Intelligence"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "7.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:29.347000+00:00\", \"old_value\": \"2026-05-12 15:12:00.731000+00:00\"}}}",
"previous_version": "7.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--420ac20b-f2b9-42b8-aa1a-6d4b72895ca4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-04-12 15:56:28.861000+00:00",
"modified": "2026-07-31 18:47:51.001000+00:00",
"name": "Mustang Panda",
"description": "[Mustang Panda](https://attack.mitre.org/groups/G0129) is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. [Mustang Panda](https://attack.mitre.org/groups/G0129) has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. [Mustang Panda](https://attack.mitre.org/groups/G0129) has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. (Citation: BlackBerry MUSTANG PANDA October 2022)(Citation: Eset PlugX Korplug Mustang Panda March 2022)(Citation: Anomali MUSTANG PANDA October 2019)(Citation: Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022)(Citation: Secureworks BRONZE PRESIDENT December 2019)(Citation: DOJ Affidavit Search and Seizure PlugX December 2024)(Citation: EclecticIQ Mustang Panda PlugX)(Citation: ATTACKIQ MUSTANG PANDA TONESHELL March 2023)(Citation: Crowdstrike MUSTANG PANDA June 2018)(Citation: Palo Alto Networks, Unit 42)(Citation: Sophos PlugX September 2022)(Citation: Sophos Mustang Panda PLUGX)(Citation: Zscaler)",
"aliases": [
"Mustang Panda",
"TA416",
"RedDelta",
"BRONZE PRESIDENT",
"STATELY TAURUS",
"FIREANT",
"CAMARO DRAGON",
"EARTH PRETA",
"HIVE0154",
"TWILL TYPHOON",
"TANTALUM",
"LUMINOUS MOTH",
"UNC6384",
"TEMP.Hex",
"Red Lich",
"ClumsyToad"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0129",
"external_id": "G0129"
},
{
"source_name": "Cloudflare 2026 Threat Report New Threat Actors March 2026",
"description": " Cloudflare. (2026, March 3). Introducing the 2026 Cloudflare Threat Report. Retrieved April 18, 2026.",
"url": "https://blog.cloudflare.com/2026-threat-report/"
},
{
"source_name": "EARTH PRETA",
"description": "(Citation: 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload)(Citation: Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024)(Citation: Trend Micro Mustang Panda Earth Preta Toneshell February 2025)(Citation: Trend Micro Mustang Panda Earth Preta TONESHELL June 2023)"
},
{
"source_name": "FIREANT",
"description": "(Citation: Broadcom)"
},
{
"source_name": "ClumsyToad",
"description": "(Citation: Cloudflare 2026 Threat Report New Threat Actors March 2026)"
},
{
"source_name": "Mustang Panda",
"description": "(Citation: Crowdstrike MUSTANG PANDA June 2018)"
},
{
"source_name": "UNC6384",
"description": "(Citation: Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025)"
},
{
"source_name": "TEMP.Hex",
"description": "(Citation: Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025)"
},
{
"source_name": "CAMARO DRAGON",
"description": "(Citation: HorseShell)"
},
{
"source_name": "HIVE0154",
"description": "(Citation: IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025)(Citation: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA)"
},
{
"source_name": "TWILL TYPHOON",
"description": "(Citation: Microsoft Naming Conventions Frequently Updated)"
},
{
"source_name": "TANTALUM",
"description": "(Citation: Microsoft Naming Conventions Frequently Updated)"
},
{
"source_name": "LUMINOUS MOTH",
"description": "(Citation: Microsoft Naming Conventions Frequently Updated)"
},
{
"source_name": "STATELY TAURUS",
"description": "(Citation: Palo Alto Networks, Unit 42)(Citation: Unit42 Bookworm Nov2015)(Citation: Unit42 Chinese VSCode 06 September 2024)(Citation: Broadcom)(Citation: Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023)(Citation: CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024)"
},
{
"source_name": "TA416",
"description": "(Citation: Proofpoint TA416 November 2020)"
},
{
"source_name": "Red Lich",
"description": "(Citation: PWC UK MUSTANG PANDA RED LICH February 2021)"
},
{
"source_name": "RedDelta",
"description": "(Citation: Recorded Future REDDELTA July 2020)(Citation: Proofpoint TA416 Europe March 2022)"
},
{
"source_name": "BRONZE PRESIDENT",
"description": "(Citation: Secureworks BRONZE PRESIDENT December 2019)(Citation: Sophos PlugX September 2022)(Citation: Sophos Mustang Panda PLUGX)"
},
{
"source_name": "Eset PlugX Korplug Mustang Panda March 2022",
"description": "Alexandre Cote Cyr. (2022, March 23). Mustang Panda\u2019s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025.",
"url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
},
{
"source_name": "Anomali MUSTANG PANDA October 2019",
"description": "Anomali Threat Research. (2019, October 7). China-Based APT Mustang Panda Targets Minority Groups, Public and Private Sector Organizations. Retrieved April 12, 2021.",
"url": "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"
},
{
"source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
"description": "Asheer Malhotra, Jungsoo An, Kendall Mc. (2022, May 5). Mustang Panda deploys a new wave of malware targeting Europe. Retrieved August 4, 2025.",
"url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
},
{
"source_name": "Broadcom",
"description": "Broadcom Protection Bulletins. (2025, February 20). Bookworm malware linked to Fireant (aka Stately Tarurus) activity observed in Southeast Asia. Retrieved July 21, 2025.",
"url": "https://www.broadcom.com/support/security-center/protection-bulletin/bookworm-malware-linked-to-fireant-aka-stately-tarurus-activity-observed-in-southeast-asia"
},
{
"source_name": "HorseShell",
"description": "Cohen, Itay. Madej, Radoslaw. Threat Intelligence Team. (2023, May 16). THE DRAGON WHO SOLD HIS CAMARO: ANALYZING CUSTOM ROUTER IMPLANT. Retrieved December 26, 2023.",
"url": "https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/"
},
{
"source_name": "Secureworks BRONZE PRESIDENT December 2019",
"description": "Counter Threat Unit Research Team. (2019, December 29). BRONZE PRESIDENT Targets NGOs. Retrieved April 13, 2021.",
"url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
},
{
"source_name": "CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024",
"description": "CSIRT CTI. (2024, January 23). Stately Taurus Targets Myanmar Amidst Concerns over Military Junta\u2019s Handling of Rebel Attacks. Retrieved August 4, 2025.",
"url": "https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"
},
{
"source_name": "DOJ Affidavit Search and Seizure PlugX December 2024",
"description": "DOJ. (2024, December 20). Mag. No. 24-mj-1387 AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR A NINTH SEARCH AND SEIZURE WARRANT- IN THE MATTER OF THE SEARCH AND SEIZURE OF COMPUTERS IN THE UNITED STATES INFECTED WITH PLUGX MALWARE . Retrieved September 9, 2025.",
"url": "https://www.justice.gov/archives/opa/media/1384136/dl"
},
{
"source_name": "EclecticIQ Mustang Panda PlugX",
"description": "EclecticIQ Threat Research Team. (2023, February 2). Mustang Panda APT Group Uses European Commission-Themed Lure to Deliver PlugX Malware. Retrieved September 9, 2025.",
"url": "https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"
},
{
"source_name": "IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025",
"description": "Golo Muhr, Joshua Chung. (2025, June 23). Hive0154 aka Mustang Panda shifts focus on Tibetan community to deploy Pubload backdoor. Retrieved August 4, 2025.",
"url": "https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"
},
{
"source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA",
"description": "Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.",
"url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"
},
{
"source_name": "Recorded Future REDDELTA July 2020",
"description": "Insikt Group. (2020, July 28). CHINESE STATE-SPONSORED GROUP \u2018REDDELTA\u2019 TARGETS THE VATICAN AND CATHOLIC ORGANIZATIONS. Retrieved April 13, 2021.",
"url": "https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"
},
{
"source_name": "ATTACKIQ MUSTANG PANDA TONESHELL March 2023",
"description": "Ken Towne, Francis Guibernau. (2023, March 23). Emulating the Politically Motivated Chinese APT Mustang Panda. Retrieved September 10, 2025.",
"url": "https://www.attackiq.com/2023/03/23/emulating-the-politically-motivated-chinese-apt-mustang-panda/"
},
{
"source_name": "Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024",
"description": "Lenart Bermejo, Sunny Lu, Ted Lee. (2024, September 9). Earth Preta Evolves its Attacks with New Malware and Strategies. Retrieved August 4, 2025.",
"url": "https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"
},
{
"source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
"description": "Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.",
"url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
},
{
"source_name": "Crowdstrike MUSTANG PANDA June 2018",
"description": "Meyers, A. (2018, June 15). Meet CrowdStrike\u2019s Adversary of the Month for June: MUSTANG PANDA. Retrieved April 12, 2021.",
"url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"
},
{
"source_name": "Microsoft Naming Conventions Frequently Updated",
"description": "Microsoft. (2025, September 8). How Microsoft names threat actors. Retrieved September 10, 2025.",
"url": "https://learn.microsoft.com/en-us/unified-secops-platform/microsoft-threat-actor-naming"
},
{
"source_name": "Trend Micro Mustang Panda Earth Preta Toneshell February 2025",
"description": "Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.",
"url": "https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"
},
{
"source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload",
"description": "Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.",
"url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
},
{
"source_name": "Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025",
"description": "Patrick Whitsell. (2025, August 25). Deception in Depth: PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats. Retrieved September 9, 2025.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"
},
{
"source_name": "Proofpoint TA416 November 2020",
"description": "Proofpoint Threat Research Team. (2020, November 23). TA416 Goes to Ground and Returns with a Golang PlugX Malware Loader. Retrieved April 13, 2021.",
"url": "https://www.proofpoint.com/us/blog/threat-insight/ta416-goes-ground-and-returns-golang-plugx-malware-loader"
},
{
"source_name": "PWC UK MUSTANG PANDA RED LICH February 2021",
"description": "PWC UK. (2021, February 28). Cyber Threats 2020: A Year in Retrospect. Retrieved October 15, 2025.",
"url": "https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf"
},
{
"source_name": "Proofpoint TA416 Europe March 2022",
"description": "Raggi, M. et al. (2022, March 7). The Good, the Bad, and the Web Bug: TA416 Increases Operational Tempo Against European Governments as Conflict in Ukraine Escalates. Retrieved March 16, 2022.",
"url": "https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"
},
{
"source_name": "Unit42 Bookworm Nov2015",
"description": "Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.",
"url": "https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"
},
{
"source_name": "Palo Alto Networks, Unit 42",
"description": "Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.",
"url": "https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"
},
{
"source_name": "Sophos PlugX September 2022",
"description": "Secureworks Counter Threat Unit Research Team. (2022, April 27). BRONZE PRESIDENT Targets Russian Speakers with Updated PlugX. Retrieved September 9, 2025.",
"url": "https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"
},
{
"source_name": "Sophos Mustang Panda PLUGX",
"description": "Secureworks Counter Threat Unit Research Team. (2022, September 8). BRONZE PRESIDENT Targets Government Officials. Retrieved September 9, 2025.",
"url": "https://www.secureworks.com/blog/bronze-president-targets-government-officials"
},
{
"source_name": "Zscaler",
"description": "Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.",
"url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"
},
{
"source_name": "Trend Micro Mustang Panda Earth Preta TONESHELL June 2023",
"description": "Sunny Lu, Vickie Su, Nick Dai. (2023, June 14). Behind the Scenes: Unveiling the Hidden Workings of Earth Preta. Retrieved September 10, 2025.",
"url": "https://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html"
},
{
"source_name": "BlackBerry MUSTANG PANDA October 2022",
"description": "The BlackBerry Research and Intelligence Team. (2022, October 6). Mustang Panda Abuses Legitimate Apps to Target Myanmar Based Victims. Retrieved October 14, 2025.",
"url": "https://blogs.blackberry.com/en/2022/10/mustang-panda-abuses-legitimate-apps-to-target-myanmar-based-victims"
},
{
"source_name": "Unit42 Chinese VSCode 06 September 2024",
"description": "Tom Fakterman. (2024, September 6). Chinese APT Abuses VSCode to Target Government in Asia. Retrieved March 24, 2025.",
"url": "https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Kyaw Pyiyt Htet, @KyawPyiytHtet",
"Jiraput Thamsongkrah",
"ZScaler ThreatLabz"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:51.001000+00:00\", \"old_value\": \"2026-05-12 15:12:00.732000+00:00\"}}}",
"previous_version": "3.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--0d4ac089-ced4-4cc4-a989-174d08e6d030",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-12-06 19:00:11.581000+00:00",
"modified": "2026-07-31 18:47:37.053000+00:00",
"name": "Mustard Tempest",
"description": "[Mustard Tempest](https://attack.mitre.org/groups/G1020) is an initial access broker that has operated the [SocGholish](https://attack.mitre.org/software/S1124) distribution network since at least 2017. [Mustard Tempest](https://attack.mitre.org/groups/G1020) has partnered with [Indrik Spider](https://attack.mitre.org/groups/G0119) to provide access for the download of additional malware including LockBit, [WastedLocker](https://attack.mitre.org/software/S0612), and remote access tools.(Citation: Microsoft Ransomware as a Service)(Citation: Microsoft Threat Actor Naming July 2023)(Citation: Secureworks Gold Prelude Profile)(Citation: SocGholish-update)",
"aliases": [
"Mustard Tempest",
"DEV-0206",
"TA569",
"GOLD PRELUDE",
"UNC1543"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1020",
"external_id": "G1020"
},
{
"source_name": "DEV-0206",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "TA569",
"description": "(Citation: Secureworks Gold Prelude Profile)"
},
{
"source_name": "GOLD PRELUDE",
"description": "(Citation: Secureworks Gold Prelude Profile)"
},
{
"source_name": "UNC1543",
"description": "(Citation: Secureworks Gold Prelude Profile)"
},
{
"source_name": "SocGholish-update",
"description": "Andrew Northern. (2022, November 22). SocGholish, a very real threat from a very fake update. Retrieved February 13, 2024.",
"url": "https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft Ransomware as a Service",
"description": "Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.",
"url": "https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"
},
{
"source_name": "Secureworks Gold Prelude Profile",
"description": "Secureworks. (n.d.). GOLD PRELUDE . Retrieved March 22, 2024.",
"url": "https://www.secureworks.com/research/threat-profiles/gold-prelude"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:37.053000+00:00\", \"old_value\": \"2024-03-25 21:23:15.556000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--025bdaa9-897d-4bad-afa6-013ba5734653",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-01-16 16:13:52.465000+00:00",
"modified": "2026-07-31 18:47:34.711000+00:00",
"name": "NEODYMIUM",
"description": "[NEODYMIUM](https://attack.mitre.org/groups/G0055) is an activity group that conducted a campaign in May 2016 and has heavily targeted Turkish victims. The group has demonstrated similarity to another activity group called [PROMETHIUM](https://attack.mitre.org/groups/G0056) due to overlapping victim and campaign characteristics. (Citation: Microsoft NEODYMIUM Dec 2016) (Citation: Microsoft SIR Vol 21) [NEODYMIUM](https://attack.mitre.org/groups/G0055) is reportedly associated closely with [BlackOasis](https://attack.mitre.org/groups/G0063) operations, but evidence that the group names are aliases has not been identified. (Citation: CyberScoop BlackOasis Oct 2017)",
"aliases": [
"NEODYMIUM"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0055",
"external_id": "G0055"
},
{
"source_name": "NEODYMIUM",
"description": "(Citation: Microsoft NEODYMIUM Dec 2016) (Citation: Microsoft SIR Vol 21)"
},
{
"source_name": "Microsoft NEODYMIUM Dec 2016",
"description": "Microsoft. (2016, December 14). Twin zero-day attacks: PROMETHIUM and NEODYMIUM target individuals in Europe. Retrieved November 27, 2017.",
"url": "https://blogs.technet.microsoft.com/mmpc/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/"
},
{
"source_name": "Microsoft SIR Vol 21",
"description": "Anthe, C. et al. (2016, December 14). Microsoft Security Intelligence Report Volume 21. Retrieved November 27, 2017.",
"url": "http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf"
},
{
"source_name": "CyberScoop BlackOasis Oct 2017",
"description": "Bing, C. (2017, October 16). Middle Eastern hacking group is using FinFisher malware to conduct international espionage. Retrieved February 15, 2018.",
"url": "https://www.cyberscoop.com/middle-eastern-hacking-group-using-finfisher-malware-conduct-international-espionage/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:34.711000+00:00\", \"old_value\": \"2025-04-25 14:49:46.469000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--2a158b0a-7ef8-43cb-9985-bf34d1e12050",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:54.232000+00:00",
"modified": "2026-07-31 18:47:45.049000+00:00",
"name": "Naikon",
"description": "[Naikon](https://attack.mitre.org/groups/G0019) is assessed to be a state-sponsored cyber espionage group attributed to the Chinese People\u2019s Liberation Army\u2019s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau (Military Unit Cover Designator 78020).(Citation: CameraShy) Active since at least 2010, [Naikon](https://attack.mitre.org/groups/G0019) has primarily conducted operations against government, military, and civil organizations in Southeast Asia, as well as against international bodies such as the United Nations Development Programme (UNDP) and the Association of Southeast Asian Nations (ASEAN).(Citation: CameraShy)(Citation: Baumgartner Naikon 2015) \n\nWhile [Naikon](https://attack.mitre.org/groups/G0019) shares some characteristics with [APT30](https://attack.mitre.org/groups/G0013), the two groups do not appear to be exact matches.(Citation: Baumgartner Golovkin Naikon 2015)",
"aliases": [
"Naikon"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0019",
"external_id": "G0019"
},
{
"source_name": "Naikon",
"description": "(Citation: Baumgartner Naikon 2015)(Citation: CameraShy)(Citation: Baumgartner Golovkin Naikon 2015)"
},
{
"source_name": "CameraShy",
"description": "ThreatConnect Inc. and Defense Group Inc. (DGI). (2015, September 23). Project CameraShy: Closing the Aperture on China's Unit 78020. Retrieved December 17, 2015.",
"url": "http://cdn2.hubspot.net/hubfs/454298/Project_CAMERASHY_ThreatConnect_Copyright_2015.pdf"
},
{
"source_name": "Baumgartner Naikon 2015",
"description": "Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.",
"url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"
},
{
"source_name": "Baumgartner Golovkin Naikon 2015",
"description": "Baumgartner, K., Golovkin, M.. (2015, May 14). The Naikon APT. Retrieved January 14, 2015.",
"url": "https://securelist.com/the-naikon-apt/69953/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Kyaw Pyiyt Htet, @KyawPyiytHtet"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:45.049000+00:00\", \"old_value\": \"2025-04-25 14:49:21.044000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--fed4f0a2-4347-4530-b0f5-6dfd49b29172",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-08-24 17:04:27.002000+00:00",
"modified": "2026-07-31 18:48:30.218000+00:00",
"name": "Nomadic Octopus",
"description": "\n[Nomadic Octopus](https://attack.mitre.org/groups/G0133) is a Russian-speaking cyber espionage threat group that has primarily targeted Central Asia, including local governments, diplomatic missions, and individuals, since at least 2014. [Nomadic Octopus](https://attack.mitre.org/groups/G0133) has been observed conducting campaigns involving Android and Windows malware, mainly using the Delphi programming language, and building custom variants.(Citation: Security Affairs DustSquad Oct 2018)(Citation: Securelist Octopus Oct 2018)(Citation: ESET Nomadic Octopus 2018)",
"aliases": [
"Nomadic Octopus",
"DustSquad"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0133",
"external_id": "G0133"
},
{
"source_name": "DustSquad",
"description": "(Citation: Security Affairs DustSquad Oct 2018)(Citation: Securelist Octopus Oct 2018)(Citation: SecurityWeek Nomadic Octopus Oct 2018)"
},
{
"source_name": "Nomadic Octopus",
"description": "(Citation: SecurityWeek Nomadic Octopus Oct 2018)(Citation: ESET Nomadic Octopus 2018)"
},
{
"source_name": "ESET Nomadic Octopus 2018",
"description": "Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.",
"url": "https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf"
},
{
"source_name": "Securelist Octopus Oct 2018",
"description": "Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.",
"url": "https://securelist.com/octopus-infested-seas-of-central-asia/88200/"
},
{
"source_name": "SecurityWeek Nomadic Octopus Oct 2018",
"description": "Kovacs, E. (2018, October 18). Russia-Linked Hackers Target Diplomatic Entities in Central Asia. Retrieved October 13, 2021.",
"url": "https://www.securityweek.com/russia-linked-hackers-target-diplomatic-entities-central-asia"
},
{
"source_name": "Security Affairs DustSquad Oct 2018",
"description": "Paganini, P. (2018, October 16). Russia-linked APT group DustSquad targets diplomatic entities in Central Asia. Retrieved August 24, 2021.",
"url": "https://securityaffairs.co/wordpress/77165/apt/russia-linked-apt-dustsquad.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:30.218000+00:00\", \"old_value\": \"2025-04-16 20:37:36.955000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--4ca1929c-7d64-4aab-b849-badbfc0c760d",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-12-14 16:46:06.044000+00:00",
"modified": "2026-07-31 20:48:34.886000+00:00",
"name": "OilRig",
"description": "[OilRig](https://attack.mitre.org/groups/G0049) is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.(Citation: FireEye APT34 Dec 2017)(Citation: Palo Alto OilRig April 2017)(Citation: ClearSky OilRig Jan 2017)(Citation: Palo Alto OilRig May 2016)(Citation: Palo Alto OilRig Oct 2016)(Citation: Unit42 OilRig Playbook 2023)(Citation: Unit 42 QUADAGENT July 2018)",
"aliases": [
"OilRig",
"COBALT GYPSY",
"IRN2",
"APT34",
"Helix Kitten",
"Evasive Serpens",
"Hazel Sandstorm",
"EUROPIUM",
"ITG13",
"Earth Simnavaz",
"Crambus",
"TA452"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0049",
"external_id": "G0049"
},
{
"source_name": "IRN2",
"description": "(Citation: Crowdstrike Helix Kitten Nov 2018)"
},
{
"source_name": "ITG13",
"description": "(Citation: IBM ZeroCleare Wiper December 2019)"
},
{
"source_name": "Hazel Sandstorm",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "EUROPIUM",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "OilRig",
"description": "(Citation: Palo Alto OilRig April 2017) (Citation: ClearSky OilRig Jan 2017) (Citation: Palo Alto OilRig May 2016) (Citation: Palo Alto OilRig Oct 2016) (Citation: Unit 42 Playbook Dec 2017) (Citation: Unit 42 QUADAGENT July 2018)"
},
{
"source_name": "TA452",
"description": "(Citation: Proofpoint Iranian Aligned Attacks JAN 2020)"
},
{
"source_name": "COBALT GYPSY",
"description": "(Citation: Secureworks COBALT GYPSY Threat Profile)"
},
{
"source_name": "Crambus",
"description": "(Citation: Symantec Crambus OCT 2023)"
},
{
"source_name": "Earth Simnavaz",
"description": "(Citation: Trend Micro Earth Simnavaz October 2024)"
},
{
"source_name": "Helix Kitten",
"description": "(Citation: Unit 42 QUADAGENT July 2018)(Citation: Crowdstrike Helix Kitten Nov 2018)"
},
{
"source_name": "Evasive Serpens",
"description": "(Citation: Unit42 OilRig Playbook 2023)"
},
{
"source_name": "Check Point APT34 April 2021",
"description": "Check Point. (2021, April 8). Iran\u2019s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021.",
"url": "https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"
},
{
"source_name": "ClearSky OilRig Jan 2017",
"description": "ClearSky Cybersecurity. (2017, January 5). Iranian Threat Agent OilRig Delivers Digitally Signed Malware, Impersonates University of Oxford. Retrieved May 3, 2017.",
"url": "http://www.clearskysec.com/oilrig/"
},
{
"source_name": "Trend Micro Earth Simnavaz October 2024",
"description": "Fahmy, M. et al. (2024, October 11). Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against Middle East. Retrieved November 27, 2024.",
"url": "https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"
},
{
"source_name": "Palo Alto OilRig May 2016",
"description": "Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.",
"url": "http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"
},
{
"source_name": "Palo Alto OilRig April 2017",
"description": "Falcone, R.. (2017, April 27). OilRig Actors Provide a Glimpse into Development and Testing Efforts. Retrieved May 3, 2017.",
"url": "http://researchcenter.paloaltonetworks.com/2017/04/unit42-oilrig-actors-provide-glimpse-development-testing-efforts/"
},
{
"source_name": "Palo Alto OilRig Oct 2016",
"description": "Grunzweig, J. and Falcone, R.. (2016, October 4). OilRig Malware Campaign Updates Toolset and Expands Targets. Retrieved May 3, 2017.",
"url": "http://researchcenter.paloaltonetworks.com/2016/10/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/"
},
{
"source_name": "IBM ZeroCleare Wiper December 2019",
"description": "Kessem, L. (2019, December 4). New Destructive Wiper ZeroCleare Targets Energy Sector in the Middle East. Retrieved September 4, 2024.",
"url": "https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/"
},
{
"source_name": "Unit 42 QUADAGENT July 2018",
"description": "Lee, B., Falcone, R. (2018, July 25). OilRig Targets Technology Service Provider and Government Agency with QUADAGENT. Retrieved August 9, 2018.",
"url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"
},
{
"source_name": "Crowdstrike Helix Kitten Nov 2018",
"description": "Meyers, A. (2018, November 27). Meet CrowdStrike\u2019s Adversary of the Month for November: HELIX KITTEN. Retrieved December 18, 2018.",
"url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Proofpoint Iranian Aligned Attacks JAN 2020",
"description": "Proofpoint. (2020, January 10). Iranian State-Sponsored and Aligned Attacks: What You Need to Know and Steps to Protect Yourself. Retrieved January 16, 2025.",
"url": "https://www.proofpoint.com/us/corporate-blog/post/iranian-state-sponsored-and-aligned-attacks-what-you-need-know-and-steps-protect"
},
{
"source_name": "FireEye APT34 Dec 2017",
"description": "Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.",
"url": "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
},
{
"source_name": "Secureworks COBALT GYPSY Threat Profile",
"description": "Secureworks. (n.d.). COBALT GYPSY Threat Profile. Retrieved April 14, 2021.",
"url": "https://www.secureworks.com/research/threat-profiles/cobalt-gypsy"
},
{
"source_name": "Symantec Crambus OCT 2023",
"description": "Symantec Threat Hunter Team. (2023, October 19). Crambus: New Campaign Targets Middle Eastern Government. Retrieved November 27, 2024.",
"url": "https://www.security.com/threat-intelligence/crambus-middle-east-government"
},
{
"source_name": "APT34",
"description": "This group was previously tracked under two distinct groups, APT34 and OilRig, but was combined due to additional reporting giving higher confidence about the overlap of the activity.(Citation: Unit 42 QUADAGENT July 2018)(Citation: FireEye APT34 Dec 2017)(Citation: Check Point APT34 April 2021)"
},
{
"source_name": "Unit 42 Playbook Dec 2017",
"description": "Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.",
"url": "https://pan-unit42.github.io/playbook_viewer/"
},
{
"source_name": "Unit42 OilRig Playbook 2023",
"description": "Unit42. (2016, May 1). Evasive Serpens Unit 42 Playbook Viewer. Retrieved February 6, 2023.",
"url": "https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Robert Falcone",
"Bryan Lee",
"Dragos Threat Intelligence",
"Jaesang Oh, KC7 Foundation"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "5.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:34.886000+00:00\", \"old_value\": \"2026-05-12 15:12:00.732000+00:00\"}}}",
"previous_version": "5.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--5636b7b3-d99b-4edd-aa05-ee649c1d4ef1",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-10-17 00:14:20.652000+00:00",
"modified": "2026-07-31 18:47:56.740000+00:00",
"name": "Orangeworm",
"description": "[Orangeworm](https://attack.mitre.org/groups/G0071) is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage.(Citation: Symantec Orangeworm April 2018) Reverse engineering of [Kwampirs](https://attack.mitre.org/software/S0236), directly associated with [Orangeworm](https://attack.mitre.org/groups/G0071) activity, indicates significant functional and development overlaps with [Shamoon](https://attack.mitre.org/software/S0140).(Citation: Cylera Kwampirs 2022)",
"aliases": [
"Orangeworm"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0071",
"external_id": "G0071"
},
{
"source_name": "Orangeworm",
"description": "(Citation: Symantec Orangeworm April 2018)"
},
{
"source_name": "Cylera Kwampirs 2022",
"description": "Pablo Rinc\u00f3n Crespo. (2022, January). The link between Kwampirs (Orangeworm) and Shamoon APTs. Retrieved February 8, 2024.",
"url": "https://resources.cylera.com/hubfs/Cylera%20Labs/Cylera%20Labs%20Kwampirs%20Shamoon%20Technical%20Report.pdf"
},
{
"source_name": "Symantec Orangeworm April 2018",
"description": "Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.",
"url": "https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Elger Vinicius S. Rodrigues, @elgervinicius, CYBINT Centre"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:56.740000+00:00\", \"old_value\": \"2024-04-10 21:33:28.444000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--f9c06633-dcff-48a1-8588-759e7cec5694",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-04-18 17:59:24.739000+00:00",
"modified": "2026-07-31 18:48:27.175000+00:00",
"name": "PLATINUM",
"description": "[PLATINUM](https://attack.mitre.org/groups/G0068) is an activity group that has targeted victims since at least 2009. The group has focused on targets associated with governments and related organizations in South and Southeast Asia. (Citation: Microsoft PLATINUM April 2016)",
"aliases": [
"PLATINUM"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0068",
"external_id": "G0068"
},
{
"source_name": "PLATINUM",
"description": "(Citation: Microsoft PLATINUM April 2016)"
},
{
"source_name": "Microsoft PLATINUM April 2016",
"description": "Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.",
"url": "https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Ryan Becwar"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:27.175000+00:00\", \"old_value\": \"2025-04-25 14:49:07.040000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.3"
},
{
"type": "intrusion-set",
"id": "intrusion-set--5f3d0238-d058-44a9-8812-3dd1b6741a8c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-07-01 19:07:04.253000+00:00",
"modified": "2026-07-31 18:47:57.978000+00:00",
"name": "POLONIUM",
"description": "[POLONIUM](https://attack.mitre.org/groups/G1005) is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February 2022. Security researchers assess [POLONIUM](https://attack.mitre.org/groups/G1005) has coordinated their operations with multiple actors affiliated with Iran\u2019s Ministry of Intelligence and Security (MOIS), based on victim overlap as well as common techniques and tooling.(Citation: Microsoft POLONIUM June 2022)",
"aliases": [
"POLONIUM",
"Plaid Rain"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1005",
"external_id": "G1005"
},
{
"source_name": "Plaid Rain",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft POLONIUM June 2022",
"description": "Microsoft. (2022, June 2). Exposing POLONIUM activity and infrastructure targeting Israeli organizations. Retrieved July 1, 2022.",
"url": "https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:57.978000+00:00\", \"old_value\": \"2024-01-08 21:56:22.594000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--efed95ba-d7e8-47ff-8c53-99c42426ee7c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-01-16 16:13:52.465000+00:00",
"modified": "2026-07-31 20:48:51.011000+00:00",
"name": "PROMETHIUM",
"description": "[PROMETHIUM](https://attack.mitre.org/groups/G0056) is an activity group focused on espionage that has been active since at least 2012. The group has conducted operations globally with a heavy emphasis on Turkish targets. [PROMETHIUM](https://attack.mitre.org/groups/G0056) has demonstrated similarity to another activity group called [NEODYMIUM](https://attack.mitre.org/groups/G0055) due to overlapping victim and campaign characteristics.(Citation: Microsoft NEODYMIUM Dec 2016)(Citation: Microsoft SIR Vol 21)(Citation: Talos Promethium June 2020)",
"aliases": [
"PROMETHIUM",
"StrongPity"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0056",
"external_id": "G0056"
},
{
"source_name": "PROMETHIUM",
"description": "(Citation: Microsoft NEODYMIUM Dec 2016) (Citation: Microsoft SIR Vol 21)"
},
{
"source_name": "Microsoft SIR Vol 21",
"description": "Anthe, C. et al. (2016, December 14). Microsoft Security Intelligence Report Volume 21. Retrieved November 27, 2017.",
"url": "http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf"
},
{
"source_name": "Talos Promethium June 2020",
"description": "Mercer, W. et al. (2020, June 29). PROMETHIUM extends global reach with StrongPity3 APT. Retrieved July 20, 2020.",
"url": "https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"
},
{
"source_name": "Microsoft NEODYMIUM Dec 2016",
"description": "Microsoft. (2016, December 14). Twin zero-day attacks: PROMETHIUM and NEODYMIUM target individuals in Europe. Retrieved November 27, 2017.",
"url": "https://blogs.technet.microsoft.com/mmpc/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/"
},
{
"source_name": "StrongPity",
"description": "The name StrongPity has also been used to describe the group and the malware used by the group.(Citation: Bitdefender StrongPity June 2020)(Citation: Talos Promethium June 2020)"
},
{
"source_name": "Bitdefender StrongPity June 2020",
"description": "Tudorica, R. et al. (2020, June 30). StrongPity APT - Revealing Trojanized Tools, Working Hours and Infrastructure. Retrieved July 20, 2020.",
"url": "https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:51.011000+00:00\", \"old_value\": \"2024-04-19 19:35:15.637000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}, \"iterable_item_added\": {\"root['x_mitre_domains'][1]\": \"mobile-attack\"}}",
"previous_version": "2.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--17862c7d-9e60-48a0-b48e-da4dc4c3f6b0",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:07.145000+00:00",
"modified": "2026-07-31 20:48:25.895000+00:00",
"name": "Patchwork",
"description": "[Patchwork](https://attack.mitre.org/groups/G0040) is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. [Patchwork](https://attack.mitre.org/groups/G0040) has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. [Patchwork](https://attack.mitre.org/groups/G0040) was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.(Citation: Cymmetria Patchwork) (Citation: Symantec Patchwork)(Citation: TrendMicro Patchwork Dec 2017)(Citation: Volexity Patchwork June 2018)",
"aliases": [
"Patchwork",
"Hangover Group",
"Dropping Elephant",
"Chinastrats",
"MONSOON",
"Operation Hangover"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0040",
"external_id": "G0040"
},
{
"source_name": "Patchwork",
"description": "(Citation: Cymmetria Patchwork) (Citation: Symantec Patchwork) (Citation: Securelist Dropping Elephant) (Citation: PaloAlto Patchwork Mar 2018) (Citation: Volexity Patchwork June 2018)"
},
{
"source_name": "Chinastrats",
"description": "(Citation: Securelist Dropping Elephant)"
},
{
"source_name": "Dropping Elephant",
"description": "(Citation: Symantec Patchwork) (Citation: Securelist Dropping Elephant) (Citation: PaloAlto Patchwork Mar 2018) (Citation: Volexity Patchwork June 2018)"
},
{
"source_name": "Hangover Group",
"description": "[Patchwork](https://attack.mitre.org/groups/G0040) and the Hangover Group have both been referenced as aliases for the threat group associated with Operation Monsoon.(Citation: PaloAlto Patchwork Mar 2018)(Citation: Unit 42 BackConfig May 2020)(Citation: Forcepoint Monsoon)"
},
{
"source_name": "Cymmetria Patchwork",
"description": "Cymmetria. (2016). Unveiling Patchwork - The Copy-Paste APT. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"
},
{
"source_name": "Operation Hangover May 2013",
"description": "Fagerland, S., et al. (2013, May). Operation Hangover: Unveiling an Indian Cyberattack Infrastructure. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20140424084220/http://enterprise-manage.norman.c.bitbit.net/resources/files/Unveiling_an_Indian_Cyberattack_Infrastructure.pdf"
},
{
"source_name": "Symantec Patchwork",
"description": "Hamada, J.. (2016, July 25). Patchwork cyberespionage group expands targets from governments to wide range of industries. Retrieved August 17, 2016.",
"url": "http://www.symantec.com/connect/blogs/patchwork-cyberespionage-group-expands-targets-governments-wide-range-industries"
},
{
"source_name": "Unit 42 BackConfig May 2020",
"description": "Hinchliffe, A. and Falcone, R. (2020, May 11). Updated BackConfig Malware Targeting Government and Military Organizations in South Asia. Retrieved June 17, 2020.",
"url": "https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"
},
{
"source_name": "Operation Hangover",
"description": "It is believed that the actors behind [Patchwork](https://attack.mitre.org/groups/G0040) are the same actors behind Operation Hangover. (Citation: Forcepoint Monsoon) (Citation: Operation Hangover May 2013)"
},
{
"source_name": "Securelist Dropping Elephant",
"description": "Kaspersky Lab's Global Research & Analysis Team. (2016, July 8). The Dropping Elephant \u2013 aggressive cyber-espionage in the Asian region. Retrieved August 3, 2016.",
"url": "https://securelist.com/the-dropping-elephant-actor/75328/"
},
{
"source_name": "PaloAlto Patchwork Mar 2018",
"description": "Levene, B. et al.. (2018, March 7). Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent. Retrieved March 31, 2018.",
"url": "https://researchcenter.paloaltonetworks.com/2018/03/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/"
},
{
"source_name": "TrendMicro Patchwork Dec 2017",
"description": "Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.",
"url": "https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"
},
{
"source_name": "Volexity Patchwork June 2018",
"description": "Meltzer, M, et al. (2018, June 07). Patchwork APT Group Targets US Think Tanks. Retrieved July 16, 2018.",
"url": "https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"
},
{
"source_name": "MONSOON",
"description": "MONSOON is the name of an espionage campaign; we use it here to refer to the actor group behind the campaign. (Citation: Forcepoint Monsoon) (Citation: PaloAlto Patchwork Mar 2018)"
},
{
"source_name": "Forcepoint Monsoon",
"description": "Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.",
"url": "https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.7",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:25.895000+00:00\", \"old_value\": \"2026-05-12 15:12:00.731000+00:00\"}}}",
"previous_version": "1.7"
},
{
"type": "intrusion-set",
"id": "intrusion-set--fe98767f-9df8-42b9-83c9-004b1dec8647",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:50.198000+00:00",
"modified": "2026-07-31 20:48:53.544000+00:00",
"name": "PittyTiger",
"description": "[PittyTiger](https://attack.mitre.org/groups/G0011) is a threat group believed to operate out of China that uses multiple different types of malware to maintain command and control.(Citation: Bizeul 2014)(Citation: Villeneuve 2014)",
"aliases": [
"PittyTiger"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0011",
"external_id": "G0011"
},
{
"source_name": "PittyTiger",
"description": "(Citation: Bizeul 2014) (Citation: Villeneuve 2014)"
},
{
"source_name": "Bizeul 2014",
"description": "Bizeul, D., Fontarensky, I., Mouchoux, R., Perigaud, F., Pernet, C. (2014, July 11). Eye of the Tiger. Retrieved September 29, 2015.",
"url": "https://airbus-cyber-security.com/the-eye-of-the-tiger/"
},
{
"source_name": "Villeneuve 2014",
"description": "Villeneuve, N., Homan, J. (2014, July 31). Spy of the Tiger. Retrieved September 29, 2015.",
"url": "https://www.fireeye.com/blog/threat-research/2014/07/spy-of-the-tiger.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:53.544000+00:00\", \"old_value\": \"2025-04-25 14:49:38.981000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--ecbf507f-6786-4121-a4cc-0fd6a8d3a29d",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-09-24 19:48:18.278000+00:00",
"modified": "2026-07-31 18:48:24.924000+00:00",
"name": "Play",
"description": "[Play](https://attack.mitre.org/groups/G1040) is a ransomware group that has been active since at least 2022 deploying [Playcrypt](https://attack.mitre.org/software/S1162) ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. [Play](https://attack.mitre.org/groups/G1040) actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)",
"aliases": [
"Play"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1040",
"external_id": "G1040"
},
{
"source_name": "CISA Play Ransomware Advisory December 2023",
"description": "CISA. (2023, December 18). #StopRansomware: Play Ransomware AA23-352A. Retrieved September 24, 2024.",
"url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"
},
{
"source_name": "Trend Micro Ransomware Spotlight Play July 2023",
"description": "Trend Micro Research. (2023, July 21). Ransomware Spotlight: Play. Retrieved September 24, 2024.",
"url": "https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Marco Pedrinazzi, @pedrinazziM"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:24.924000+00:00\", \"old_value\": \"2024-10-02 05:37:34.149000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--7ecc3b4f-5cdb-457e-b55a-df376b359446",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:04.179000+00:00",
"modified": "2026-07-31 18:48:04.495000+00:00",
"name": "Poseidon Group",
"description": "[Poseidon Group](https://attack.mitre.org/groups/G0033) is a Portuguese-speaking threat group that has been active since at least 2005. The group has a history of using information exfiltrated from victims to blackmail victim companies into contracting the [Poseidon Group](https://attack.mitre.org/groups/G0033) as a security firm. (Citation: Kaspersky Poseidon Group)",
"aliases": [
"Poseidon Group"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0033",
"external_id": "G0033"
},
{
"source_name": "Poseidon Group",
"description": "(Citation: Kaspersky Poseidon Group)"
},
{
"source_name": "Kaspersky Poseidon Group",
"description": "Kaspersky Lab's Global Research and Analysis Team. (2016, February 9). Poseidon Group: a Targeted Attack Boutique specializing in global cyber-espionage. Retrieved March 16, 2016.",
"url": "https://securelist.com/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/73673/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:04.495000+00:00\", \"old_value\": \"2025-04-25 14:49:33.223000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--5ce5392a-3a6c-4e07-9df3-9b6a9159ac45",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:56.785000+00:00",
"modified": "2026-07-31 18:47:57.762000+00:00",
"name": "Putter Panda",
"description": "[Putter Panda](https://attack.mitre.org/groups/G0024) is a Chinese threat group that has been attributed to Unit 61486 of the 12th Bureau of the PLA\u2019s 3rd General Staff Department (GSD). (Citation: CrowdStrike Putter Panda)",
"aliases": [
"Putter Panda",
"APT2",
"MSUpdater"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0024",
"external_id": "G0024"
},
{
"source_name": "MSUpdater",
"description": "(Citation: CrowdStrike Putter Panda)"
},
{
"source_name": "Putter Panda",
"description": "(Citation: CrowdStrike Putter Panda) (Citation: Cylance Putter Panda)"
},
{
"source_name": "APT2",
"description": "(Citation: Cylance Putter Panda)"
},
{
"source_name": "CrowdStrike Putter Panda",
"description": "Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.",
"url": "http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf"
},
{
"source_name": "Cylance Putter Panda",
"description": "Gross, J. and Walter, J.. (2016, January 12). Puttering into the Future.... Retrieved November 17, 2024.",
"url": "https://blogs.blackberry.com/en/2016/01/puttering-into-the-future"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:57.762000+00:00\", \"old_value\": \"2024-11-17 16:43:16.049000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--c416b28c-103b-4df1-909e-78089a7e0e5f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:10.206000+00:00",
"modified": "2026-07-31 18:48:16.598000+00:00",
"name": "RTM",
"description": "[RTM](https://attack.mitre.org/groups/G0048) is a cybercriminal group that has been active since at least 2015 and is primarily interested in users of remote banking systems in Russia and neighboring countries. The group uses a Trojan by the same name ([RTM](https://attack.mitre.org/software/S0148)). (Citation: ESET RTM Feb 2017)",
"aliases": [
"RTM"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0048",
"external_id": "G0048"
},
{
"source_name": "RTM",
"description": "(Citation: ESET RTM Feb 2017)"
},
{
"source_name": "ESET RTM Feb 2017",
"description": "Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.",
"url": "https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Oleg Skulkin, Group-IB"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:16.598000+00:00\", \"old_value\": \"2025-04-25 14:49:01.288000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--f40eb8ce-2a74-4e56-89a1-227021410142",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-10-17 00:14:20.652000+00:00",
"modified": "2026-07-31 18:48:26.231000+00:00",
"name": "Rancor",
"description": "[Rancor](https://attack.mitre.org/groups/G0075) is a threat group that has led targeted campaigns against the South East Asia region. [Rancor](https://attack.mitre.org/groups/G0075) uses politically-motivated lures to entice victims to open malicious documents. (Citation: Rancor Unit42 June 2018)",
"aliases": [
"Rancor"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0075",
"external_id": "G0075"
},
{
"source_name": "Rancor",
"description": "(Citation: Rancor Unit42 June 2018)"
},
{
"source_name": "Rancor Unit42 June 2018",
"description": "Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July 2, 2018.",
"url": "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:26.231000+00:00\", \"old_value\": \"2024-02-09 19:30:38.407000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.3"
},
{
"type": "intrusion-set",
"id": "intrusion-set--82323c70-4186-4b61-94f5-b227c3b28e89",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-09-23 21:32:19.337000+00:00",
"modified": "2026-07-31 18:48:05.317000+00:00",
"name": "RedCurl",
"description": "[RedCurl](https://attack.mitre.org/groups/G1039) is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks.(Citation: group-ib_redcurl1) [RedCurl](https://attack.mitre.org/groups/G1039) is allegedly a Russian-speaking threat actor.(Citation: group-ib_redcurl1)(Citation: group-ib_redcurl2) The group\u2019s operations typically start with spearphishing emails to gain initial access, then the group executes discovery and collection commands and scripts to find corporate data. The group concludes operations by exfiltrating files to the C2 servers. ",
"aliases": [
"RedCurl"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1039",
"external_id": "G1039"
},
{
"source_name": "group-ib_redcurl1",
"description": "Group-IB. (2020, August). RedCurl: The Pentest You Didn\u2019t Know About. Retrieved August 9, 2024.",
"url": "https://www.group-ib.com/resources/research-hub/red-curl/"
},
{
"source_name": "group-ib_redcurl2",
"description": "Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.",
"url": "https://www.group-ib.com/resources/research-hub/red-curl-2/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Joe Gumke, U.S. Bank"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:05.317000+00:00\", \"old_value\": \"2024-09-23 23:11:00.562000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--2c40f629-6cf9-4f75-af32-9a98caec24ae",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-11-21 22:34:30.327000+00:00",
"modified": "2026-07-31 18:47:46.134000+00:00",
"name": "RedEcho",
"description": "[RedEcho](https://attack.mitre.org/groups/G1042) is a People\u2019s Republic of China-related threat actor associated with long-running intrusions in Indian critical infrastructure entities. [RedEcho](https://attack.mitre.org/groups/G1042) overlaps with various other PRC-linked threat groups, such as [APT41](https://attack.mitre.org/groups/G0096), and is linked to [ShadowPad](https://attack.mitre.org/software/S0596) malware use through shared infrastructure.(Citation: RecordedFuture RedEcho 2021)(Citation: RecordedFuture RedEcho 2022)",
"aliases": [
"RedEcho"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1042",
"external_id": "G1042"
},
{
"source_name": "RecordedFuture RedEcho 2021",
"description": "Recorded Future Insikt Group. (2021, February). China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions. Retrieved November 21, 2024.",
"url": "https://go.recordedfuture.com/hubfs/reports/cta-2021-0228.pdf"
},
{
"source_name": "RecordedFuture RedEcho 2022",
"description": "Recorded Future Insikt Group. (2022, April 6). Continued Targeting of Indian Power Grid Assets by Chinese State-Sponsored Activity Group. Retrieved November 21, 2024.",
"url": "https://go.recordedfuture.com/hubfs/reports/ta-2022-0406.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:46.134000+00:00\", \"old_value\": \"2025-03-13 20:54:46.475000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--44102191-3a31-45f8-acbe-34bdb441d5ad",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-05-26 14:20:20.623000+00:00",
"modified": "2026-07-31 18:47:51.614000+00:00",
"name": "Rocke",
"description": "[Rocke](https://attack.mitre.org/groups/G0106) is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name [Rocke](https://attack.mitre.org/groups/G0106) comes from the email address \"rocke@live.cn\" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between [Rocke](https://attack.mitre.org/groups/G0106) and the Iron Cybercrime Group, though this attribution has not been confirmed.(Citation: Talos Rocke August 2018)",
"aliases": [
"Rocke"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0106",
"external_id": "G0106"
},
{
"source_name": "Talos Rocke August 2018",
"description": "Liebenberg, D.. (2018, August 30). Rocke: The Champion of Monero Miners. Retrieved May 26, 2020.",
"url": "https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:51.614000+00:00\", \"old_value\": \"2025-04-25 14:49:08.821000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--674582ec-51c4-42ce-b409-797239e37a2a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-05-25 16:11:54.881000+00:00",
"modified": "2026-07-31 18:47:59.664000+00:00",
"name": "Saint Bear",
"description": "[Saint Bear](https://attack.mitre.org/groups/G1031) is a Russian-nexus threat actor active since early 2021, primarily targeting entities in Ukraine and Georgia. The group is notable for a specific remote access tool, [Saint Bot](https://attack.mitre.org/software/S1018), and information stealer, [OutSteel](https://attack.mitre.org/software/S1017) in campaigns. [Saint Bear](https://attack.mitre.org/groups/G1031) typically relies on phishing or web staging of malicious documents and related file types for initial access, spoofing government or related entities.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )(Citation: Cadet Blizzard emerges as novel threat actor) [Saint Bear](https://attack.mitre.org/groups/G1031) has previously been confused with [Ember Bear](https://attack.mitre.org/groups/G1003) operations, but analysis of behaviors, tools, and targeting indicates these are distinct clusters.",
"aliases": [
"Saint Bear",
"Storm-0587",
"TA471",
"UAC-0056",
"Lorec53"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1031",
"external_id": "G1031"
},
{
"source_name": "Storm-0587",
"description": "(Citation: Cadet Blizzard emerges as novel threat actor)"
},
{
"source_name": "TA471",
"description": "(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )"
},
{
"source_name": "UAC-0056",
"description": "(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )"
},
{
"source_name": "Lorec53",
"description": "(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )"
},
{
"source_name": "Cadet Blizzard emerges as novel threat actor",
"description": "Microsoft Threat Intelligence. (2023, June 14). Cadet Blizzard emerges as a novel and distinct Russian threat actor. Retrieved July 10, 2023.",
"url": "https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"
},
{
"source_name": "Palo Alto Unit 42 OutSteel SaintBot February 2022 ",
"description": "Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.",
"url": "https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:59.664000+00:00\", \"old_value\": \"2024-08-12 17:32:47.430000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--1c3dcf91-b859-4aae-a09c-ae26dc8b6390",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-02-24 20:45:14.093000+00:00",
"modified": "2026-07-31 18:47:41.313000+00:00",
"name": "Salt Typhoon",
"description": "[Salt Typhoon](https://attack.mitre.org/groups/G1045) is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP).(Citation: US Dept. of Treasury Salt Typhoon JAN 2025)(Citation: Cisco Salt Typhoon FEB 2025)\n",
"aliases": [
"Salt Typhoon"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1045",
"external_id": "G1045"
},
{
"source_name": "Cisco Salt Typhoon FEB 2025",
"description": "Cisco Talos. (2025, February 20). Weathering the storm: In the midst of a Typhoon. Retrieved February 24, 2025.",
"url": "https://blog.talosintelligence.com/salt-typhoon-analysis/"
},
{
"source_name": "US Dept. of Treasury Salt Typhoon JAN 2025",
"description": "US Department of Treasury. (2025, January 17). Treasury Sanctions Company Associated with Salt Typhoon and Hacker Associated with Treasury Compromise. Retrieved February 24, 2025.",
"url": "https://home.treasury.gov/news/press-releases/jy2792"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:41.313000+00:00\", \"old_value\": \"2025-03-06 20:09:16.402000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--381fcf73-60f6-4ab2-9991-6af3cbc35192",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:04.588000+00:00",
"modified": "2026-07-31 20:48:32.342000+00:00",
"name": "Sandworm Team",
"description": "[Sandworm Team](https://attack.mitre.org/groups/G0034) is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) This group has been active since at least 2009.(Citation: iSIGHT Sandworm 2014)(Citation: CrowdStrike VOODOO BEAR)(Citation: USDOJ Sandworm Feb 2020)(Citation: NCSC Sandworm Feb 2020)\n\nIn October 2020, the US indicted six GRU Unit 74455 officers associated with [Sandworm Team](https://attack.mitre.org/groups/G0034) for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide [NotPetya](https://attack.mitre.org/software/S0368) attack, targeting of the 2017 French presidential campaign, the 2018 [Olympic Destroyer](https://attack.mitre.org/software/S0365) attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as [APT28](https://attack.mitre.org/groups/G0007).(Citation: US District Court Indictment GRU Oct 2018)",
"aliases": [
"Sandworm Team",
"ELECTRUM",
"Telebots",
"IRON VIKING",
"BlackEnergy (Group)",
"Quedagh",
"Voodoo Bear",
"IRIDIUM",
"Seashell Blizzard",
"FROZENBARENTS",
"APT44"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0034",
"external_id": "G0034"
},
{
"source_name": "Voodoo Bear",
"description": "(Citation: CrowdStrike VOODOO BEAR)(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)"
},
{
"source_name": "ELECTRUM",
"description": "(Citation: Dragos ELECTRUM)(Citation: UK NCSC Olympic Attacks October 2020)"
},
{
"source_name": "Sandworm Team",
"description": "(Citation: iSIGHT Sandworm 2014) (Citation: F-Secure BlackEnergy 2014) (Citation: InfoSecurity Sandworm Oct 2014)(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)"
},
{
"source_name": "Quedagh",
"description": "(Citation: iSIGHT Sandworm 2014) (Citation: F-Secure BlackEnergy 2014)(Citation: UK NCSC Olympic Attacks October 2020)"
},
{
"source_name": "FROZENBARENTS",
"description": "(Citation: Leonard TAG 2023)"
},
{
"source_name": "APT44",
"description": "(Citation: mandiant_apt44_unearthing_sandworm)"
},
{
"source_name": "IRIDIUM",
"description": "(Citation: Microsoft Prestige ransomware October 2022)"
},
{
"source_name": "Seashell Blizzard",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "BlackEnergy (Group)",
"description": "(Citation: NCSC Sandworm Feb 2020)(Citation: UK NCSC Olympic Attacks October 2020)"
},
{
"source_name": "Telebots",
"description": "(Citation: NCSC Sandworm Feb 2020)(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)"
},
{
"source_name": "IRON VIKING",
"description": "(Citation: Secureworks IRON VIKING )(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)"
},
{
"source_name": "Leonard TAG 2023",
"description": "Billy Leonard. (2023, April 19). Ukraine remains Russia\u2019s biggest cyber focus in 2023. Retrieved March 1, 2024.",
"url": "https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"
},
{
"source_name": "US District Court Indictment GRU Oct 2018",
"description": "Brady, S . (2018, October 3). Indictment - United States vs Aleksei Sergeyevich Morenets, et al.. Retrieved October 1, 2020.",
"url": "https://www.justice.gov/opa/page/file/1098481/download"
},
{
"source_name": "Dragos ELECTRUM",
"description": "Dragos. (2017, January 1). ELECTRUM Threat Profile. Retrieved June 10, 2020.",
"url": "https://www.dragos.com/resource/electrum/"
},
{
"source_name": "F-Secure BlackEnergy 2014",
"description": "F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016.",
"url": "https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf"
},
{
"source_name": "iSIGHT Sandworm 2014",
"description": "Hultquist, J.. (2016, January 7). Sandworm Team and the Ukrainian Power Authority Attacks. Retrieved October 6, 2017.",
"url": "https://www.fireeye.com/blog/threat-research/2016/01/ukraine-and-sandworm-team.html"
},
{
"source_name": "CrowdStrike VOODOO BEAR",
"description": "Meyers, A. (2018, January 19). Meet CrowdStrike\u2019s Adversary of the Month for January: VOODOO BEAR. Retrieved May 22, 2018.",
"url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-january-voodoo-bear/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft Prestige ransomware October 2022",
"description": "MSTIC. (2022, October 14). New \u201cPrestige\u201d ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023.",
"url": "https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"
},
{
"source_name": "InfoSecurity Sandworm Oct 2014",
"description": "Muncaster, P.. (2014, October 14). Microsoft Zero Day Traced to Russian \u2018Sandworm\u2019 Hackers. Retrieved October 6, 2017.",
"url": "https://www.infosecurity-magazine.com/news/microsoft-zero-day-traced-russian/"
},
{
"source_name": "NCSC Sandworm Feb 2020",
"description": "NCSC. (2020, February 20). NCSC supports US advisory regarding GRU intrusion set Sandworm. Retrieved June 10, 2020.",
"url": "https://www.ncsc.gov.uk/news/ncsc-supports-sandworm-advisory"
},
{
"source_name": "USDOJ Sandworm Feb 2020",
"description": "Pompeo, M. (2020, February 20). The United States Condemns Russian Cyber Attack Against the Country of Georgia. Retrieved September 12, 2024.",
"url": "https://2017-2021.state.gov/the-united-states-condemns-russian-cyber-attack-against-the-country-of-georgia/index.html"
},
{
"source_name": "mandiant_apt44_unearthing_sandworm",
"description": "Roncone, G. et al. (n.d.). APT44: Unearthing Sandworm. Retrieved July 11, 2024.",
"url": "https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf"
},
{
"source_name": "US District Court Indictment GRU Unit 74455 October 2020",
"description": "Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.",
"url": "https://www.justice.gov/opa/press-release/file/1328521/download"
},
{
"source_name": "Secureworks IRON VIKING ",
"description": "Secureworks. (2020, May 1). IRON VIKING Threat Profile. Retrieved June 10, 2020.",
"url": "https://www.secureworks.com/research/threat-profiles/iron-viking"
},
{
"source_name": "UK NCSC Olympic Attacks October 2020",
"description": "UK NCSC. (2020, October 19). UK exposes series of Russian cyber attacks against Olympic and Paralympic Games . Retrieved November 30, 2020.",
"url": "https://www.gov.uk/government/news/uk-exposes-series-of-russian-cyber-attacks-against-olympic-and-paralympic-games"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Dragos Threat Intelligence",
"Hakan KARABACAK"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "4.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:32.342000+00:00\", \"old_value\": \"2024-12-04 21:17:08.593000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "4.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--c5574ca0-d5a4-490a-b207-e4658e5fd1d7",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:00.677000+00:00",
"modified": "2026-07-31 18:48:17.922000+00:00",
"name": "Scarlet Mimic",
"description": "[Scarlet Mimic](https://attack.mitre.org/groups/G0029) is a threat group that has targeted minority rights activists. This group has not been directly linked to a government source, but the group's motivations appear to overlap with those of the Chinese government. While there is some overlap between IP addresses used by [Scarlet Mimic](https://attack.mitre.org/groups/G0029) and [Putter Panda](https://attack.mitre.org/groups/G0024), it has not been concluded that the groups are the same. (Citation: Scarlet Mimic Jan 2016)",
"aliases": [
"Scarlet Mimic"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0029",
"external_id": "G0029"
},
{
"source_name": "Scarlet Mimic",
"description": "(Citation: Scarlet Mimic Jan 2016)"
},
{
"source_name": "Scarlet Mimic Jan 2016",
"description": "Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016.",
"url": "http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:17.922000+00:00\", \"old_value\": \"2025-04-25 14:49:45.222000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--44d37b89-a739-4810-9111-0d2617a8939b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-07-05 17:54:54.789000+00:00",
"modified": "2026-07-31 20:48:33.778000+00:00",
"name": "Scattered Spider",
"description": "[Scattered Spider](https://attack.mitre.org/groups/G1015) is a native English-speaking cybercriminal group active since at least 2022. (Citation: CrowdStrike Scattered Spider Profile) (Citation: MSTIC Octo Tempest Operations October 2023) The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. (Citation: MSTIC Octo Tempest Operations October 2023)\n[Scattered Spider](https://attack.mitre.org/groups/G1015) relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. (Citation: CISA Scattered Spider Advisory November 2023) (Citation: CrowdStrike Scattered Spider BYOVD January 2023) (Citation: Crowdstrike TELCO BPO Campaign December 2022)\n[Scattered Spider](https://attack.mitre.org/groups/G1015) had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. (Citation: Mandiant UNC3944 May 2025)",
"aliases": [
"Scattered Spider",
"Roasted 0ktapus",
"Octo Tempest",
"Storm-0875",
"UNC3944"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1015",
"external_id": "G1015"
},
{
"source_name": "Roasted 0ktapus",
"description": "(Citation: CrowdStrike Scattered Spider BYOVD January 2023)"
},
{
"source_name": "UNC3944",
"description": "(Citation: Mandiant UNC3944 May 2025)(Citation: Mandiant VMware vSphere JUL 2025)"
},
{
"source_name": "Octo Tempest",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Storm-0875",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "CISA Scattered Spider Advisory November 2023",
"description": "CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.",
"url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"
},
{
"source_name": "CrowdStrike Scattered Spider BYOVD January 2023",
"description": "CrowdStrike. (2023, January 10). SCATTERED SPIDER Exploits Windows Security Deficiencies with Bring-Your-Own-Vulnerable-Driver Tactic in Attempt to Bypass Endpoint Security. Retrieved July 5, 2023.",
"url": "https://www.crowdstrike.com/blog/scattered-spider-attempts-to-avoid-detection-with-bring-your-own-vulnerable-driver-tactic/"
},
{
"source_name": "CrowdStrike Scattered Spider Profile",
"description": "CrowdStrike. (n.d.). Scattered Spider. Retrieved July 5, 2023.",
"url": "https://www.crowdstrike.com/adversaries/scattered-spider/"
},
{
"source_name": "Mandiant VMware vSphere JUL 2025",
"description": "Mandiant Incident Response. (2025, July 23). From Help Desk to Hypervisor: Defending Your VMware vSphere Estate from UNC3944. Retrieved October 13, 2025.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"
},
{
"source_name": "Mandiant UNC3944 May 2025",
"description": "Mandiant Incident Response. (2025, May 6). Defending Against UNC3944: Cybercrime Hardening Guidance from the Frontlines. Retrieved October 13, 2025.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "MSTIC Octo Tempest Operations October 2023",
"description": "Microsoft. (2023, October 25). Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction. Retrieved March 18, 2024.",
"url": "https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/"
},
{
"source_name": "Crowdstrike TELCO BPO Campaign December 2022",
"description": "Parisi, T. (2022, December 2). Not a SIMulation: CrowdStrike Investigations Reveal Intrusion Campaign Targeting Telco and BPO Companies. Retrieved June 30, 2023.",
"url": "https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:33.778000+00:00\", \"old_value\": \"2025-10-24 02:30:51.936000+00:00\"}}}",
"previous_version": "3.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--56a05d27-4d47-418a-b330-781c5614f202",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-11-20 18:21:28.242000+00:00",
"modified": "2026-07-31 18:47:56.961000+00:00",
"name": "Sea Turtle",
"description": "[Sea Turtle](https://attack.mitre.org/groups/G1041) is a T\u00fcrkiye-linked threat actor active since at least 2017 performing espionage and service provider compromise operations against victims in Asia, Europe, and North America. [Sea Turtle](https://attack.mitre.org/groups/G1041) is notable for targeting registrars managing ccTLDs and complex DNS-based intrusions where the threat actor compromised DNS providers to hijack DNS resolution for ultimate victims, enabling [Sea Turtle](https://attack.mitre.org/groups/G1041) to spoof log in portals and other applications for credential collection.(Citation: Talos Sea Turtle 2019)(Citation: Talos Sea Turtle 2019_2)(Citation: PWC Sea Turtle 2023)(Citation: Hunt Sea Turtle 2024)",
"aliases": [
"Sea Turtle",
"Teal Kurma",
"Marbled Dust",
"Cosmic Wolf",
"SILICON"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1041",
"external_id": "G1041"
},
{
"source_name": "SILICON",
"description": "(Citation: Microsoft Digital Defense 2021)(Citation: Hunt Sea Turtle 2024)"
},
{
"source_name": "Teal Kurma",
"description": "(Citation: PWC Sea Turtle 2023)(Citation: Hunt Sea Turtle 2024)"
},
{
"source_name": "Marbled Dust",
"description": "(Citation: PWC Sea Turtle 2023)(Citation: Hunt Sea Turtle 2024)"
},
{
"source_name": "Cosmic Wolf",
"description": "(Citation: PWC Sea Turtle 2023)(Citation: Hunt Sea Turtle 2024)"
},
{
"source_name": "Talos Sea Turtle 2019",
"description": "Cisco Talos. (2019, April 17). Sea Turtle: DNS Hijacking Abuses Trust In Core Internet Service. Retrieved November 20, 2024.",
"url": "https://blog.talosintelligence.com/seaturtle/"
},
{
"source_name": "Hunt Sea Turtle 2024",
"description": "Hunt & Hackett Research Team. (2024, January 5). Turkish espionage campaigns in the Netherlands. Retrieved November 20, 2024.",
"url": "https://www.huntandhackett.com/blog/turkish-espionage-campaigns"
},
{
"source_name": "Microsoft Digital Defense 2021",
"description": "Microsoft. (2021, October). Microsoft Digital Defense Report. Retrieved November 20, 2024.",
"url": "https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWMFIi?id=101738"
},
{
"source_name": "Talos Sea Turtle 2019_2",
"description": "Paul Rascagneres. (2019, July 9). Sea Turtle keeps on swimming, finds new victims, DNS hijacking techniques. Retrieved November 20, 2024.",
"url": "https://blog.talosintelligence.com/sea-turtle-keeps-on-swimming/"
},
{
"source_name": "PWC Sea Turtle 2023",
"description": "PwC Threat Intelligence. (2023, December 5). The Tortoise and The Malware. Retrieved November 20, 2024.",
"url": "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/tortoise-and-malwahare.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Inna Danilevich, U.S. Bank",
"Joe Gumke, U.S. Bank"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:56.961000+00:00\", \"old_value\": \"2025-03-28 15:28:31.727000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--03be849d-b5a2-4766-9dda-48976bae5710",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-08-07 13:52:07.791000+00:00",
"modified": "2026-07-31 18:47:36.181000+00:00",
"name": "SideCopy",
"description": "[SideCopy](https://attack.mitre.org/groups/G1008) is a Pakistani threat group that has primarily targeted South Asian countries, including Indian and Afghani government personnel, since at least 2019. [SideCopy](https://attack.mitre.org/groups/G1008)'s name comes from its infection chain that tries to mimic that of [Sidewinder](https://attack.mitre.org/groups/G0121), a suspected Indian threat group.(Citation: MalwareBytes SideCopy Dec 2021)",
"aliases": [
"SideCopy"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1008",
"external_id": "G1008"
},
{
"source_name": "MalwareBytes SideCopy Dec 2021",
"description": "Threat Intelligence Team. (2021, December 2). SideCopy APT: Connecting lures victims, payloads to infrastructure. Retrieved June 13, 2022.",
"url": "https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Pooja Natarajan, NEC Corporation India",
"Hiroki Nagahama, NEC Corporation",
"Manikantan Srinivasan, NEC Corporation India"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:36.181000+00:00\", \"old_value\": \"2025-04-16 20:37:38.248000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--3fc023b2-c5cc-481d-9c3e-70141ae1a87e",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-01-27 15:57:11.183000+00:00",
"modified": "2026-07-31 18:47:50.955000+00:00",
"name": "Sidewinder",
"description": "[Sidewinder](https://attack.mitre.org/groups/G0121) is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan.(Citation: ATT Sidewinder January 2021)(Citation: Securelist APT Trends April 2018)(Citation: Cyble Sidewinder September 2020)",
"aliases": [
"Sidewinder",
"T-APT-04",
"Rattlesnake"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0121",
"external_id": "G0121"
},
{
"source_name": "T-APT-04",
"description": "(Citation: Cyble Sidewinder September 2020)"
},
{
"source_name": "Rattlesnake",
"description": "(Citation: Cyble Sidewinder September 2020)"
},
{
"source_name": "Cyble Sidewinder September 2020",
"description": "Cyble. (2020, September 26). SideWinder APT Targets with futuristic Tactics and Techniques. Retrieved January 29, 2021.",
"url": "https://cybleinc.com/2020/09/26/sidewinder-apt-targets-with-futuristic-tactics-and-techniques/"
},
{
"source_name": "Securelist APT Trends April 2018",
"description": "Global Research and Analysis Team . (2018, April 12). APT Trends report Q1 2018. Retrieved January 27, 2021.",
"url": "https://securelist.com/apt-trends-report-q1-2018/85280/"
},
{
"source_name": "ATT Sidewinder January 2021",
"description": "Hegel, T. (2021, January 13). A Global Perspective of the SideWinder APT. Retrieved January 27, 2021.",
"url": "https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Lacework Labs",
"Daniyal Naeem, BT Security"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:50.955000+00:00\", \"old_value\": \"2024-04-11 00:07:05.918000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--d13c8a7f-740b-4efa-a232-de7d6bb05321",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-05-24 17:57:36.491000+00:00",
"modified": "2026-07-31 18:48:20.506000+00:00",
"name": "Silence",
"description": "[Silence](https://attack.mitre.org/groups/G0091) is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank's Automated Workstation Client, ATMs, and card processing.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017) ",
"aliases": [
"Silence",
"Whisper Spider"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0091",
"external_id": "G0091"
},
{
"source_name": "Whisper Spider",
"description": "(Citation: Crowdstrike GTR2020 Mar 2020)"
},
{
"source_name": "Silence",
"description": "(Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017) "
},
{
"source_name": "Crowdstrike GTR2020 Mar 2020",
"description": "Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.",
"url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"
},
{
"source_name": "SecureList Silence Nov 2017",
"description": "GReAT. (2017, November 1). Silence \u2013 a new Trojan attacking financial organizations. Retrieved May 24, 2019.",
"url": "https://securelist.com/the-silence/83009/"
},
{
"source_name": "Cyber Forensicator Silence Jan 2019",
"description": "Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Oleg Skulkin, Group-IB"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:20.506000+00:00\", \"old_value\": \"2024-11-17 18:19:52.955000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--90784c1e-4aba-40eb-9adf-7556235e6384",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-02-03 16:36:38.145000+00:00",
"modified": "2026-07-31 18:48:08.693000+00:00",
"name": "Silent Librarian",
"description": "[Silent Librarian](https://attack.mitre.org/groups/G0122) is a group that has targeted research and proprietary data at universities, government agencies, and private sector companies worldwide since at least 2013. Members of [Silent Librarian](https://attack.mitre.org/groups/G0122) are known to have been affiliated with the Iran-based Mabna Institute which has conducted cyber intrusions at the behest of the government of Iran, specifically the Islamic Revolutionary Guard Corps (IRGC).(Citation: DOJ Iran Indictments March 2018)(Citation: Phish Labs Silent Librarian)(Citation: Malwarebytes Silent Librarian October 2020)",
"aliases": [
"Silent Librarian",
"TA407",
"COBALT DICKENS"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0122",
"external_id": "G0122"
},
{
"source_name": "TA407",
"description": "(Citation: Proofpoint TA407 September 2019)(Citation: Malwarebytes Silent Librarian October 2020)"
},
{
"source_name": "COBALT DICKENS",
"description": "(Citation: Secureworks COBALT DICKENS August 2018)(Citation: Secureworks COBALT DICKENS September 2019)(Citation: Proofpoint TA407 September 2019)(Citation: Malwarebytes Silent Librarian October 2020)"
},
{
"source_name": "DOJ Iran Indictments March 2018",
"description": "DOJ. (2018, March 23). U.S. v. Rafatnejad et al . Retrieved February 3, 2021.",
"url": "https://www.justice.gov/usao-sdny/press-release/file/1045781/download"
},
{
"source_name": "Phish Labs Silent Librarian",
"description": "Hassold, Crane. (2018, March 26). Silent Librarian: More to the Story of the Iranian Mabna Institute Indictment. Retrieved February 3, 2021.",
"url": "https://info.phishlabs.com/blog/silent-librarian-more-to-the-story-of-the-iranian-mabna-institute-indictment"
},
{
"source_name": "Malwarebytes Silent Librarian October 2020",
"description": "Malwarebytes Threat Intelligence Team. (2020, October 14). Silent Librarian APT right on schedule for 20/21 academic year. Retrieved February 3, 2021.",
"url": "https://blog.malwarebytes.com/malwarebytes-news/2020/10/silent-librarian-apt-phishing-attack/"
},
{
"source_name": "Proofpoint TA407 September 2019",
"description": "Proofpoint Threat Insight Team. (2019, September 5). Threat Actor Profile: TA407, the Silent Librarian. Retrieved February 3, 2021.",
"url": "https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian"
},
{
"source_name": "Secureworks COBALT DICKENS August 2018",
"description": "Counter Threat Unit Research Team. (2018, August 24). Back to School: COBALT DICKENS Targets Universities. Retrieved February 3, 2021.",
"url": "https://www.secureworks.com/blog/back-to-school-cobalt-dickens-targets-universities"
},
{
"source_name": "Secureworks COBALT DICKENS September 2019",
"description": "Counter Threat Unit Research Team. (2019, September 11). COBALT DICKENS Goes Back to School\u2026Again. Retrieved February 3, 2021.",
"url": "https://www.secureworks.com/blog/cobalt-dickens-goes-back-to-school-again"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:08.693000+00:00\", \"old_value\": \"2025-04-25 14:49:29.613000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--76565741-3452-4069-ab08-80c0ea95bbeb",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-01-29 21:36:59.793000+00:00",
"modified": "2026-07-31 18:48:02.596000+00:00",
"name": "SilverTerrier",
"description": "[SilverTerrier](https://attack.mitre.org/groups/G0083) is a Nigerian threat group that has been seen active since 2014. [SilverTerrier](https://attack.mitre.org/groups/G0083) mainly targets organizations in high technology, higher education, and manufacturing.(Citation: Unit42 SilverTerrier 2018)(Citation: Unit42 SilverTerrier 2016)",
"aliases": [
"SilverTerrier"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0083",
"external_id": "G0083"
},
{
"source_name": "SilverTerrier",
"description": "(Citation: Unit42 SilverTerrier 2018)(Citation: Unit42 SilverTerrier 2016)"
},
{
"source_name": "Unit42 SilverTerrier 2016",
"description": "Renals, P., Conant, S. (2016). SILVERTERRIER: The Next Evolution in Nigerian Cybercrime. Retrieved November 13, 2018.",
"url": "https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/silverterrier-next-evolution-in-nigerian-cybercrime.pdf"
},
{
"source_name": "Unit42 SilverTerrier 2018",
"description": "Unit42. (2016). SILVERTERRIER: THE RISE OF NIGERIAN BUSINESS EMAIL COMPROMISE. Retrieved November 13, 2018.",
"url": "https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/whitepapers/unit42-silverterrier-rise-of-nigerian-business-email-compromise"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:02.596000+00:00\", \"old_value\": \"2023-09-27 20:22:05.127000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--d1acfbb3-647b-4723-9154-800ec119006e",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-01-16 16:13:52.465000+00:00",
"modified": "2026-07-31 18:48:20.561000+00:00",
"name": "Sowbug",
"description": "[Sowbug](https://attack.mitre.org/groups/G0054) is a threat group that has conducted targeted attacks against organizations in South America and Southeast Asia, particularly government entities, since at least 2015. (Citation: Symantec Sowbug Nov 2017)",
"aliases": [
"Sowbug"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0054",
"external_id": "G0054"
},
{
"source_name": "Sowbug",
"description": "(Citation: Symantec Sowbug Nov 2017)"
},
{
"source_name": "Symantec Sowbug Nov 2017",
"description": "Symantec Security Response. (2017, November 7). Sowbug: Cyber espionage group targets South American and Southeast Asian governments. Retrieved November 16, 2017.",
"url": "https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Alan Neville, @abnev"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:20.561000+00:00\", \"old_value\": \"2025-04-25 14:49:21.603000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--9b36c218-4d80-4ec6-a68d-cc2886bbe410",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-06-14 18:17:18.727000+00:00",
"modified": "2026-07-31 20:48:42.370000+00:00",
"name": "Star Blizzard",
"description": "[Star Blizzard](https://attack.mitre.org/groups/G1033) is a cyber espionage and influence group originating in Russia that has been active since at least 2019. [Star Blizzard](https://attack.mitre.org/groups/G1033) campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.(Citation: Microsoft Star Blizzard August 2022)(Citation: CISA Star Blizzard Advisory December 2023)(Citation: StarBlizzard)(Citation: Google TAG COLDRIVER January 2024)\n",
"aliases": [
"Star Blizzard",
"SEABORGIUM",
"Callisto Group",
"TA446",
"COLDRIVER"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1033",
"external_id": "G1033"
},
{
"source_name": "Callisto Group",
"description": "(Citation: CISA Star Blizzard Advisory December 2023)"
},
{
"source_name": "TA446",
"description": "(Citation: CISA Star Blizzard Advisory December 2023)"
},
{
"source_name": "COLDRIVER",
"description": "(Citation: Google TAG COLDRIVER January 2024)"
},
{
"source_name": "SEABORGIUM",
"description": "(Citation: Microsoft Star Blizzard August 2022)"
},
{
"source_name": "CISA Star Blizzard Advisory December 2023",
"description": "CISA, et al. (2023, December 7). Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spear-phishing Campaigns. Retrieved June 13, 2024.",
"url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a"
},
{
"source_name": "Microsoft Star Blizzard August 2022",
"description": "Microsoft Threat Intelligence. (2022, August 15). Disrupting SEABORGIUM\u2019s ongoing phishing operations. Retrieved June 13, 2024.",
"url": "https://www.microsoft.com/en-us/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/"
},
{
"source_name": "StarBlizzard",
"description": "Microsoft Threat Intelligence. (2023, December 7). Star Blizzard increases sophistication and evasion in ongoing attacks. Retrieved February 13, 2024.",
"url": "https://www.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks/"
},
{
"source_name": "Google TAG COLDRIVER January 2024",
"description": "Shields, W. (2024, January 18). Russian threat group COLDRIVER expands its targeting of Western officials to include the use of malware. Retrieved June 13, 2024.",
"url": "https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Aung Kyaw Min Naing, @Nolan"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:42.370000+00:00\", \"old_value\": \"2026-05-12 15:12:00.732000+00:00\"}}}",
"previous_version": "2.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--894aab42-3371-47b1-8859-a4a074c804c8",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:06.390000+00:00",
"modified": "2026-07-31 18:48:06.436000+00:00",
"name": "Stealth Falcon",
"description": "[Stealth Falcon](https://attack.mitre.org/groups/G0038) is a threat group that has conducted targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012. Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates (UAE) government, but that has not been confirmed. (Citation: Citizen Lab Stealth Falcon May 2016)",
"aliases": [
"Stealth Falcon"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0038",
"external_id": "G0038"
},
{
"source_name": "Stealth Falcon",
"description": "(Citation: Citizen Lab Stealth Falcon May 2016)"
},
{
"source_name": "Citizen Lab Stealth Falcon May 2016",
"description": "Marczak, B. and Scott-Railton, J.. (2016, May 29). Keep Calm and (Don\u2019t) Enable Macros: A New Threat Actor Targets UAE Dissidents. Retrieved June 8, 2016.",
"url": "https://citizenlab.org/2016/05/stealth-falcon/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:06.436000+00:00\", \"old_value\": \"2025-04-25 14:49:04.710000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--7b404cd0-3ae9-41d4-90c0-023793d35d97",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-10-19 19:08:22.474000+00:00",
"modified": "2026-07-31 18:48:03.011000+00:00",
"name": "Storm-0501",
"description": "[Storm-0501](https://attack.mitre.org/groups/G1053) is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. [Storm-0501](https://attack.mitre.org/groups/G1053) has been active since 2021 and has previously been affiliated with Sabbath Ransomware and other Ransomware-as-a-Service (RaaS) variants such as Hive, [BlackCat](https://attack.mitre.org/software/S1068), Hunters International, [LockBit 3.0](https://attack.mitre.org/software/S1202), and [Embargo](https://attack.mitre.org/software/S1247) ransomware.(Citation: Avertium Storm-0501 Sabbath Ransomware Arcane January 2022)(Citation: Microsoft Storm-501 Sabbath Ransomware Embargo September 2024)(Citation: Microsoft Storm-0501 Embargo Ransomware August 2025)(Citation: Google Mandiant Storm-0501 Sabbath Ransomware November 2021)",
"aliases": [
"Storm-0501"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1053",
"external_id": "G1053"
},
{
"source_name": "Avertium Storm-0501 Sabbath Ransomware Arcane January 2022",
"description": "Avertium. (2022, January 11). An In-Depth Look at Ransomware Gang, Sabbath. Retrieved October 19, 2025.",
"url": "https://www.avertium.com/resources/threat-reports/in-depth-look-at-sabbath-ransomware-gang"
},
{
"source_name": "Microsoft Storm-501 Sabbath Ransomware Embargo September 2024",
"description": "Microsoft Threat Intelligence. (2024, September 26). Storm-0501: Ransomware attacks expanding to hybrid cloud environments. Retrieved October 19, 2025.",
"url": "https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"
},
{
"source_name": "Microsoft Storm-0501 Embargo Ransomware August 2025",
"description": "Microsoft Threat Intelligence. (2025, August 27). Storm-0501\u2019s evolving techniques lead to cloud-based ransomware. Retrieved October 19, 2025.",
"url": "https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"
},
{
"source_name": "Google Mandiant Storm-0501 Sabbath Ransomware November 2021",
"description": "Tyler McLellan, Brandan Schondorfer. (2021, November 29). Kitten.gif: Meet the Sabbath Ransomware Affiliate Program, Again. Retrieved October 19, 2025.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/sabbath-ransomware-affiliate/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:03.011000+00:00\", \"old_value\": \"2025-10-24 02:33:31.401000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--319fd652-edde-46b2-9987-3519493989f5",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-03-14 12:48:44.771000+00:00",
"modified": "2026-07-31 18:47:47.257000+00:00",
"name": "Storm-1811",
"description": "[Storm-1811](https://attack.mitre.org/groups/G1046) is a financially-motivated entity linked to [Black Basta](https://attack.mitre.org/software/S1070) ransomware deployment. [Storm-1811](https://attack.mitre.org/groups/G1046) is notable for unique phishing and social engineering mechanisms for initial access, such as overloading victim email inboxes with non-malicious spam to prompt a fake \"help desk\" interaction leading to the deployment of adversary tools and capabilities.(Citation: Microsoft Storm-1811 2024)(Citation: rapid7-email-bombing)(Citation: RedCanary Storm-1811 2024)(Citation: RedCanary June Insights 2024)",
"aliases": [
"Storm-1811"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1046",
"external_id": "G1046"
},
{
"source_name": "Microsoft Storm-1811 2024",
"description": "Microsoft Threat Intelligence. (2024, May 15). Threat actors misusing Quick Assist in social engineering attacks leading to ransomware. Retrieved March 14, 2025.",
"url": "https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"
},
{
"source_name": "RedCanary Storm-1811 2024",
"description": "Red Canary Intelligence. (2024, December 2). Storm-1811 exploits RMM tools to drop Black Basta ransomware. Retrieved March 14, 2025.",
"url": "https://redcanary.com/blog/threat-intelligence/storm-1811-black-basta/"
},
{
"source_name": "RedCanary June Insights 2024",
"description": "The Red Canary Team. (2024, June 20). Intelligence Insights: June 2024. Retrieved March 14, 2025.",
"url": "https://redcanary.com/blog/threat-intelligence/intelligence-insights-june-2024/"
},
{
"source_name": "rapid7-email-bombing",
"description": "Tyler McGraw, Thomas Elkins, and Evan McCann. (2024, May 10). Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators. Retrieved January 31, 2025.",
"url": "https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Liran Ravich, CardinalOps",
"Joe Gumke, U.S. Bank"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:47.257000+00:00\", \"old_value\": \"2025-03-14 19:17:33.785000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--277d2f87-2ae5-4730-a3aa-50c1fdff9656",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:07.541000+00:00",
"modified": "2026-07-31 18:47:44.949000+00:00",
"name": "Strider",
"description": "[Strider](https://attack.mitre.org/groups/G0041) is a threat group that has been active since at least 2011 and has targeted victims in Russia, China, Sweden, Belgium, Iran, and Rwanda.(Citation: Symantec Strider Blog)(Citation: Kaspersky ProjectSauron Blog)",
"aliases": [
"Strider",
"ProjectSauron"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0041",
"external_id": "G0041"
},
{
"source_name": "Strider",
"description": "(Citation: Symantec Strider Blog) (Citation: Kaspersky ProjectSauron Blog)"
},
{
"source_name": "ProjectSauron",
"description": "ProjectSauron is used to refer both to the threat group also known as G0041 as well as the malware platform also known as S0125. (Citation: Kaspersky ProjectSauron Blog) (Citation: Kaspersky ProjectSauron Full Report)"
},
{
"source_name": "Symantec Strider Blog",
"description": "Symantec Security Response. (2016, August 7). Strider: Cyberespionage group turns eye of Sauron on targets. Retrieved August 17, 2016.",
"url": "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
},
{
"source_name": "Kaspersky ProjectSauron Blog",
"description": "Kaspersky Lab's Global Research & Analysis Team. (2016, August 8). ProjectSauron: top level cyber-espionage platform covertly extracts encrypted government comms. Retrieved August 17, 2016.",
"url": "https://securelist.com/faq-the-projectsauron-apt/75533/"
},
{
"source_name": "Kaspersky ProjectSauron Full Report",
"description": "Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.",
"url": "https://securelist.com/files/2016/07/The-ProjectSauron-APT_research_KL.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:44.949000+00:00\", \"old_value\": \"2025-04-25 14:49:43.099000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--5cbe0d3b-6fb1-471f-b591-4b192915116d",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:06.777000+00:00",
"modified": "2026-07-31 18:47:57.501000+00:00",
"name": "Suckfly",
"description": "[Suckfly](https://attack.mitre.org/groups/G0039) is a China-based threat group that has been active since at least 2014. (Citation: Symantec Suckfly March 2016)",
"aliases": [
"Suckfly"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0039",
"external_id": "G0039"
},
{
"source_name": "Suckfly",
"description": "(Citation: Symantec Suckfly March 2016) (Citation: Symantec Suckfly May 2016)"
},
{
"source_name": "Symantec Suckfly March 2016",
"description": "DiMaggio, J. (2016, March 15). Suckfly: Revealing the secret life of your code signing certificates. Retrieved August 3, 2016.",
"url": "http://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
},
{
"source_name": "Symantec Suckfly May 2016",
"description": "DiMaggio, J. (2016, May 17). Indian organizations targeted in Suckfly attacks. Retrieved August 3, 2016.",
"url": "http://www.symantec.com/connect/blogs/indian-organizations-targeted-suckfly-attacks"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:57.501000+00:00\", \"old_value\": \"2025-04-16 20:37:33.565000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--467271fd-47c0-4e90-a3f9-d84f5cf790d0",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-09-12 17:00:22.615000+00:00",
"modified": "2026-07-31 18:47:54.288000+00:00",
"name": "TA2541",
"description": "[TA2541](https://attack.mitre.org/groups/G1018) is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. [TA2541](https://attack.mitre.org/groups/G1018) campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.(Citation: Proofpoint TA2541 February 2022)(Citation: Cisco Operation Layover September 2021)",
"aliases": [
"TA2541"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1018",
"external_id": "G1018"
},
{
"source_name": "Proofpoint TA2541 February 2022",
"description": "Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.",
"url": "https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"
},
{
"source_name": "Cisco Operation Layover September 2021",
"description": "Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.",
"url": "https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Pooja Natarajan, NEC Corporation India",
"Aaron Jornet"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:54.288000+00:00\", \"old_value\": \"2024-04-10 22:38:45.199000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--62a64fd3-aaf7-4d09-a375-d6f8bb118481",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-04-18 17:59:24.739000+00:00",
"modified": "2026-07-31 18:47:58.066000+00:00",
"name": "TA459",
"description": "[TA459](https://attack.mitre.org/groups/G0062) is a threat group believed to operate out of China that has targeted countries including Russia, Belarus, Mongolia, and others. (Citation: Proofpoint TA459 April 2017)",
"aliases": [
"TA459"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0062",
"external_id": "G0062"
},
{
"source_name": "TA459",
"description": "(Citation: Proofpoint TA459 April 2017)"
},
{
"source_name": "Proofpoint TA459 April 2017",
"description": "Axel F. (2017, April 27). APT Targets Financial Analysts with CVE-2017-0199. Retrieved February 15, 2018.",
"url": "https://www.proofpoint.com/us/threat-insight/post/apt-targets-financial-analysts"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Valerii Marchuk, Cybersecurity Help s.r.o."
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:58.066000+00:00\", \"old_value\": \"2025-04-25 14:49:19.743000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--7eda3dd8-b09b-4705-8090-c2ad9fb8c14d",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-05-28 15:54:17.213000+00:00",
"modified": "2026-07-31 18:48:04.495000+00:00",
"name": "TA505",
"description": "[TA505](https://attack.mitre.org/groups/G0092) is a cyber criminal group that has been active since at least 2014. [TA505](https://attack.mitre.org/groups/G0092) is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving [Clop](https://attack.mitre.org/software/S0611).(Citation: Proofpoint TA505 Sep 2017)(Citation: Proofpoint TA505 June 2018)(Citation: Proofpoint TA505 Jan 2019)(Citation: NCC Group TA505)(Citation: Korean FSI TA505 2020)",
"aliases": [
"TA505",
"Hive0065",
"Spandex Tempest",
"CHIMBORAZO"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0092",
"external_id": "G0092"
},
{
"source_name": "Hive0065",
"description": "(Citation: IBM TA505 April 2020)"
},
{
"source_name": "Spandex Tempest",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "CHIMBORAZO",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Korean FSI TA505 2020",
"description": "Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.",
"url": "https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="
},
{
"source_name": "IBM TA505 April 2020",
"description": "Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020.",
"url": "https://web.archive.org/web/20200420201624/https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Proofpoint TA505 Sep 2017",
"description": "Proofpoint Staff. (2017, September 27). Threat Actor Profile: TA505, From Dridex to GlobeImposter. Retrieved May 28, 2019.",
"url": "https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter"
},
{
"source_name": "Proofpoint TA505 June 2018",
"description": "Proofpoint Staff. (2018, June 8). TA505 shifts with the times. Retrieved May 28, 2019.",
"url": "https://www.proofpoint.com/us/threat-insight/post/ta505-shifts-times"
},
{
"source_name": "Proofpoint TA505 Jan 2019",
"description": "Schwarz, D. and Proofpoint Staff. (2019, January 9). ServHelper and FlawedGrace - New malware introduced by TA505. Retrieved May 28, 2019.",
"url": "https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505"
},
{
"source_name": "NCC Group TA505",
"description": "Terefos, A. (2020, November 18). TA505: A Brief History of Their Time. Retrieved July 14, 2022.",
"url": "https://research.nccgroup.com/2020/11/18/ta505-a-brief-history-of-their-time/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:04.495000+00:00\", \"old_value\": \"2026-01-20 15:50:34.667000+00:00\"}}}",
"previous_version": "3.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--94873029-f950-4268-9cfd-5032e15cb182",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-03-19 21:04:00.692000+00:00",
"modified": "2026-07-31 18:48:09.361000+00:00",
"name": "TA551",
"description": "[TA551](https://attack.mitre.org/groups/G0127) is a financially-motivated threat group that has been active since at least 2018. (Citation: Secureworks GOLD CABIN) The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns. (Citation: Unit 42 TA551 Jan 2021)",
"aliases": [
"TA551",
"GOLD CABIN",
"Shathak"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0127",
"external_id": "G0127"
},
{
"source_name": "GOLD CABIN",
"description": "(Citation: Secureworks GOLD CABIN)"
},
{
"source_name": "Shathak",
"description": "(Citation: Unit 42 Valak July 2020)(Citation: Unit 42 TA551 Jan 2021)"
},
{
"source_name": "Unit 42 Valak July 2020",
"description": "Duncan, B. (2020, July 24). Evolution of Valak, from Its Beginnings to Mass Distribution. Retrieved August 31, 2020.",
"url": "https://unit42.paloaltonetworks.com/valak-evolution/"
},
{
"source_name": "Unit 42 TA551 Jan 2021",
"description": "Duncan, B. (2021, January 7). TA551: Email Attack Campaign Switches from Valak to IcedID. Retrieved March 17, 2021.",
"url": "https://unit42.paloaltonetworks.com/ta551-shathak-icedid/"
},
{
"source_name": "Secureworks GOLD CABIN",
"description": "Secureworks. (n.d.). GOLD CABIN Threat Profile. Retrieved March 17, 2021.",
"url": "https://www.secureworks.com/research/threat-profiles/gold-cabin"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Shuhei Sasada, Cyber Defense Institute, Inc",
"Ryo Tamura, SecureBrain Corporation",
"Shotaro Hamamoto, NEC Solution Innovators, Ltd",
"Yusuke Niwa, ITOCHU Corporation",
"Takuma Matsumoto, LAC Co., Ltd"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:09.361000+00:00\", \"old_value\": \"2025-04-16 20:37:36.634000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--13ef3485-70d2-4567-b934-0e83c1eafcf1",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-09-17 16:05:53.084000+00:00",
"modified": "2026-07-31 18:47:37.994000+00:00",
"name": "TA577",
"description": "[TA577](https://attack.mitre.org/groups/G1037) is an initial access broker (IAB) that has distributed [QakBot](https://attack.mitre.org/software/S0650) and [Pikabot](https://attack.mitre.org/software/S1145), and was among the first observed groups distributing [Latrodectus](https://attack.mitre.org/software/S1160) in 2023.(Citation: Latrodectus APR 2024)",
"aliases": [
"TA577"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1037",
"external_id": "G1037"
},
{
"source_name": "Latrodectus APR 2024",
"description": "Proofpoint Threat Research and Team Cymru S2 Threat Research. (2024, April 4). Latrodectus: This Spider Bytes Like Ice . Retrieved May 31, 2024.",
"url": "https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:37.994000+00:00\", \"old_value\": \"2024-09-17 16:07:34.686000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--a5cfbc79-316c-42f2-915d-6e8fef4085f8",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-09-17 17:55:44.833000+00:00",
"modified": "2026-07-31 18:48:11.583000+00:00",
"name": "TA578",
"description": "[TA578](https://attack.mitre.org/groups/G1038) is a threat actor that has used contact forms and email to initiate communications with victims and to distribute malware including [Latrodectus](https://attack.mitre.org/software/S1160), [IcedID](https://attack.mitre.org/software/S0483), and [Bumblebee](https://attack.mitre.org/software/S1039).(Citation: Latrodectus APR 2024)(Citation: Bitsight Latrodectus June 2024)",
"aliases": [
"TA578"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1038",
"external_id": "G1038"
},
{
"source_name": "Bitsight Latrodectus June 2024",
"description": "Batista, J. (2024, June 17). Latrodectus, are you coming back?. Retrieved September 13, 2024.",
"url": "https://www.bitsight.com/blog/latrodectus-are-you-coming-back"
},
{
"source_name": "Latrodectus APR 2024",
"description": "Proofpoint Threat Research and Team Cymru S2 Threat Research. (2024, April 4). Latrodectus: This Spider Bytes Like Ice . Retrieved May 31, 2024.",
"url": "https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:11.583000+00:00\", \"old_value\": \"2024-09-17 17:55:58.333000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--9538b1a4-4120-4e2d-bf59-3b11fcab05a4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-04-16 15:14:38.533000+00:00",
"modified": "2026-07-31 20:48:41.930000+00:00",
"name": "TEMP.Veles",
"description": "[TEMP.Veles](https://attack.mitre.org/groups/G0088) is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing [TRITON](https://attack.mitre.org/software/S0609), a malware framework designed to manipulate industrial safety systems.(Citation: FireEye TRITON 2019)(Citation: FireEye TEMP.Veles 2018)(Citation: FireEye TEMP.Veles JSON April 2019)",
"aliases": [
"TEMP.Veles",
"XENOTIME"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0088",
"external_id": "G0088"
},
{
"source_name": "TEMP.Veles",
"description": "(Citation: FireEye TRITON 2019)"
},
{
"source_name": "Dragos Xenotime 2018",
"description": "Dragos, Inc.. (n.d.). Xenotime. Retrieved April 16, 2019.",
"url": "https://dragos.com/resource/xenotime/"
},
{
"source_name": "FireEye TEMP.Veles 2018",
"description": "FireEye Intelligence . (2018, October 23). TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers. Retrieved April 16, 2019.",
"url": "https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html"
},
{
"source_name": "FireEye TRITON 2019",
"description": "Miller, S, et al. (2019, April 10). TRITON Actor TTP Profile, Custom Attack Tools, Detections, and ATT&CK Mapping. Retrieved April 16, 2019.",
"url": "https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html"
},
{
"source_name": "FireEye TEMP.Veles JSON April 2019",
"description": "Miller, S., et al. (2019, April 10). TRITON Appendix C. Retrieved April 29, 2019.",
"url": "https://www.fireeye.com/content/dam/fireeye-www/blog/files/TRITON_Appendix_C.html"
},
{
"source_name": "Pylos Xenotime 2019",
"description": "Slowik, J.. (2019, April 12). A XENOTIME to Remember: Veles in the Wild. Retrieved April 16, 2019.",
"url": "https://pylos.co/2019/04/12/a-xenotime-to-remember-veles-in-the-wild/"
},
{
"source_name": "XENOTIME",
"description": "The activity group XENOTIME, as defined by Dragos, has overlaps with activity reported upon by FireEye about TEMP.Veles as well as the actors behind [TRITON](https://attack.mitre.org/software/S0609).(Citation: Dragos Xenotime 2018)(Citation: Pylos Xenotime 2019)(Citation: FireEye TRITON 2019)(Citation: FireEye TEMP.Veles 2018)"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Dragos Threat Intelligence"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:41.930000+00:00\", \"old_value\": \"2024-04-17 16:13:43.697000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.4"
},
{
"type": "intrusion-set",
"id": "intrusion-set--35d1b3be-49d4-42f1-aaa6-ef159c880bca",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-10-01 01:57:31.229000+00:00",
"modified": "2026-07-31 18:47:48.259000+00:00",
"name": "TeamTNT",
"description": "[TeamTNT](https://attack.mitre.org/groups/G0139) is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.(Citation: Palo Alto Black-T October 2020)(Citation: Lacework TeamTNT May 2021)(Citation: Intezer TeamTNT September 2020)(Citation: Cado Security TeamTNT Worm August 2020)(Citation: Unit 42 Hildegard Malware)(Citation: Trend Micro TeamTNT)(Citation: ATT TeamTNT Chimaera September 2020)(Citation: Aqua TeamTNT August 2020)(Citation: Intezer TeamTNT Explosion September 2021)",
"aliases": [
"TeamTNT"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0139",
"external_id": "G0139"
},
{
"source_name": "ATT TeamTNT Chimaera September 2020",
"description": "AT&T Alien Labs. (2021, September 8). TeamTNT with new campaign aka Chimaera. Retrieved September 22, 2021.",
"url": "https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera"
},
{
"source_name": "Cado Security TeamTNT Worm August 2020",
"description": "Cado Security. (2020, August 16). Team TNT \u2013 The First Crypto-Mining Worm to Steal AWS Credentials. Retrieved September 22, 2021.",
"url": "https://www.cadosecurity.com/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials/"
},
{
"source_name": "Unit 42 Hildegard Malware",
"description": "Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.",
"url": "https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"
},
{
"source_name": "Trend Micro TeamTNT",
"description": "Fiser, D. Oliveira, A. (n.d.). Tracking the Activities of TeamTNT A Closer Look at a Cloud-Focused Malicious Actor Group. Retrieved September 22, 2021.",
"url": "https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"
},
{
"source_name": "Intezer TeamTNT September 2020",
"description": "Fishbein, N. (2020, September 8). Attackers Abusing Legitimate Cloud Monitoring Tools to Conduct Cyber Attacks. Retrieved September 22, 2021.",
"url": "https://www.intezer.com/blog/cloud-security/attackers-abusing-legitimate-cloud-monitoring-tools-to-conduct-cyber-attacks/"
},
{
"source_name": "Intezer TeamTNT Explosion September 2021",
"description": "Intezer. (2021, September 1). TeamTNT Cryptomining Explosion. Retrieved October 15, 2021.",
"url": "https://www.intezer.com/wp-content/uploads/2021/09/TeamTNT-Cryptomining-Explosion.pdf"
},
{
"source_name": "Aqua TeamTNT August 2020",
"description": "Kol, Roi. Morag, A. (2020, August 25). Deep Analysis of TeamTNT Techniques Using Container Images to Attack. Retrieved September 22, 2021.",
"url": "https://blog.aquasec.com/container-security-tnt-container-attack"
},
{
"source_name": "Palo Alto Black-T October 2020",
"description": "Quist, N. (2020, October 5). Black-T: New Cryptojacking Variant from TeamTNT. Retrieved September 22, 2021.",
"url": "https://unit42.paloaltonetworks.com/black-t-cryptojacking-variant/"
},
{
"source_name": "Lacework TeamTNT May 2021",
"description": "Stroud, J. (2021, May 25). Taking TeamTNT's Docker Images Offline. Retrieved September 16, 2024.",
"url": "https://www.lacework.com/blog/taking-teamtnt-docker-images-offline"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Will Thomas, Cyjax",
"Darin Smith, Cisco"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:48.259000+00:00\", \"old_value\": \"2025-10-22 03:04:28.916000+00:00\"}}}",
"previous_version": "1.4"
},
{
"type": "intrusion-set",
"id": "intrusion-set--6688d679-ccdb-4f12-abf6-c7545dd767a4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-05-02 00:08:18.314000+00:00",
"modified": "2026-07-31 18:47:59.296000+00:00",
"name": "The White Company",
"description": "[The White Company](https://attack.mitre.org/groups/G0089) is a likely state-sponsored threat actor with advanced capabilities. From 2017 through 2018, the group led an espionage campaign called Operation Shaheen targeting government and military organizations in Pakistan.(Citation: Cylance Shaheen Nov 2018)",
"aliases": [
"The White Company"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0089",
"external_id": "G0089"
},
{
"source_name": "Cylance Shaheen Nov 2018",
"description": "Livelli, K, et al. (2018, November 12). Operation Shaheen. Retrieved May 1, 2019.",
"url": "https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:59.296000+00:00\", \"old_value\": \"2025-04-25 14:49:32.865000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--d519164e-f5fa-4b8c-a1fb-cf0172ad0983",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:59.120000+00:00",
"modified": "2026-07-31 18:48:20.978000+00:00",
"name": "Threat Group-1314",
"description": "[Threat Group-1314](https://attack.mitre.org/groups/G0028) is an unattributed threat group that has used compromised credentials to log into a victim's remote access infrastructure. (Citation: Dell TG-1314)",
"aliases": [
"Threat Group-1314",
"TG-1314"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0028",
"external_id": "G0028"
},
{
"source_name": "Threat Group-1314",
"description": "(Citation: Dell TG-1314)"
},
{
"source_name": "TG-1314",
"description": "(Citation: Dell TG-1314)"
},
{
"source_name": "Dell TG-1314",
"description": "Dell SecureWorks Counter Threat Unit Special Operations Team. (2015, May 28). Living off the Land. Retrieved January 26, 2016.",
"url": "https://web.archive.org/web/20150626073312/http://www.secureworks.com/resources/blog/living-off-the-land/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:20.978000+00:00\", \"old_value\": \"2026-01-20 16:07:46.964000+00:00\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--fb366179-766c-4a4a-afa1-52bff1fd601c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:58.518000+00:00",
"modified": "2026-07-31 18:48:27.731000+00:00",
"name": "Threat Group-3390",
"description": "[Threat Group-3390](https://attack.mitre.org/groups/G0027) is a Chinese threat group that has extensively used strategic Web compromises to target victims.(Citation: Dell TG-3390) The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Securelist LuckyMouse June 2018)(Citation: Trend Micro DRBControl February 2020)",
"aliases": [
"Threat Group-3390",
"Earth Smilodon",
"TG-3390",
"Emissary Panda",
"BRONZE UNION",
"APT27",
"Iron Tiger",
"LuckyMouse",
"Linen Typhoon"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0027",
"external_id": "G0027"
},
{
"source_name": "Threat Group-3390",
"description": "(Citation: Dell TG-3390)(Citation: Hacker News LuckyMouse June 2018)"
},
{
"source_name": "TG-3390",
"description": "(Citation: Dell TG-3390)(Citation: Nccgroup Emissary Panda May 2018)(Citation: Hacker News LuckyMouse June 2018)"
},
{
"source_name": "Emissary Panda",
"description": "(Citation: Gallagher 2015)(Citation: Nccgroup Emissary Panda May 2018)(Citation: Securelist LuckyMouse June 2018)(Citation: Hacker News LuckyMouse June 2018)(Citation: Unit42 Emissary Panda May 2019)(Citation: Trend Micro Iron Tiger April 2021)"
},
{
"source_name": "Iron Tiger",
"description": "(Citation: Hacker News LuckyMouse June 2018)(Citation: Trend Micro Iron Tiger April 2021)"
},
{
"source_name": "Linen Typhoon",
"description": "(Citation: Microsoft Naming Conventions Frequently Updated)"
},
{
"source_name": "APT27",
"description": "(Citation: Nccgroup Emissary Panda May 2018)(Citation: Securelist LuckyMouse June 2018)(Citation: Hacker News LuckyMouse June 2018)(Citation: Trend Micro Iron Tiger April 2021)"
},
{
"source_name": "LuckyMouse",
"description": "(Citation: Securelist LuckyMouse June 2018)(Citation: Hacker News LuckyMouse June 2018)(Citation: Trend Micro Iron Tiger April 2021)"
},
{
"source_name": "BRONZE UNION",
"description": "(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Nccgroup Emissary Panda May 2018)"
},
{
"source_name": "Earth Smilodon",
"description": "(Citation: Trend Micro Iron Tiger April 2021)"
},
{
"source_name": "SecureWorks BRONZE UNION June 2017",
"description": "Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017.",
"url": "https://www.secureworks.com/research/bronze-union"
},
{
"source_name": "Dell TG-3390",
"description": "Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018.",
"url": "https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"
},
{
"source_name": "Unit42 Emissary Panda May 2019",
"description": "Falcone, R. and Lancaster, T. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019.",
"url": "https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/"
},
{
"source_name": "Gallagher 2015",
"description": "Gallagher, S.. (2015, August 5). Newly discovered Chinese hacking group hacked 100+ websites to use as \u201cwatering holes\u201d. Retrieved January 25, 2016.",
"url": "http://arstechnica.com/security/2015/08/newly-discovered-chinese-hacking-group-hacked-100-websites-to-use-as-watering-holes/"
},
{
"source_name": "Hacker News LuckyMouse June 2018",
"description": "Khandelwal, S. (2018, June 14). Chinese Hackers Carried Out Country-Level Watering Hole Attack. Retrieved August 18, 2018.",
"url": "https://thehackernews.com/2018/06/chinese-watering-hole-attack.html"
},
{
"source_name": "Securelist LuckyMouse June 2018",
"description": "Legezo, D. (2018, June 13). LuckyMouse hits national data center to organize country-level waterholing campaign. Retrieved August 18, 2018.",
"url": "https://securelist.com/luckymouse-hits-national-data-center/86083/"
},
{
"source_name": "Trend Micro Iron Tiger April 2021",
"description": "Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.",
"url": "https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"
},
{
"source_name": "Trend Micro DRBControl February 2020",
"description": "Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.",
"url": "https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"
},
{
"source_name": "Microsoft Naming Conventions Frequently Updated",
"description": "Microsoft. (2025, September 8). How Microsoft names threat actors. Retrieved September 10, 2025.",
"url": "https://learn.microsoft.com/en-us/unified-secops-platform/microsoft-threat-actor-naming"
},
{
"source_name": "Nccgroup Emissary Panda May 2018",
"description": "Pantazopoulos, N., Henry T. (2018, May 18). Emissary Panda \u2013 A potential new malicious tool. Retrieved June 25, 2018.",
"url": "https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Daniyal Naeem, BT Security",
"Kyaw Pyiyt Htet, @KyawPyiytHtet"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:27.731000+00:00\", \"old_value\": \"2025-10-15 20:24:59.798000+00:00\"}}}",
"previous_version": "3.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--d69e568e-9ac8-4c08-b32c-d93b43ba9172",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-10-17 00:14:20.652000+00:00",
"modified": "2026-07-31 18:48:21.405000+00:00",
"name": "Thrip",
"description": "[Thrip](https://attack.mitre.org/groups/G0076) is an espionage group that has targeted satellite communications, telecoms, and defense contractor companies in the U.S. and Southeast Asia. The group uses custom malware as well as \"living off the land\" techniques. (Citation: Symantec Thrip June 2018)",
"aliases": [
"Thrip"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0076",
"external_id": "G0076"
},
{
"source_name": "Thrip",
"description": "(Citation: Symantec Thrip June 2018)"
},
{
"source_name": "Symantec Thrip June 2018",
"description": "Security Response Attack Investigation Team. (2018, June 19). Thrip: Espionage Group Hits Satellite, Telecoms, and Defense Companies. Retrieved July 10, 2018.",
"url": "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:21.405000+00:00\", \"old_value\": \"2025-04-25 14:49:36.307000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--b516b235-fc7d-4635-aca5-3d33312339c3",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-01-03 21:34:10.988000+00:00",
"modified": "2026-07-31 18:48:13.519000+00:00",
"name": "ToddyCat",
"description": "[ToddyCat](https://attack.mitre.org/groups/G1022) is a sophisticated threat group that has been active since at least 2020 using custom loaders and malware in multi-stage infection chains against government and military targets across Europe and Asia.(Citation: Kaspersky ToddyCat June 2022)(Citation: Kaspersky ToddyCat Check Logs October 2023)",
"aliases": [
"ToddyCat"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1022",
"external_id": "G1022"
},
{
"source_name": "Kaspersky ToddyCat June 2022",
"description": "Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.",
"url": "https://securelist.com/toddycat/106799/"
},
{
"source_name": "Kaspersky ToddyCat Check Logs October 2023",
"description": "Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.",
"url": "https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:13.519000+00:00\", \"old_value\": \"2024-02-14 20:35:53.080000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--c5b81590-6814-4d2a-8baa-15c4b6c7f960",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-05-05 17:18:25.987000+00:00",
"modified": "2026-07-31 18:48:18.168000+00:00",
"name": "Tonto Team",
"description": "[Tonto Team](https://attack.mitre.org/groups/G0131) is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. [Tonto Team](https://attack.mitre.org/groups/G0131) has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).(Citation: Kaspersky CactusPete Aug 2020)(Citation: ESET Exchange Mar 2021)(Citation: FireEye Chinese Espionage October 2019)(Citation: ARS Technica China Hack SK April 2017)(Citation: Trend Micro HeartBeat Campaign January 2013)(Citation: Talos Bisonal 10 Years March 2020)",
"aliases": [
"Tonto Team",
"Earth Akhlut",
"BRONZE HUNTLEY",
"CactusPete",
"Karma Panda"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0131",
"external_id": "G0131"
},
{
"source_name": "CactusPete",
"description": "(Citation: Kaspersky CactusPete Aug 2020)"
},
{
"source_name": "Karma Panda",
"description": "(Citation: Kaspersky CactusPete Aug 2020)(Citation: CrowdStrike Manufacturing Threat July 2020)"
},
{
"source_name": "BRONZE HUNTLEY",
"description": "(Citation: Secureworks BRONZE HUNTLEY )"
},
{
"source_name": "Tonto Team",
"description": "(Citation: Talos Bisonal Mar 2020) "
},
{
"source_name": "Earth Akhlut",
"description": "(Citation: TrendMicro Tonto Team October 2020)"
},
{
"source_name": "TrendMicro Tonto Team October 2020",
"description": "Daniel Lughi, Jaromir Horejsi. (2020, October 2). Tonto Team - Exploring the TTPs of an advanced threat actor operating a large infrastructure. Retrieved October 17, 2021.",
"url": "https://vb2020.vblocalhost.com/uploads/VB2020-06.pdf"
},
{
"source_name": "CrowdStrike Manufacturing Threat July 2020",
"description": "Falcon OverWatch Team. (2020, July 14). Manufacturing Industry in the Adversaries\u2019 Crosshairs. Retrieved October 17, 2021.",
"url": "https://www.crowdstrike.com/blog/adversaries-targeting-the-manufacturing-industry/"
},
{
"source_name": "ESET Exchange Mar 2021",
"description": "Faou, M., Tartare, M., Dupuy, T. (2021, March 10). Exchange servers under siege from at least 10 APT groups. Retrieved May 21, 2021.",
"url": "https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/"
},
{
"source_name": "Talos Bisonal Mar 2020",
"description": "Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.",
"url": "https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"
},
{
"source_name": "FireEye Chinese Espionage October 2019",
"description": "Nalani Fraser, Kelli Vanderlee. (2019, October 10). Achievement Unlocked - Chinese Cyber Espionage Evolves to Support Higher Level Missions. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20210308054208/https://www.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf"
},
{
"source_name": "Trend Micro HeartBeat Campaign January 2013",
"description": "Roland Dela Paz. (2003, January 3). The HeartBeat APT Campaign. Retrieved October 17, 2021.",
"url": "https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the-heartbeat-apt-campaign.pdf?"
},
{
"source_name": "ARS Technica China Hack SK April 2017",
"description": "Sean Gallagher. (2017, April 21). Researchers claim China trying to hack South Korea missile defense efforts. Retrieved October 17, 2021.",
"url": "https://arstechnica.com/information-technology/2017/04/researchers-claim-china-trying-to-hack-south-korea-missile-defense-efforts/"
},
{
"source_name": "Secureworks BRONZE HUNTLEY ",
"description": "Secureworks. (2021, January 1). BRONZE HUNTLEY Threat Profile. Retrieved May 5, 2021.",
"url": "https://www.secureworks.com/research/threat-profiles/bronze-huntley"
},
{
"source_name": "Talos Bisonal 10 Years March 2020",
"description": "Warren Mercer, Paul Rascagneres, Vitor Ventura. (2020, March 6). Bisonal 10 Years of Play. Retrieved October 17, 2021.",
"url": "https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"
},
{
"source_name": "Kaspersky CactusPete Aug 2020",
"description": "Zykov, K. (2020, August 13). CactusPete APT group\u2019s updated Bisonal backdoor. Retrieved May 5, 2021.",
"url": "https://securelist.com/cactuspete-apt-groups-updated-bisonal-backdoor/97962/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:18.168000+00:00\", \"old_value\": \"2024-11-17 16:30:03.375000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--e44e0985-bc65-4a8f-b578-211c858128e3",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-09-02 15:14:33.738000+00:00",
"modified": "2026-07-31 18:48:23.430000+00:00",
"name": "Transparent Tribe",
"description": "[Transparent Tribe](https://attack.mitre.org/groups/G0134) is a suspected Pakistan-based threat group that has been active since at least 2013, primarily targeting diplomatic, defense, and research organizations in India and Afghanistan.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Talos Transparent Tribe May 2021)",
"aliases": [
"Transparent Tribe",
"COPPER FIELDSTONE",
"APT36",
"Mythic Leopard",
"ProjectM"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0134",
"external_id": "G0134"
},
{
"source_name": "Mythic Leopard",
"description": "(Citation: Crowdstrike Mythic Leopard Profile)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Talos Transparent Tribe May 2021)"
},
{
"source_name": "COPPER FIELDSTONE",
"description": "(Citation: Secureworks COPPER FIELDSTONE Profile)"
},
{
"source_name": "APT36",
"description": "(Citation: Talos Transparent Tribe May 2021)"
},
{
"source_name": "ProjectM",
"description": "(Citation: Unit 42 ProjectM March 2016)(Citation: Kaspersky Transparent Tribe August 2020)"
},
{
"source_name": "Crowdstrike Mythic Leopard Profile",
"description": "Crowdstrike. (n.d.). Mythic Leopard. Retrieved October 6, 2021.",
"url": "https://adversary.crowdstrike.com/en-US/adversary/mythic-leopard/"
},
{
"source_name": "Kaspersky Transparent Tribe August 2020",
"description": "Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.",
"url": "https://securelist.com/transparent-tribe-part-1/98127/"
},
{
"source_name": "Unit 42 ProjectM March 2016",
"description": "Falcone, R. and Conant S. (2016, March 25). ProjectM: Link Found Between Pakistani Actor and Operation Transparent Tribe. Retrieved September 2, 2021.",
"url": "https://unit42.paloaltonetworks.com/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"
},
{
"source_name": "Proofpoint Operation Transparent Tribe March 2016",
"description": "Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.",
"url": "https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"
},
{
"source_name": "Talos Transparent Tribe May 2021",
"description": "Malhotra, A. et al. (2021, May 13). Transparent Tribe APT expands its Windows malware arsenal. Retrieved September 2, 2021.",
"url": "https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html"
},
{
"source_name": "Secureworks COPPER FIELDSTONE Profile",
"description": "Secureworks. (n.d.). COPPER FIELDSTONE. Retrieved October 6, 2021.",
"url": "https://www.secureworks.com/research/threat-profiles/copper-fieldstone"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Manikantan Srinivasan, NEC Corporation India",
"Pooja Natarajan, NEC Corporation India",
"Hiroki Nagahama, NEC Corporation"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:23.430000+00:00\", \"old_value\": \"2024-04-10 22:30:51.062000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--56319646-eb6e-41fc-ae53-aadfa7adb924",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-01-29 20:17:48.717000+00:00",
"modified": "2026-07-31 18:47:56.506000+00:00",
"name": "Tropic Trooper",
"description": "[Tropic Trooper](https://attack.mitre.org/groups/G0081) is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. [Tropic Trooper](https://attack.mitre.org/groups/G0081) focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)",
"aliases": [
"Tropic Trooper",
"Pirate Panda",
"KeyBoy"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0081",
"external_id": "G0081"
},
{
"source_name": "Pirate Panda",
"description": "(Citation: Crowdstrike Pirate Panda April 2020)"
},
{
"source_name": "Tropic Trooper",
"description": "(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: Unit 42 Tropic Trooper Nov 2016)"
},
{
"source_name": "KeyBoy",
"description": "(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper Mar 2018)"
},
{
"source_name": "Crowdstrike Pirate Panda April 2020",
"description": "Busselen, M. (2020, April 7). On-demand Webcast: CrowdStrike Experts on COVID-19 Cybersecurity Challenges and Recommendations. Retrieved May 20, 2020.",
"url": "https://www.crowdstrike.com/blog/on-demand-webcast-crowdstrike-experts-on-covid-19-cybersecurity-challenges-and-recommendations/"
},
{
"source_name": "TrendMicro Tropic Trooper May 2020",
"description": "Chen, J.. (2020, May 12). Tropic Trooper\u2019s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.",
"url": "https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"
},
{
"source_name": "TrendMicro Tropic Trooper Mar 2018",
"description": "Horejsi, J., et al. (2018, March 14). Tropic Trooper\u2019s New Strategy. Retrieved November 9, 2018.",
"url": "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
},
{
"source_name": "Unit 42 Tropic Trooper Nov 2016",
"description": "Ray, V. (2016, November 22). Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy. Retrieved November 9, 2018.",
"url": "https://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Edward Millington"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.6",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:56.506000+00:00\", \"old_value\": \"2025-10-21 23:19:38.101000+00:00\"}}}",
"previous_version": "1.6"
},
{
"type": "intrusion-set",
"id": "intrusion-set--7a19ecb1-3c65-4de3-a230-993516aed6a6",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:49.816000+00:00",
"modified": "2026-07-31 18:48:02.956000+00:00",
"name": "Turla",
"description": "[Turla](https://attack.mitre.org/groups/G0010) is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. [Turla](https://attack.mitre.org/groups/G0010) is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as [Uroburos](https://attack.mitre.org/software/S0022).(Citation: Kaspersky Turla)(Citation: ESET Gazer Aug 2017)(Citation: CrowdStrike VENOMOUS BEAR)(Citation: ESET Turla Mosquito Jan 2018)(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)",
"aliases": [
"Turla",
"IRON HUNTER",
"Group 88",
"Waterbug",
"WhiteBear",
"Snake",
"Krypton",
"Venomous Bear",
"Secret Blizzard",
"BELUGASTURGEON"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0010",
"external_id": "G0010"
},
{
"source_name": "BELUGASTURGEON",
"description": "(Citation: Accenture HyperStack October 2020)"
},
{
"source_name": "Krypton",
"description": "(Citation: CrowdStrike VENOMOUS BEAR)"
},
{
"source_name": "Snake",
"description": "(Citation: CrowdStrike VENOMOUS BEAR)(Citation: ESET Turla PowerShell May 2019)(Citation: Talos TinyTurla September 2021)"
},
{
"source_name": "Venomous Bear",
"description": "(Citation: CrowdStrike VENOMOUS BEAR)(Citation: Talos TinyTurla September 2021)"
},
{
"source_name": "Turla",
"description": "(Citation: Kaspersky Turla)"
},
{
"source_name": "Group 88",
"description": "(Citation: Leonardo Turla Penquin May 2020)"
},
{
"source_name": "Secret Blizzard",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "IRON HUNTER",
"description": "(Citation: Secureworks IRON HUNTER Profile)"
},
{
"source_name": "Accenture HyperStack October 2020",
"description": "Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020.",
"url": "https://web.archive.org/web/20201101015247/https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity"
},
{
"source_name": "Waterbug",
"description": "Based similarity in TTPs and malware used, Turla and Waterbug appear to be the same group.(Citation: Symantec Waterbug)"
},
{
"source_name": "Talos TinyTurla September 2021",
"description": "Cisco Talos. (2021, September 21). TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines. Retrieved December 2, 2021.",
"url": "https://blog.talosintelligence.com/2021/09/tinyturla.html"
},
{
"source_name": "ESET Turla Mosquito Jan 2018",
"description": "ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.",
"url": "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
},
{
"source_name": "ESET Gazer Aug 2017",
"description": "ESET. (2017, August). Gazing at Gazer: Turla\u2019s new second stage backdoor. Retrieved September 14, 2017.",
"url": "https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf"
},
{
"source_name": "ESET Turla PowerShell May 2019",
"description": "Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.",
"url": "https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"
},
{
"source_name": "Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023",
"description": "FBI et al. (2023, May 9). Hunting Russian Intelligence \u201cSnake\u201d Malware. Retrieved June 8, 2023.",
"url": "https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"
},
{
"source_name": "Securelist WhiteBear Aug 2017",
"description": "Kaspersky Lab's Global Research & Analysis Team. (2017, August 30). Introducing WhiteBear. Retrieved September 21, 2017.",
"url": "https://securelist.com/introducing-whitebear/81638/"
},
{
"source_name": "Kaspersky Turla",
"description": "Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.",
"url": "https://securelist.com/the-epic-turla-operation/65545/"
},
{
"source_name": "Leonardo Turla Penquin May 2020",
"description": "Leonardo. (2020, May 29). MALWARE TECHNICAL INSIGHT TURLA \u201cPenquin_x64\u201d. Retrieved March 11, 2021.",
"url": "https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf"
},
{
"source_name": "CrowdStrike VENOMOUS BEAR",
"description": "Meyers, A. (2018, March 12). Meet CrowdStrike\u2019s Adversary of the Month for March: VENOMOUS BEAR. Retrieved May 16, 2018.",
"url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-march-venomous-bear/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Secureworks IRON HUNTER Profile",
"description": "Secureworks CTU. (n.d.). IRON HUNTER. Retrieved February 22, 2022.",
"url": "http://www.secureworks.com/research/threat-profiles/iron-hunter"
},
{
"source_name": "Symantec Waterbug",
"description": "Symantec. (2015, January 26). The Waterbug attack group. Retrieved April 10, 2015.",
"url": "https://www.threatminer.org/report.php?q=waterbug-attack-group.pdf&y=2015#gsc.tab=0&gsc.q=waterbug-attack-group.pdf&gsc.page=1"
},
{
"source_name": "WhiteBear",
"description": "WhiteBear is a designation used by Securelist to describe a cluster of activity that has overlaps with activity described by others as Turla, but appears to have a separate focus.(Citation: Securelist WhiteBear Aug 2017)(Citation: Talos TinyTurla September 2021)"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Matthieu Faou, ESET",
"Edward Millington"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "5.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:02.956000+00:00\", \"old_value\": \"2026-01-20 15:11:37.732000+00:00\"}}}",
"previous_version": "5.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--461b8e25-8f4a-4ea2-a4a8-e39df7ce6630",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-05-29 20:48:42.051000+00:00",
"modified": "2026-07-31 18:47:52.855000+00:00",
"name": "UNC3886",
"description": "[UNC3886](https://attack.mitre.org/groups/G1048) is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. [UNC3886](https://attack.mitre.org/groups/G1048) has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.(Citation: Mandiant Fortinet Zero Day)(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023)",
"aliases": [
"UNC3886"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1048",
"external_id": "G1048"
},
{
"source_name": "Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023",
"description": "Alexander Marvi, Brad Slaybaugh, Ron Craft, and Rufus Brown. (2023, June 13). VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors. Retrieved March 26, 2025.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"
},
{
"source_name": "Mandiant Fortinet Zero Day",
"description": "Marvi, A. et al.. (2023, March 16). Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation. Retrieved March 22, 2023.",
"url": "https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:52.855000+00:00\", \"old_value\": \"2025-10-24 03:55:02.289000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--ebd7ce77-c9ba-4fba-bb28-58296ac66559",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-20 15:16:16.697000+00:00",
"modified": "2026-07-31 18:48:24.451000+00:00",
"name": "VOID MANTICORE",
"description": "[VOID MANTICORE](https://attack.mitre.org/groups/G1055) is a threat group assessed to operate on behalf of Iran\u2019s Ministry of Intelligence and Security (MOIS).(Citation: Check Point VOID MANTICORE Handala Hack March 2026) Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States.(Citation: Check Point VOID MANTICORE Handala Hack March 2026)(Citation: Palo Alto VOID MANTICORE Iran Cyber Threats March 2026) [VOID MANTICORE](https://attack.mitre.org/groups/G1055) conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including [HomeLand Justice](https://attack.mitre.org/campaigns/C0038) in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation.(Citation: Check Point VOID MANTICORE Handala Hack March 2026)(Citation: DOJ FBI Handala Hack March 2026) [VOID MANTICORE](https://attack.mitre.org/groups/G1055) has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE\u2019s activity.(Citation: Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026) ",
"aliases": [
"VOID MANTICORE",
"COBALT MYSTIQUE",
"Handala Hack",
"Homeland Justice",
"Karma",
"Karmabelow80",
"BANISHED KITTEN",
"Red Sandstorm"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1055",
"external_id": "G1055"
},
{
"source_name": "BANISHED KITTEN",
"description": "(Citation: Check Point VOID MANTICORE Handala Hack March 2026)"
},
{
"source_name": "Red Sandstorm",
"description": "(Citation: Check Point VOID MANTICORE Handala Hack March 2026)"
},
{
"source_name": "Handala Hack",
"description": "(Citation: DOJ FBI Handala Hack March 2026)"
},
{
"source_name": "Homeland Justice",
"description": "(Citation: DOJ FBI Handala Hack March 2026)"
},
{
"source_name": "Karma",
"description": "(Citation: DOJ FBI Handala Hack March 2026)"
},
{
"source_name": "COBALT MYSTIQUE",
"description": "(Citation: Sophos VOID MANTICORE COBALT MYSTIQUE other Names April 2026)"
},
{
"source_name": "Karmabelow80",
"description": "(Citation: Sophos VOID MANTICORE COBALT MYSTIQUE other Names April 2026)"
},
{
"source_name": "Check Point VOID MANTICORE Handala Hack March 2026",
"description": "Check Point Research. (2026, March 12). \u201cHandala Hack\u201d \u2013 Unveiling Group\u2019s Modus Operandi. Retrieved April 20, 2026.",
"url": "https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"
},
{
"source_name": "DOJ FBI Handala Hack March 2026",
"description": "DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.",
"url": "https://www.justice.gov/opa/media/1431956/dl?inline"
},
{
"source_name": "Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026",
"description": "DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.",
"url": "https://dti.domaintools.com/research/handala-mois-linked-cyber-influence-ecosystem-threat-intelligence-assessment"
},
{
"source_name": "Palo Alto VOID MANTICORE Iran Cyber Threats March 2026",
"description": "Justin Moore. (2026, March 16). Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization. Retrieved April 20, 2026.",
"url": "https://unit42.paloaltonetworks.com/evolution-of-iran-cyber-threats/"
},
{
"source_name": "Sophos VOID MANTICORE COBALT MYSTIQUE other Names April 2026",
"description": "Sophos. (2026, April 20). Iran COBALT MYSTIQUE. Retrieved April 20, 2026.",
"url": "https://www.sophos.com/en-us/threat-profiles/cobalt-mystique"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:24.451000+00:00\", \"old_value\": \"2026-05-12 16:30:18.375000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--e1fc262c-dad2-4b82-abda-5f08dd134971",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-03-14 19:21:17.470000+00:00",
"modified": "2026-07-31 18:48:23.128000+00:00",
"name": "Velvet Ant",
"description": "[Velvet Ant](https://attack.mitre.org/groups/G1047) is a threat actor operating since at least 2021. [Velvet Ant](https://attack.mitre.org/groups/G1047) is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploits.(Citation: Sygnia VelvetAnt 2024A)(Citation: Sygnia VelvetAnt 2024B)",
"aliases": [
"Velvet Ant"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1047",
"external_id": "G1047"
},
{
"source_name": "Sygnia VelvetAnt 2024B",
"description": "Sygnia Team. (2024, July 1). China-Nexus Threat Group \u2018Velvet Ant\u2019 Exploits Cisco Zero-Day (CVE-2024-20399) to Compromise Nexus Switch Devices \u2013 Advisory for Mitigation and Response. Retrieved March 14, 2025.",
"url": "https://www.sygnia.co/threat-reports-and-advisories/china-nexus-threat-group-velvet-ant-exploits-cisco-0-day/"
},
{
"source_name": "Sygnia VelvetAnt 2024A",
"description": "Sygnia Team. (2024, June 3). China-Nexus Threat Group \u2018Velvet Ant\u2019 Abuses F5 Load Balancers for Persistence. Retrieved March 14, 2025.",
"url": "https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Oren Biderman, Sygnia",
"Amnon Kushnir, Sygnia"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:23.128000+00:00\", \"old_value\": \"2025-04-04 17:24:17.983000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--b2e34388-6938-4c59-a702-80dc219e15e3",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-02-08 20:30:30.578000+00:00",
"modified": "2026-07-31 18:48:12.835000+00:00",
"name": "Volatile Cedar",
"description": "[Volatile Cedar](https://attack.mitre.org/groups/G0123) is a Lebanese threat group that has targeted individuals, companies, and institutions worldwide. [Volatile Cedar](https://attack.mitre.org/groups/G0123) has been operating since 2012 and is motivated by political and ideological interests.(Citation: CheckPoint Volatile Cedar March 2015)(Citation: ClearSky Lebanese Cedar Jan 2021)",
"aliases": [
"Volatile Cedar",
"Lebanese Cedar"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0123",
"external_id": "G0123"
},
{
"source_name": "Volatile Cedar",
"description": "(Citation: CheckPoint Volatile Cedar March 2015)"
},
{
"source_name": "Lebanese Cedar",
"description": "(Citation: ClearSky Lebanese Cedar Jan 2021)"
},
{
"source_name": "ClearSky Lebanese Cedar Jan 2021",
"description": "ClearSky Cyber Security. (2021, January). \u201cLebanese Cedar\u201d APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.",
"url": "https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"
},
{
"source_name": "CheckPoint Volatile Cedar March 2015",
"description": "Threat Intelligence and Research. (2015, March 30). VOLATILE CEDAR. Retrieved February 8, 2021.",
"url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:12.835000+00:00\", \"old_value\": \"2025-04-16 20:37:38.546000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--174279b4-399f-4ddb-966e-5efedd1dd5f2",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-07-27 20:35:46.206000+00:00",
"modified": "2026-07-31 18:47:38.941000+00:00",
"name": "Volt Typhoon",
"description": "[Volt Typhoon](https://attack.mitre.org/groups/G1017) is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. [Volt Typhoon](https://attack.mitre.org/groups/G1017)'s targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. [Volt Typhoon](https://attack.mitre.org/groups/G1017) has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)(Citation: Microsoft Volt Typhoon May 2023)(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)(Citation: Secureworks BRONZE SILHOUETTE May 2023). The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.(Citation: DOJ KVBotnet 2024). \n\nReporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to [Volt Typhoon](https://attack.mitre.org/groups/G1017), also tracked as VOLTZITE, for follow-on operations. (Citation: Dragos 2025 Year in Review)",
"aliases": [
"Volt Typhoon",
"BRONZE SILHOUETTE",
"Vanguard Panda",
"DEV-0391",
"UNC3236",
"Voltzite",
"Insidious Taurus",
"DazedToad"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1017",
"external_id": "G1017"
},
{
"source_name": "Cloudflare 2026 Threat Report New Threat Actors March 2026",
"description": " Cloudflare. (2026, March 3). Introducing the 2026 Cloudflare Threat Report. Retrieved April 18, 2026.",
"url": "https://blog.cloudflare.com/2026-threat-report/"
},
{
"source_name": "Vanguard Panda",
"description": "(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)"
},
{
"source_name": "DEV-0391",
"description": "(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)"
},
{
"source_name": "UNC3236",
"description": "(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)"
},
{
"source_name": "Voltzite",
"description": "(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)"
},
{
"source_name": "Insidious Taurus",
"description": "(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)"
},
{
"source_name": "DazedToad",
"description": "(Citation: Cloudflare 2026 Threat Report New Threat Actors March 2026)"
},
{
"source_name": "BRONZE SILHOUETTE",
"description": "(Citation: Secureworks BRONZE SILHOUETTE May 2023)(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)"
},
{
"source_name": "CISA AA24-038A PRC Critical Infrastructure February 2024",
"description": "CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.",
"url": "https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"
},
{
"source_name": "Secureworks BRONZE SILHOUETTE May 2023",
"description": "Counter Threat Unit Research Team. (2023, May 24). Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations. Retrieved July 27, 2023.",
"url": "https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"
},
{
"source_name": "Dragos 2025 Year in Review",
"description": "Dragos. (2026, February). 9TH ANNUAL YEAR IN REVIEW | OT/ICS CYBERSECURITY REPORT . Retrieved April 26, 2026.",
"url": "https://5943619.hs-sites.com/hubfs/312-Year-in-Review/2026/Dragos-2026-OT-Cybersecurity-Report-A-Year-in-Review.pdf?hsCtaAttrib=205683189348"
},
{
"source_name": "Microsoft Volt Typhoon May 2023",
"description": "Microsoft Threat Intelligence. (2023, May 24). Volt Typhoon targets US critical infrastructure with living-off-the-land techniques. Retrieved July 27, 2023.",
"url": "https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"
},
{
"source_name": "Joint Cybersecurity Advisory Volt Typhoon June 2023",
"description": "NSA et al. (2023, May 24). People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection. Retrieved July 27, 2023.",
"url": "https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"
},
{
"source_name": "DOJ KVBotnet 2024",
"description": "US Department of Justice. (2024, January 31). U.S. Government Disrupts Botnet People\u2019s Republic of China Used to Conceal Hacking of Critical Infrastructure. Retrieved June 10, 2024.",
"url": "https://www.justice.gov/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Ai Kimura, NEC Corporation",
"Manikantan Srinivasan, NEC Corporation India",
"Phyo Paing Htun (ChiLai), I-Secure Co.,Ltd",
"Pooja Natarajan, NEC Corporation India",
"Vlad Shumaher, Palo Alto Networks"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:38.941000+00:00\", \"old_value\": \"2026-04-27 03:57:23.174000+00:00\"}}}",
"previous_version": "2.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--f8cb7b36-62ef-4488-8a6d-a7033e3271c1",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-05-24 17:02:44.226000+00:00",
"modified": "2026-07-31 20:48:52.082000+00:00",
"name": "WIRTE",
"description": "[WIRTE](https://attack.mitre.org/groups/G0090) is a cyberespionage actor, believed to be a subgroup of the Hamas-affiliated Gaza Cybergang, that has been active since at least August 2018. [WIRTE](https://attack.mitre.org/groups/G0090) has targeted diplomatic, financial, military, legal, and technology organizations across the Middle East, North Africa, and in Europe to gather intelligence. [WIRTE](https://attack.mitre.org/groups/G0090) has remained persistently active despite the ongoing Israel-Hamas conflict and has expanded their operations to include wiper malware attacks against Israeli targets.(Citation: Lab52 WIRTE Apr 2019)(Citation: Kaspersky WIRTE November 2021)(Citation: Check Point Wirte NOV 2024)(Citation: Palo Alto Ashen Lepus DEC 2025)",
"aliases": [
"WIRTE",
"Ashen Lepus"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0090",
"external_id": "G0090"
},
{
"source_name": "WIRTE",
"description": "(Citation: Lab52 WIRTE Apr 2019)"
},
{
"source_name": "Ashen Lepus",
"description": "(Citation: Palo Alto Ashen Lepus DEC 2025)"
},
{
"source_name": "Check Point Wirte NOV 2024",
"description": "Check Point. (2024, November 12). Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity. Retrieved April 20, 2026.",
"url": "https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"
},
{
"source_name": "Lab52 WIRTE Apr 2019",
"description": "S2 Grupo. (2019, April 2). WIRTE Group attacking the Middle East. Retrieved May 24, 2019.",
"url": "https://lab52.io/blog/wirte-group-attacking-the-middle-east/"
},
{
"source_name": "Palo Alto Ashen Lepus DEC 2025",
"description": "Unit 42. (2025, December 11). Hamas-Affiliated Ashen Lepus Targets Middle Eastern Diplomatic Entities With New AshTag Malware Suite. Retrieved April 20, 2026.",
"url": "https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"
},
{
"source_name": "Kaspersky WIRTE November 2021",
"description": "Yamout, M. (2021, November 29). WIRTE\u2019s campaign in the Middle East \u2018living off the land\u2019 since at least 2019. Retrieved February 1, 2022.",
"url": "https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Lab52 by S2 Grupo"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:52.082000+00:00\", \"old_value\": \"2026-04-23 02:15:29.965000+00:00\"}}}",
"previous_version": "3.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--be8847e0-9512-45db-895e-f871ab6d3820",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-09-29 20:01:50.272000+00:00",
"modified": "2026-07-31 18:48:14.500000+00:00",
"name": "Water Galura",
"description": "[Water Galura](https://attack.mitre.org/groups/G1050) are the operators of the [Qilin](https://attack.mitre.org/software/S1242) Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the publication of stolen data for [Qilin](https://attack.mitre.org/software/S1242) affilates recruited on Russian cybercrime forums. [Water Galura](https://attack.mitre.org/groups/G1050) have been active since at least 2022 and use a double extortion model where they demand payment for providing decryption keys and for refraining from publishing the stolen data to their leak site.(Citation: BushidoToken Qilin RaaS JUN 2024)(Citation: Sophos Qilin MSP APR 2025)",
"aliases": [
"Water Galura",
"GOLD FEATHER"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1050",
"external_id": "G1050"
},
{
"source_name": "GOLD FEATHER",
"description": "(Citation: BushidoToken Qilin RaaS JUN 2024)"
},
{
"source_name": "Sophos Qilin MSP APR 2025",
"description": "Bradshaw, A. et al. (2025, April 1). Qilin affiliates spear-phish MSP ScreenConnect admin, targeting customers downstream. Retrieved September 26, 2025.",
"url": "https://news.sophos.com/en-us/2025/04/01/sophos-mdr-tracks-ongoing-campaign-by-qilin-affiliates-targeting-screenconnect/"
},
{
"source_name": "BushidoToken Qilin RaaS JUN 2024",
"description": "Thomas, W. (2024, June 12). Tracking Adversaries: The Qilin RaaS. Retrieved September 26, 2025.",
"url": "https://blog.bushidotoken.net/2024/06/tracking-adversaries-qilin-raas.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:14.500000+00:00\", \"old_value\": \"2025-10-23 21:52:27.774000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--b74f909f-8e52-4b69-b770-162bf59a1b4e",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-05-26 16:55:09.674000+00:00",
"modified": "2026-07-31 18:48:13.766000+00:00",
"name": "Whitefly",
"description": "[Whitefly](https://attack.mitre.org/groups/G0107) is a cyber espionage group that has been operating since at least 2017. The group has targeted organizations based mostly in Singapore across a wide variety of sectors, and is primarily interested in stealing large amounts of sensitive information. The group has been linked to an attack against Singapore\u2019s largest public health organization, SingHealth.(Citation: Symantec Whitefly March 2019)",
"aliases": [
"Whitefly"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0107",
"external_id": "G0107"
},
{
"source_name": "Symantec Whitefly March 2019",
"description": "Symantec. (2019, March 6). Whitefly: Espionage Group has Singapore in Its Sights. Retrieved May 26, 2020.",
"url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/whitefly-espionage-singapore"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:13.766000+00:00\", \"old_value\": \"2024-04-10 20:43:09.698000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--4e868dad-682d-4897-b8df-2dc98f46c68a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-02-10 19:57:38.042000+00:00",
"modified": "2026-07-31 18:47:55.695000+00:00",
"name": "Windigo",
"description": "The [Windigo](https://attack.mitre.org/groups/G0124) group has been operating since at least 2011, compromising thousands of Linux and Unix servers using the [Ebury](https://attack.mitre.org/software/S0377) SSH backdoor to create a spam botnet. Despite law enforcement intervention against the creators, [Windigo](https://attack.mitre.org/groups/G0124) operators continued updating [Ebury](https://attack.mitre.org/software/S0377) through 2019.(Citation: ESET Windigo Mar 2014)(Citation: CERN Windigo June 2019)",
"aliases": [
"Windigo"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0124",
"external_id": "G0124"
},
{
"source_name": "ESET Windigo Mar 2014",
"description": "Bilodeau, O., Bureau, M., Calvet, J., Dorais-Joncas, A., L\u00e9veill\u00e9, M., Vanheuverzwijn, B. (2014, March 18). Operation Windigo \u2013 the vivisection of a large Linux server\u2011side credential\u2011stealing malware campaign. Retrieved February 10, 2021.",
"url": "https://www.welivesecurity.com/2014/03/18/operation-windigo-the-vivisection-of-a-large-linux-server-side-credential-stealing-malware-campaign/"
},
{
"source_name": "CERN Windigo June 2019",
"description": "CERN. (2019, June 4). 2019/06/04 Advisory: Windigo attacks. Retrieved February 10, 2021.",
"url": "https://security.web.cern.ch/advisories/windigo/windigo.shtml"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:55.695000+00:00\", \"old_value\": \"2025-04-25 14:49:09.909000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--afec6dc3-a18e-4b62-b1a4-5510e1a498d1",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-06-25 17:16:39.168000+00:00",
"modified": "2026-07-31 20:48:43.267000+00:00",
"name": "Windshift",
"description": "[Windshift](https://attack.mitre.org/groups/G0112) is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.(Citation: SANS Windshift August 2018)(Citation: objective-see windtail1 dec 2018)(Citation: objective-see windtail2 jan 2019)",
"aliases": [
"Windshift",
"Bahamut"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0112",
"external_id": "G0112"
},
{
"source_name": "Bahamut",
"description": "(Citation: SANS Windshift August 2018)"
},
{
"source_name": "SANS Windshift August 2018",
"description": "Karim, T. (2018, August). TRAILS OF WINDSHIFT. Retrieved November 17, 2024.",
"url": "https://www.scribd.com/document/661837258/WINDSHIFT-summit-archive-1554718868"
},
{
"source_name": "objective-see windtail1 dec 2018",
"description": "Wardle, Patrick. (2018, December 20). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 1). Retrieved October 3, 2019.",
"url": "https://objective-see.com/blog/blog_0x3B.html"
},
{
"source_name": "objective-see windtail2 jan 2019",
"description": "Wardle, Patrick. (2019, January 15). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 2). Retrieved October 3, 2019.",
"url": "https://objective-see.com/blog/blog_0x3D.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:43.267000+00:00\", \"old_value\": \"2024-11-17 14:15:51.850000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--c5947e1c-1cbc-434c-94b8-27c7e3be0fff",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:08.682000+00:00",
"modified": "2026-07-31 18:48:18.078000+00:00",
"name": "Winnti Group",
"description": "[Winnti Group](https://attack.mitre.org/groups/G0044) is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting.(Citation: Kaspersky Winnti April 2013)(Citation: Kaspersky Winnti June 2015)(Citation: Novetta Winnti April 2015) Some reporting suggests a number of other groups, including [Axiom](https://attack.mitre.org/groups/G0001), [APT17](https://attack.mitre.org/groups/G0025), and [Ke3chang](https://attack.mitre.org/groups/G0004), are closely linked to [Winnti Group](https://attack.mitre.org/groups/G0044).(Citation: 401 TRG Winnti Umbrella May 2018)",
"aliases": [
"Winnti Group",
"Blackfly"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0044",
"external_id": "G0044"
},
{
"source_name": "Winnti Group",
"description": "(Citation: Kaspersky Winnti April 2013) (Citation: Kaspersky Winnti June 2015)"
},
{
"source_name": "Blackfly",
"description": "(Citation: Symantec Suckfly March 2016)"
},
{
"source_name": "Symantec Suckfly March 2016",
"description": "DiMaggio, J. (2016, March 15). Suckfly: Revealing the secret life of your code signing certificates. Retrieved August 3, 2016.",
"url": "http://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
},
{
"source_name": "401 TRG Winnti Umbrella May 2018",
"description": "Hegel, T. (2018, May 3). Burning Umbrella: An Intelligence Report on the Winnti Umbrella and Associated State-Sponsored Attackers. Retrieved July 8, 2018.",
"url": "https://401trg.github.io/pages/burning-umbrella.html"
},
{
"source_name": "Kaspersky Winnti April 2013",
"description": "Kaspersky Lab's Global Research and Analysis Team. (2013, April 11). Winnti. More than just a game. Retrieved February 8, 2017.",
"url": "https://securelist.com/winnti-more-than-just-a-game/37029/"
},
{
"source_name": "Novetta Winnti April 2015",
"description": "Novetta Threat Research Group. (2015, April 7). Winnti Analysis. Retrieved February 8, 2017.",
"url": "https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf"
},
{
"source_name": "Kaspersky Winnti June 2015",
"description": "Tarakanov, D. (2015, June 22). Games are over: Winnti is now targeting pharmaceutical companies. Retrieved January 14, 2016.",
"url": "https://securelist.com/games-are-over/70991/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Edward Millington"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:18.078000+00:00\", \"old_value\": \"2025-04-16 20:37:35.689000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--75a07184-a7e5-4222-95a1-a04dbc96a29c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-07-29 22:23:03.779000+00:00",
"modified": "2026-07-31 18:48:02.493000+00:00",
"name": "Winter Vivern",
"description": "Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control.(Citation: DomainTools WinterVivern 2021)(Citation: SentinelOne WinterVivern 2023)(Citation: CERT-UA WinterVivern 2023)(Citation: ESET WinterVivern 2023)(Citation: Proofpoint WinterVivern 2023)",
"aliases": [
"Winter Vivern",
"TA473",
"UAC-0114"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1035",
"external_id": "G1035"
},
{
"source_name": "UAC-0114",
"description": "(Citation: CERT-UA WinterVivern 2023)"
},
{
"source_name": "TA473",
"description": "(Citation: Proofpoint WinterVivern 2023)"
},
{
"source_name": "CERT-UA WinterVivern 2023",
"description": "CERT-UA. (2023, February 1). UAC-0114 aka Winter Vivern to target Ukrainian and Polish GOV entities (CERT-UA#5909). Retrieved July 29, 2024.",
"url": "https://cert.gov.ua/article/3761104"
},
{
"source_name": "DomainTools WinterVivern 2021",
"description": "Chad Anderson. (2021, April 27). Winter Vivern: A Look At Re-Crafted Government MalDocs Targeting Multiple Languages. Retrieved July 29, 2024.",
"url": "https://www.domaintools.com/resources/blog/winter-vivern-a-look-at-re-crafted-government-maldocs/"
},
{
"source_name": "ESET WinterVivern 2023",
"description": "Matthieu Faou. (2023, October 25). Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers. Retrieved July 29, 2024.",
"url": "https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/"
},
{
"source_name": "Proofpoint WinterVivern 2023",
"description": "Michael Raggi & The Proofpoint Threat Research Team. (2023, March 30). Exploitation is a Dish Best Served Cold: Winter Vivern Uses Known Zimbra Vulnerability to Target Webmail Portals of NATO-Aligned Governments in Europe. Retrieved July 29, 2024.",
"url": "https://www.proofpoint.com/us/blog/threat-insight/exploitation-dish-best-served-cold-winter-vivern-uses-known-zimbra-vulnerability"
},
{
"source_name": "SentinelOne WinterVivern 2023",
"description": "Tom Hegel. (2023, March 16). Winter Vivern | Uncovering a Wave of Global Espionage. Retrieved July 29, 2024.",
"url": "https://www.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espionage/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Onur Atali"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:02.493000+00:00\", \"old_value\": \"2024-10-10 14:33:40.986000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--dd2d9ca6-505b-4860-a604-233685b802c7",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-05-12 18:15:29.396000+00:00",
"modified": "2026-07-31 20:48:49.730000+00:00",
"name": "Wizard Spider",
"description": "[Wizard Spider](https://attack.mitre.org/groups/G0102) is a Russia-based financially motivated threat group originally known for the creation and deployment of [TrickBot](https://attack.mitre.org/software/S0266) since at least 2016. [Wizard Spider](https://attack.mitre.org/groups/G0102) possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.(Citation: CrowdStrike Ryuk January 2019)(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)(Citation: CrowdStrike Wizard Spider October 2020)",
"aliases": [
"Wizard Spider",
"UNC1878",
"TEMP.MixMaster",
"Grim Spider",
"FIN12",
"GOLD BLACKBURN",
"ITG23",
"Periwinkle Tempest",
"DEV-0193",
"Pistachio Tempest",
"DEV-0237"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0102",
"external_id": "G0102"
},
{
"source_name": "Grim Spider",
"description": "(Citation: CrowdStrike Ryuk January 2019)(Citation: CrowdStrike Grim Spider May 2019)"
},
{
"source_name": "UNC1878",
"description": "(Citation: FireEye KEGTAP SINGLEMALT October 2020)"
},
{
"source_name": "TEMP.MixMaster",
"description": "(Citation: FireEye Ryuk and Trickbot January 2019)"
},
{
"source_name": "ITG23",
"description": "(Citation: IBM X-Force ITG23 Oct 2021)"
},
{
"source_name": "FIN12",
"description": "(Citation: Mandiant FIN12 Oct 2021)"
},
{
"source_name": "Periwinkle Tempest",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "DEV-0193",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Pistachio Tempest",
"description": "(Citation: Microsoft_PistachioTempest_Jan2024)"
},
{
"source_name": "DEV-0237",
"description": "(Citation: Microsoft_PistachioTempest_Jan2024)"
},
{
"source_name": "GOLD BLACKBURN",
"description": "(Citation: Secureworks Gold Blackburn Mar 2022)"
},
{
"source_name": "DHS/CISA Ransomware Targeting Healthcare October 2020",
"description": "DHS/CISA. (2020, October 28). Ransomware Activity Targeting the Healthcare and Public Health Sector. Retrieved October 28, 2020.",
"url": "https://us-cert.cisa.gov/ncas/alerts/aa20-302a"
},
{
"source_name": "FireEye Ryuk and Trickbot January 2019",
"description": "Goody, K., et al (2019, January 11). A Nasty Trick: From Credential Theft Malware to Business Disruption. Retrieved May 12, 2020.",
"url": "https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html"
},
{
"source_name": "CrowdStrike Ryuk January 2019",
"description": "Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.",
"url": "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/"
},
{
"source_name": "CrowdStrike Grim Spider May 2019",
"description": "John, E. and Carvey, H. (2019, May 30). Unraveling the Spiderweb: Timelining ATT&CK Artifacts Used by GRIM SPIDER. Retrieved May 12, 2020.",
"url": "https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"
},
{
"source_name": "FireEye KEGTAP SINGLEMALT October 2020",
"description": "Kimberly Goody, Jeremy Kennelly, Joshua Shilko, Steve Elovitz, Douglas Bienstock. (2020, October 28). Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser. Retrieved October 28, 2020.",
"url": "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft_PistachioTempest_Jan2024",
"description": "Microsoft. (2024, January 25). Financially Motivated Threat Actor Pistachio Tempest. Retrieved December 15, 2025.",
"url": "https://www.microsoft.com/en-us/security/security-insider/threat-landscape/pistachio-tempest"
},
{
"source_name": "CrowdStrike Wizard Spider October 2020",
"description": "Podlosky, A., Hanel, A. et al. (2020, October 16). WIZARD SPIDER Update: Resilient, Reactive and Resolute. Retrieved June 15, 2021.",
"url": "https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"
},
{
"source_name": "Secureworks Gold Blackburn Mar 2022",
"description": "Secureworks Counter Threat Unit. (2022, March 1). Gold Blackburn Threat Profile. Retrieved June 15, 2023.",
"url": "https://www.secureworks.com/research/threat-profiles/gold-blackburn"
},
{
"source_name": "Mandiant FIN12 Oct 2021",
"description": "Shilko, J., et al. (2021, October 7). FIN12: The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets. Retrieved June 15, 2023.",
"url": "https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"
},
{
"source_name": "IBM X-Force ITG23 Oct 2021",
"description": "Villadsen, O., et al. (2021, October 13). Trickbot Rising - Gang Doubles Down on Infection Efforts to Amass Network Footholds. Retrieved June 15, 2023.",
"url": "https://securityintelligence.com/posts/trickbot-gang-doubles-down-enterprise-infection/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Edward Millington",
"Oleksiy Gayda"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "4.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:49.730000+00:00\", \"old_value\": \"2026-05-12 15:12:00.732000+00:00\"}}}",
"previous_version": "4.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--4283ae19-69c7-4347-a35e-b56f08eb660b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-03-24 15:48:17.731000+00:00",
"modified": "2026-07-31 18:47:51.321000+00:00",
"name": "ZIRCONIUM",
"description": "[ZIRCONIUM](https://attack.mitre.org/groups/G0128) is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community.(Citation: Microsoft Targeting Elections September 2020)(Citation: Check Point APT31 February 2021)",
"aliases": [
"ZIRCONIUM",
"APT31",
"Violet Typhoon"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0128",
"external_id": "G0128"
},
{
"source_name": "APT31",
"description": "(Citation: Check Point APT31 February 2021)"
},
{
"source_name": "Violet Typhoon",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Microsoft Targeting Elections September 2020",
"description": "Burt, T. (2020, September 10). New cyberattacks targeting U.S. elections. Retrieved March 24, 2021.",
"url": "https://blogs.microsoft.com/on-the-issues/2020/09/10/cyberattacks-us-elections-trump-biden/"
},
{
"source_name": "Check Point APT31 February 2021",
"description": "Itkin, E. and Cohen, I. (2021, February 22). The Story of Jian \u2013 How APT31 Stole and Used an Unknown Equation Group 0-Day. Retrieved March 24, 2021.",
"url": "https://research.checkpoint.com/2021/the-story-of-jian/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:51.321000+00:00\", \"old_value\": \"2025-10-15 20:39:25.843000+00:00\"}}}",
"previous_version": "2.3"
},
{
"type": "intrusion-set",
"id": "intrusion-set--16ade1aa-0ea1-4bb7-88cc-9079df2ae756",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:53.579000+00:00",
"modified": "2026-07-31 18:47:38.827000+00:00",
"name": "admin@338",
"description": "[admin@338](https://attack.mitre.org/groups/G0018) is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as [PoisonIvy](https://attack.mitre.org/software/S0012), as well as some non-public backdoors. (Citation: FireEye admin@338)",
"aliases": [
"admin@338"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0018",
"external_id": "G0018"
},
{
"source_name": "admin@338",
"description": "(Citation: FireEye admin@338)"
},
{
"source_name": "FireEye admin@338",
"description": "FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.",
"url": "https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Tatsuya Daitoku, Cyber Defense Institute, Inc."
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:38.827000+00:00\", \"old_value\": \"2025-04-25 14:48:47.886000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--222fbd21-fc4f-4b7e-9f85-0e6e3a76c33f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:09.054000+00:00",
"modified": "2026-07-31 18:47:42.898000+00:00",
"name": "menuPass",
"description": "[menuPass](https://attack.mitre.org/groups/G0045) is a threat group that has been active since at least 2006. Individual members of [menuPass](https://attack.mitre.org/groups/G0045) are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018)\n\n[menuPass](https://attack.mitre.org/groups/G0045) has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.(Citation: Palo Alto menuPass Feb 2017)(Citation: Crowdstrike CrowdCast Oct 2013)(Citation: FireEye Poison Ivy)(Citation: PWC Cloud Hopper April 2017)(Citation: FireEye APT10 April 2017)(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018)",
"aliases": [
"menuPass",
"Cicada",
"POTASSIUM",
"Stone Panda",
"APT10",
"Red Apollo",
"CVNX",
"HOGFISH",
"BRONZE RIVERSIDE"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0045",
"external_id": "G0045"
},
{
"source_name": "HOGFISH",
"description": "(Citation: Accenture Hogfish April 2018)"
},
{
"source_name": "POTASSIUM",
"description": "(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018)"
},
{
"source_name": "Stone Panda",
"description": "(Citation: Palo Alto menuPass Feb 2017)(Citation: Accenture Hogfish April 2018)(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018)(Citation: Symantec Cicada November 2020)"
},
{
"source_name": "APT10",
"description": "(Citation: Palo Alto menuPass Feb 2017)(Citation: Accenture Hogfish April 2018)(Citation: FireEye APT10 Sept 2018)(Citation: DOJ APT10 Dec 2018)(Citation: Symantec Cicada November 2020)"
},
{
"source_name": "menuPass",
"description": "(Citation: Palo Alto menuPass Feb 2017)(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018)"
},
{
"source_name": "Red Apollo",
"description": "(Citation: PWC Cloud Hopper April 2017)(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018)"
},
{
"source_name": "CVNX",
"description": "(Citation: PWC Cloud Hopper April 2017)(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018)"
},
{
"source_name": "BRONZE RIVERSIDE",
"description": "(Citation: SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022)"
},
{
"source_name": "Cicada",
"description": "(Citation: Symantec Cicada November 2020)"
},
{
"source_name": "Accenture Hogfish April 2018",
"description": "Accenture Security. (2018, April 23). Hogfish Redleaves Campaign. Retrieved July 2, 2018.",
"url": "http://web.archive.org/web/20220810112638/https:/www.accenture.com/t20180423T055005Z_w_/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"
},
{
"source_name": "SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022",
"description": "Counter Threat Unit Research Team . (2022, June 23). BRONZE STARLIGHT RANSOMWARE OPERATIONS USE HUI LOADER. Retrieved December 7, 2023.",
"url": "https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader"
},
{
"source_name": "Crowdstrike CrowdCast Oct 2013",
"description": "Crowdstrike. (2013, October 16). CrowdCasts Monthly: You Have an Adversary Problem. Retrieved November 17, 2024.",
"url": "https://www.slideshare.net/slideshow/crowd-casts-monthly-you-have-an-adversary-problem/27262315"
},
{
"source_name": "FireEye APT10 April 2017",
"description": "FireEye iSIGHT Intelligence. (2017, April 6). APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat. Retrieved June 29, 2017.",
"url": "https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"
},
{
"source_name": "FireEye Poison Ivy",
"description": "FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved September 19, 2024.",
"url": "https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf"
},
{
"source_name": "FireEye APT10 Sept 2018",
"description": "Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.",
"url": "https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"
},
{
"source_name": "Palo Alto menuPass Feb 2017",
"description": "Miller-Osborn, J. and Grunzweig, J.. (2017, February 16). menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations. Retrieved March 1, 2017.",
"url": "http://researchcenter.paloaltonetworks.com/2017/02/unit42-menupass-returns-new-malware-new-attacks-japanese-academics-organizations/"
},
{
"source_name": "PWC Cloud Hopper April 2017",
"description": "PwC and BAE Systems. (2017, April). Operation Cloud Hopper. Retrieved April 5, 2017.",
"url": "https://web.archive.org/web/20220224041316/https:/www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf"
},
{
"source_name": "Symantec Cicada November 2020",
"description": "Symantec. (2020, November 17). Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign. Retrieved December 17, 2020.",
"url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"
},
{
"source_name": "DOJ APT10 Dec 2018",
"description": "United States District Court Southern District of New York (USDC SDNY) . (2018, December 17). United States of America v. Zhu Hua and Zhang Shilong. Retrieved April 17, 2019.",
"url": "https://www.justice.gov/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion"
},
{
"source_name": "District Court of NY APT10 Indictment December 2018",
"description": "US District Court Southern District of New York. (2018, December 17). United States v. Zhu Hua Indictment. Retrieved December 17, 2020.",
"url": "https://www.justice.gov/opa/page/file/1122671/download"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Edward Millington",
"Michael Cox"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:42.898000+00:00\", \"old_value\": \"2026-05-12 15:12:00.731000+00:00\"}}}",
"previous_version": "3.0"
}
],
"revocations": [],
"deprecations": [],
"deletions": []
},
"campaigns": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [
{
"type": "campaign",
"id": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-09-27 13:11:52.340000+00:00",
"modified": "2026-08-04 20:48:44.047000+00:00",
"name": "2015 Ukraine Electric Power Attack",
"description": "[2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028) was a [Sandworm Team](https://attack.mitre.org/groups/G0034) campaign during which they used [BlackEnergy](https://attack.mitre.org/software/S0089) (specifically BlackEnergy3) and [KillDisk](https://attack.mitre.org/software/S0607) to target and disrupt transmission and distribution substations within the Ukrainian power grid. This campaign was the first major public attack conducted against the Ukrainian power grid by Sandworm Team.",
"aliases": [
"2015 Ukraine Electric Power Attack"
],
"first_seen": "2015-12-01 05:00:00+00:00",
"last_seen": "2016-01-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0028",
"external_id": "C0028"
},
{
"source_name": "Booz Allen Hamilton",
"description": "Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.",
"url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_first_seen_citation": "(Citation: Booz Allen Hamilton)",
"x_mitre_last_seen_citation": "(Citation: Booz Allen Hamilton)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-08-04 20:48:44.047000+00:00\", \"old_value\": \"2024-12-18 18:59:44.199000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}, \"iterable_item_removed\": {\"root['x_mitre_domains'][2]\": \"mobile-attack\"}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--aa73efef-1418-4dbe-b43c-87a498e97234",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-03-31 17:22:23.567000+00:00",
"modified": "2026-07-31 21:05:24.494000+00:00",
"name": "2016 Ukraine Electric Power Attack",
"description": "[2016 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0025) was a [Sandworm Team](https://attack.mitre.org/groups/G0034) campaign during which they used [Industroyer](https://attack.mitre.org/software/S0604) malware to target and disrupt distribution substations within the Ukrainian power grid. This campaign was the second major public attack conducted against Ukraine by [Sandworm Team](https://attack.mitre.org/groups/G0034).(Citation: ESET Industroyer)(Citation: Dragos Crashoverride 2018)",
"aliases": [
"2016 Ukraine Electric Power Attack"
],
"first_seen": "2016-12-01 05:00:00+00:00",
"last_seen": "2016-12-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0025",
"external_id": "C0025"
},
{
"source_name": "ESET Industroyer",
"description": "Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.",
"url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
},
{
"source_name": "Dragos Crashoverride 2018",
"description": "Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.",
"url": "https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_first_seen_citation": "(Citation: ESET Industroyer)(Citation: Dragos Crashoverride 2018)",
"x_mitre_last_seen_citation": "(Citation: ESET Industroyer)(Citation: Dragos Crashoverride 2018)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 21:05:24.494000+00:00\", \"old_value\": \"2025-04-16 20:37:46.567000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}, \"iterable_item_removed\": {\"root['x_mitre_domains'][2]\": \"mobile-attack\"}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--df8eb785-70f8-4300-b444-277ba849083d",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-27 19:43:25.703000+00:00",
"modified": "2026-07-31 21:11:04.731000+00:00",
"name": "2022 Ukraine Electric Power Attack",
"description": "The [2022 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0034) was a [Sandworm Team](https://attack.mitre.org/groups/G0034) campaign that used a combination of GOGETTER, Neo-REGEORG, [CaddyWiper](https://attack.mitre.org/software/S0693), and living of the land (LotL) techniques to gain access to a Ukrainian electric utility to send unauthorized commands from their SCADA system.(Citation: Mandiant-Sandworm-Ukraine-2022)(Citation: Dragos-Sandworm-Ukraine-2022) ",
"aliases": [
"2022 Ukraine Electric Power Attack"
],
"first_seen": "2022-06-01 04:00:00+00:00",
"last_seen": "2022-10-01 04:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0034",
"external_id": "C0034"
},
{
"source_name": "Dragos-Sandworm-Ukraine-2022",
"description": "Dragos, Inc.. (2023, December 11). ELECTRUM Targeted Ukrainian Electric Entity Using Custom Tools and CaddyWiper Malware, October 2022. Retrieved March 28, 2024.",
"url": "https://www.dragos.com/blog/new-details-electrum-ukraine-electric-sector-compromise-2022/"
},
{
"source_name": "Mandiant-Sandworm-Ukraine-2022",
"description": "Ken Proska, John Wolfram, Jared Wilson, Dan Black, Keith Lunden, Daniel Kapellmann Zafra, Nathan Brubaker, Tyler Mclellan, Chris Sistrunk. (2023, November 9). Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology. Retrieved March 28, 2024.",
"url": "https://www.mandiant.com/resources/blog/sandworm-disrupts-power-ukraine-operational-technology"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_first_seen_citation": "(Citation: Mandiant-Sandworm-Ukraine-2022)",
"x_mitre_last_seen_citation": "(Citation: Mandiant-Sandworm-Ukraine-2022)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 21:11:04.731000+00:00\", \"old_value\": \"2024-04-10 16:02:48.078000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}, \"iterable_item_removed\": {\"root['x_mitre_domains'][2]\": \"mobile-attack\"}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-22 19:33:22.532000+00:00",
"modified": "2026-07-31 20:48:19.151000+00:00",
"name": "2025 Poland Wiper Attacks",
"description": "[2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063) is a Russian state-sponsored campaign that conducted destructive cyberattacks against Polish energy infrastructure in December 2025. Targets included more than 30 wind and photovoltaic farms, a combined heat and power (CHP) plant, and a manufacturing sector company. The attacks on the distributed energy resources (DER) disrupted communications between affected facilities and the distribution system operator, but did not impact electricity generation or heat supply. Across the campaign, threat actors deployed two previously undocumented wiper tools, [DynoWiper](https://attack.mitre.org/software/S9038), a Windows-based wiper and [LazyWiper](https://attack.mitre.org/software/S9039), a PowerShell wiper, distributed via malicious Group Policy Objects. At the CHP plant, threat actors had maintained access since at least March 2025, using that foothold to obtain credentials and move laterally before attempting wiper deployment. Some reporting has assessed the activity to be consistent with Russian Federal Security Service (FSB) threat activity group [Dragonfly](https://attack.mitre.org/groups/G0035), also tracked as STATIC TUNDRA, while other reporting attributes the destructive wiper activities to the Russian General Staff Main Intelligence Directorate (GRU) threat activity group ELECTRUM, also tracked as [Sandworm Team](https://attack.mitre.org/groups/G0034).(Citation: CERT Polska)(Citation: Dragos ELECTRUM JAN 2026)(Citation: ESET DynoWiper JAN 2026)(Citation: ESET DynoWiper Update JAN 2026)",
"aliases": [
"2025 Poland Wiper Attacks",
"2025 Poland Wiper Campaign"
],
"first_seen": "2025-03-01 05:00:00+00:00",
"last_seen": "2025-12-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0063",
"external_id": "C0063"
},
{
"source_name": "CERT Polska",
"description": "CERT Polska. (2026, January 30). Energy Sector Incident Report \u2013 29 December. Retrieved April 22, 2026.",
"url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
},
{
"source_name": "ESET DynoWiper Update JAN 2026",
"description": "ESET. (2026, January 30). DynoWiper update: Technical analysis and attribution. Retrieved April 22, 2026.",
"url": "https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/"
},
{
"source_name": "ESET DynoWiper JAN 2026",
"description": "ESET. (2026, January 30). Russian Sandworm group attacks energy company in Poland with DynoWiper, ESET Research discovers. Retrieved April 22, 2026.",
"url": "https://www.eset.com/us/about/newsroom/research/eset-research-russian-sandwormapt-attacks-energy-company-poland-with-dynowiper/"
},
{
"source_name": "Dragos ELECTRUM JAN 2026",
"description": "https://5943619.hs-sites.com/hubfs/Reports/dragos-2025-poland-attack-report.pdf. (2026, January). ELECTRUM: CYBER ATTACK ON POLAND\u2019S ELECTRIC SYSTEM 2025. Retrieved April 22, 2026.",
"url": "https://5943619.hs-sites.com/hubfs/Reports/dragos-2025-poland-attack-report.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Dragos Threat Intelligence"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_first_seen_citation": "(Citation: CERT Polska)(Citation: Dragos ELECTRUM JAN 2026)",
"x_mitre_last_seen_citation": "(Citation: CERT Polska)(Citation: Dragos ELECTRUM JAN 2026)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:19.151000+00:00\", \"old_value\": \"2026-05-12 15:12:00.730000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--4fd53ccc-c6b1-4e3c-abe8-a456d46d789e",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-08-25 22:00:39.072000+00:00",
"modified": "2026-07-31 18:47:21.686000+00:00",
"name": "3CX Supply Chain Attack",
"description": "The [3CX Supply Chain Attack](https://attack.mitre.org/campaigns/C0057) was the first publicly reported case of one supply chain compromise triggering another, leading to a cascading, two-stage intrusion. The initial supply chain attack began when a 3CX employee downloaded and executed a trojanized, end-of-life version of the X_Trader trading software from Trading Technologies. This provided UNC4736, a threat cluster associated with [AppleJeus](https://attack.mitre.org/groups/G1049), access to the 3CX environment. From there UNC4736 compromised the Windows and macOS build environments used to distribute the 3CX desktop application to their customers.(Citation: Mandiant 3cx UNC4736 2023) While 3CX serves more than 600,000 customers and 12 million users, only a subset of systems were affected. Subsequent targeting focused on victims in the defense and cryptocurrency sectors, where attackers deployed secondary payloads such as Gopuram for credential theft and persistence.(Citation: Kaspersky 3CX Gopuram 2023) The campaign began in late 2022 and was disrupted after security vendors publicly reported the compromise in March 2023.(Citation: 3cx official statement 2023)(Citation: Krebs 3cx overview 2023)",
"aliases": [
"3CX Supply Chain Attack"
],
"first_seen": "2022-11-01 06:00:00+00:00",
"last_seen": "2023-03-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0057",
"external_id": "C0057"
},
{
"source_name": "3cx official statement 2023",
"description": "Agathocles Prodromou. (2023, April 20). Security Update Thursday 20 April 2023 \u2013 Initial Intrusion Vector Found. Retrieved August 25, 2025.",
"url": "https://www.3cx.com/blog/news/mandiant-security-update2/"
},
{
"source_name": "Krebs 3cx overview 2023",
"description": "Brian Krebs. (2023, April 20). 3CX Breach Was a Double Supply Chain Compromise. Retrieved May 22, 2025.",
"url": "https://krebsonsecurity.com/2023/04/3cx-breach-was-a-double-supply-chain-compromise/"
},
{
"source_name": "Kaspersky 3CX Gopuram 2023",
"description": "Georgy Kucherin, Vasily Berdnikov, Vilen Kamalov. (2023, April 3). Not just an infostealer: Gopuram backdoor deployed through 3CX supply chain attack. Retrieved August 25, 2025.",
"url": "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
},
{
"source_name": "Mandiant 3cx UNC4736 2023",
"description": "Jeff Johnson, Fred Plan, Adrian Sanchez, Renato Fontana, Jake Nicastro, Dimiter Andonov, Marius Fodoreanu, Daniel Scott. (2023, April 20). 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible. Retrieved August 25, 2025.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Austin Larsen and the Google Threat Intelligence Group",
"Michael \u201cBarni\u201d Barnhart, DTEX"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Mandiant 3cx UNC4736 2023)",
"x_mitre_last_seen_citation": "(Citation: 3cx official statement 2023)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:21.686000+00:00\", \"old_value\": \"2025-10-23 18:32:38.121000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--a010610e-22cb-437e-bfde-b78861bdca7a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-02-25 17:11:53.066000+00:00",
"modified": "2026-07-31 21:11:45.365000+00:00",
"name": "APT28 Nearest Neighbor Campaign",
"description": "[APT28 Nearest Neighbor Campaign](https://attack.mitre.org/campaigns/C0051) was conducted by [APT28](https://attack.mitre.org/groups/G0007) from early February 2022 to November 2024 against organizations and individuals with expertise on Ukraine. APT28 primarily leveraged living-off-the-land techniques, while leveraging the zero-day exploitation of CVE-2022-38028. Notably, APT28 leveraged Wi-Fi networks in close proximity to the intended target to gain initial access to the victim environment. By daisy-chaining multiple compromised organizations nearby the intended target, APT28 discovered dual-homed systems (with both a wired and wireless network connection) to enable Wi-Fi and use compromised credentials to connect to the victim network.(Citation: Nearest Neighbor Volexity)",
"aliases": [
"APT28 Nearest Neighbor Campaign"
],
"first_seen": "2022-02-01 05:00:00+00:00",
"last_seen": "2024-11-01 04:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0051",
"external_id": "C0051"
},
{
"source_name": "Nearest Neighbor Volexity",
"description": "Koessel, Sean. Adair, Steven. Lancaster, Tom. (2024, November 22). The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access. Retrieved February 25, 2025.",
"url": "https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Nearest Neighbor Volexity)",
"x_mitre_last_seen_citation": "(Citation: Nearest Neighbor Volexity)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 21:11:45.365000+00:00\", \"old_value\": \"2026-05-12 15:12:00.730000+00:00\"}}, \"iterable_item_removed\": {\"root['x_mitre_domains'][1]\": \"mobile-attack\"}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--add4d9de-1256-4166-83b8-57087288dced",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-09-16 09:05:01.249000+00:00",
"modified": "2026-07-31 18:47:29.732000+00:00",
"name": "APT41 DUST",
"description": "[APT41 DUST](https://attack.mitre.org/campaigns/C0040) was conducted by [APT41](https://attack.mitre.org/groups/G0096) from 2023 to July 2024 against entities in Europe, Asia, and the Middle East. [APT41 DUST](https://attack.mitre.org/campaigns/C0040) targeted sectors such as shipping, logistics, and media for information gathering purposes. [APT41](https://attack.mitre.org/groups/G0096) used previously-observed malware such as [DUSTPAN](https://attack.mitre.org/software/S1158) as well as newly observed tools such as [DUSTTRAP](https://attack.mitre.org/software/S1159) in [APT41 DUST](https://attack.mitre.org/campaigns/C0040).(Citation: Google Cloud APT41 2024)",
"aliases": [
"APT41 DUST"
],
"first_seen": "2023-01-31 23:00:00+00:00",
"last_seen": "2024-06-30 22:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0040",
"external_id": "C0040"
},
{
"source_name": "Google Cloud APT41 2024",
"description": "Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Google Cloud APT41 2024)",
"x_mitre_last_seen_citation": "(Citation: Google Cloud APT41 2024)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:29.732000+00:00\", \"old_value\": \"2024-09-21 07:12:01.955000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--590cd5b0-2421-4158-84a2-db13b5db02a3",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-20 19:08:41.632000+00:00",
"modified": "2026-07-31 18:47:23.588000+00:00",
"name": "Anthropic AI-orchestrated Campaign",
"description": "The [Anthropic AI-orchestrated Campaign](https://attack.mitre.org/campaigns/C0062) was conducted in September 2025 by a likely China nexus espionage actor identified as GTG-1002. The [Anthropic AI-orchestrated Campaign](https://attack.mitre.org/campaigns/C0062) was a highly coordinated operation that manipulated Claude Code to perform reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, data analysis, and exfiltration operations at approximately 30 entities in the technology, financial, chemical, and government sectors. During the [Anthropic AI-orchestrated Campaign](https://attack.mitre.org/campaigns/C0062), human operators used Claude Code agents and Model Context Protocol (MCP) tools to automate cyber operations. Operators broke attacks into discrete tasks, used crafted prompts, and established personas to bypass AI guardrails, enabling the agents to execute the operations with minimal human involvement.(Citation: Anthropic AI Orchestrated Campaign NOV 2025)(Citation: Anthropic Disrupting AI Espionage NOV 2025) ",
"aliases": [
"Anthropic AI-orchestrated Campaign"
],
"first_seen": "2025-09-01 04:00:00+00:00",
"last_seen": "2025-09-01 04:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0062",
"external_id": "C0062"
},
{
"source_name": "Anthropic Disrupting AI Espionage NOV 2025",
"description": "Anthropic. (2025, November 13). Disrupting the first reported AI-orchestrated cyber espionage campaign. Retrieved April 20, 2026.",
"url": "https://www.anthropic.com/news/disrupting-AI-espionage"
},
{
"source_name": "Anthropic AI Orchestrated Campaign NOV 2025",
"description": "Anthropic. (2025, November). Disrupting the first reported AI-orchestrated cyber espionage campaign. Retrieved April 20, 2026.",
"url": "https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Anthropic AI Orchestrated Campaign NOV 2025)(Citation: Anthropic Disrupting AI Espionage NOV 2025)",
"x_mitre_last_seen_citation": "(Citation: Anthropic AI Orchestrated Campaign NOV 2025)(Citation: Anthropic Disrupting AI Espionage NOV 2025)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:23.588000+00:00\", \"old_value\": \"2026-04-23 23:45:31.444000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--a543ef15-91ea-4aa9-9c10-267d56e1ee82",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-01-06 15:59:57.952000+00:00",
"modified": "2026-07-31 18:47:28.435000+00:00",
"name": "ArcaneDoor",
"description": "[ArcaneDoor](https://attack.mitre.org/campaigns/C0046) is a campaign targeting networking devices from Cisco and other vendors between July 2023 and April 2024, primarily focused on government and critical infrastructure networks. [ArcaneDoor](https://attack.mitre.org/campaigns/C0046) is associated with the deployment of the custom backdoors [Line Runner](https://attack.mitre.org/software/S1188) and [Line Dancer](https://attack.mitre.org/software/S1186). [ArcaneDoor](https://attack.mitre.org/campaigns/C0046) is attributed to a group referred to as UAT4356 or STORM-1849, and is assessed to be a state-sponsored campaign.(Citation: Cisco ArcaneDoor 2024)(Citation: CCCS ArcaneDoor 2024)",
"aliases": [
"ArcaneDoor"
],
"first_seen": "2023-07-01 06:00:00+00:00",
"last_seen": "2024-04-01 06:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0046",
"external_id": "C0046"
},
{
"source_name": "CCCS ArcaneDoor 2024",
"description": "Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.",
"url": "https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns"
},
{
"source_name": "Cisco ArcaneDoor 2024",
"description": "Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.",
"url": "https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Jun Hirata, NEC Corporation",
"Sareena Karapoola, NEC Corporation India",
"Pooja Natarajan, NEC Corporation India"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Cisco ArcaneDoor 2024)",
"x_mitre_last_seen_citation": "(Citation: Cisco ArcaneDoor 2024)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:28.435000+00:00\", \"old_value\": \"2025-03-10 19:05:59.813000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--ab747e62-1bcb-479f-a26b-1cd39d413d81",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-09-21 22:16:42.003000+00:00",
"modified": "2026-07-31 18:47:29.344000+00:00",
"name": "C0010",
"description": "[C0010](https://attack.mitre.org/campaigns/C0010) was a cyber espionage campaign conducted by UNC3890 that targeted Israeli shipping, government, aviation, energy, and healthcare organizations. Security researcher assess UNC3890 conducts operations in support of Iranian interests, and noted several limited technical connections to Iran, including PDB strings and Farsi language artifacts. [C0010](https://attack.mitre.org/campaigns/C0010) began by at least late 2020, and was still ongoing as of mid-2022.(Citation: Mandiant UNC3890 Aug 2022)",
"aliases": [
"C0010"
],
"first_seen": "2020-12-01 07:00:00+00:00",
"last_seen": "2022-08-01 06:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0010",
"external_id": "C0010"
},
{
"source_name": "Mandiant UNC3890 Aug 2022",
"description": "Mandiant Israel Research Team. (2022, August 17). Suspected Iranian Actor Targeting Israeli Shipping, Healthcare, Government and Energy Sectors. Retrieved September 21, 2022.",
"url": "https://www.mandiant.com/resources/blog/suspected-iranian-actor-targeting-israeli-shipping"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Mandiant UNC3890 Aug 2022)",
"x_mitre_last_seen_citation": "(Citation: Mandiant UNC3890 Aug 2022)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:29.344000+00:00\", \"old_value\": \"2025-04-16 20:37:46.129000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--b4e5a4a9-f3be-4631-ba8f-da6ebb067fac",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-09-22 17:12:02.893000+00:00",
"modified": "2026-07-31 18:47:30.973000+00:00",
"name": "C0011",
"description": "[C0011](https://attack.mitre.org/campaigns/C0011) was a suspected cyber espionage campaign conducted by [Transparent Tribe](https://attack.mitre.org/groups/G0134) that targeted students at universities and colleges in India. Security researchers noted this campaign against students was a significant shift from [Transparent Tribe](https://attack.mitre.org/groups/G0134)'s historic targeting Indian government, military, and think tank personnel, and assessed it was still ongoing as of July 2022.(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022) ",
"aliases": [
"C0011"
],
"first_seen": "2021-12-01 06:00:00+00:00",
"last_seen": "2022-07-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0011",
"external_id": "C0011"
},
{
"source_name": "Cisco Talos Transparent Tribe Education Campaign July 2022",
"description": "N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.",
"url": "https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)",
"x_mitre_last_seen_citation": "(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:30.973000+00:00\", \"old_value\": \"2025-04-16 20:37:47.897000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--78068e68-4124-4243-b6f4-76e4e5be8a06",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-09-29 16:42:29.364000+00:00",
"modified": "2026-07-31 18:47:24.571000+00:00",
"name": "C0015",
"description": "[C0015](https://attack.mitre.org/campaigns/C0015) was a ransomware intrusion during which the unidentified attackers used [Bazar](https://attack.mitre.org/software/S0534), [Cobalt Strike](https://attack.mitre.org/software/S0154), and [Conti](https://attack.mitre.org/software/S0575), along with other tools, over a 5 day period. Security researchers assessed the actors likely used the widely-circulated [Conti](https://attack.mitre.org/software/S0575) ransomware playbook based on the observed pattern of activity and operator errors.(Citation: DFIR Conti Bazar Nov 2021)",
"aliases": [
"C0015"
],
"first_seen": "2021-08-01 05:00:00+00:00",
"last_seen": "2021-08-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0015",
"external_id": "C0015"
},
{
"source_name": "DFIR Conti Bazar Nov 2021",
"description": "DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.",
"url": "https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Matt Brenton, Zurich Insurance Group"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: DFIR Conti Bazar Nov 2021)",
"x_mitre_last_seen_citation": "(Citation: DFIR Conti Bazar Nov 2021)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:24.571000+00:00\", \"old_value\": \"2025-04-16 20:37:46.910000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--ba6dfa37-f401-4140-88b0-8938f2895e61",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-12-01 15:40:34.011000+00:00",
"modified": "2026-07-31 21:12:29.849000+00:00",
"name": "C0017",
"description": "[C0017](https://attack.mitre.org/campaigns/C0017) was an [APT41](https://attack.mitre.org/groups/G0096) campaign conducted between May 2021 and February 2022 that successfully compromised at least six U.S. state government networks through the exploitation of vulnerable Internet facing web applications. During [C0017](https://attack.mitre.org/campaigns/C0017), [APT41](https://attack.mitre.org/groups/G0096) was quick to adapt and use publicly-disclosed as well as zero-day vulnerabilities for initial access, and in at least two cases re-compromised victims following remediation efforts. The goals of [C0017](https://attack.mitre.org/campaigns/C0017) are unknown, however [APT41](https://attack.mitre.org/groups/G0096) was observed exfiltrating Personal Identifiable Information (PII).(Citation: Mandiant APT41)",
"aliases": [
"C0017"
],
"first_seen": "2021-05-01 04:00:00+00:00",
"last_seen": "2022-02-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0017",
"external_id": "C0017"
},
{
"source_name": "Mandiant APT41",
"description": "Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022.",
"url": "https://www.mandiant.com/resources/apt41-us-state-governments"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Kyaw Pyiyt Htet, @KyawPyiytHtet"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Mandiant APT41)",
"x_mitre_last_seen_citation": "(Citation: Mandiant APT41)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 21:12:29.849000+00:00\", \"old_value\": \"2025-04-16 20:37:47.537000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}, \"iterable_item_removed\": {\"root['x_mitre_domains'][1]\": \"mobile-attack\"}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--519ee082-8ab6-439b-988f-a8a3f02c8d30",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-01-17 21:42:34.998000+00:00",
"modified": "2026-07-31 18:47:22.530000+00:00",
"name": "C0018",
"description": "\n[C0018](https://attack.mitre.org/campaigns/C0018) was a month-long ransomware intrusion that successfully deployed [AvosLocker](https://attack.mitre.org/software/S1053) onto a compromised network. The unidentified actors gained initial access to the victim network through an exposed server and used a variety of open-source tools prior to executing [AvosLocker](https://attack.mitre.org/software/S1053).(Citation: Costa AvosLocker May 2022)(Citation: Cisco Talos Avos Jun 2022)",
"aliases": [
"C0018"
],
"first_seen": "2022-02-01 05:00:00+00:00",
"last_seen": "2022-03-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0018",
"external_id": "C0018"
},
{
"source_name": "Costa AvosLocker May 2022",
"description": "Costa, F. (2022, May 1). RaaS AvosLocker Incident Response Analysis. Retrieved January 11, 2023.",
"url": "https://www.linkedin.com/pulse/raas-avoslocker-incident-response-analysis-fl%C3%A1vio-costa?trk=articles_directory"
},
{
"source_name": "Cisco Talos Avos Jun 2022",
"description": "Venere, G. Neal, C. (2022, June 21). Avos ransomware group expands with new attack arsenal. Retrieved January 11, 2023.",
"url": "https://blog.talosintelligence.com/avoslocker-new-arsenal/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Fl\u00e1vio Costa, @Seguran\u00e7a Descomplicada"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Cisco Talos Avos Jun 2022)",
"x_mitre_last_seen_citation": "(Citation: Cisco Talos Avos Jun 2022)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:22.530000+00:00\", \"old_value\": \"2025-04-21 19:40:47.537000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--712e38c3-a656-426a-9b3b-a6bfb63294c6",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-03-15 19:23:36.696000+00:00",
"modified": "2026-07-31 18:47:23.636000+00:00",
"name": "C0021",
"description": "[C0021](https://attack.mitre.org/campaigns/C0021) was a spearphishing campaign conducted in November 2018 that targeted public sector institutions, non-governmental organizations (NGOs), educational institutions, and private-sector corporations in the oil and gas, chemical, and hospitality industries. The majority of targets were located in the US, particularly in and around Washington D.C., with other targets located in Europe, Hong Kong, India, and Canada. [C0021](https://attack.mitre.org/campaigns/C0021)'s technical artifacts, tactics, techniques, and procedures (TTPs), and targeting overlap with previous suspected [APT29](https://attack.mitre.org/groups/G0016) activity.(Citation: Microsoft Unidentified Dec 2018)(Citation: FireEye APT29 Nov 2018)",
"aliases": [
"C0021"
],
"first_seen": "2018-11-01 05:00:00+00:00",
"last_seen": "2018-11-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0021",
"external_id": "C0021"
},
{
"source_name": "FireEye APT29 Nov 2018",
"description": "Dunwoody, M., et al. (2018, November 19). Not So Cozy: An Uncomfortable Examination of a Suspected APT29 Phishing Campaign. Retrieved November 27, 2018.",
"url": "https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html"
},
{
"source_name": "Microsoft Unidentified Dec 2018",
"description": "Microsoft Defender Research Team. (2018, December 3). Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers. Retrieved April 15, 2019.",
"url": "https://www.microsoft.com/security/blog/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: FireEye APT29 Nov 2018)(Citation: Microsoft Unidentified Dec 2018)",
"x_mitre_last_seen_citation": "(Citation: FireEye APT29 Nov 2018)(Citation: Microsoft Unidentified Dec 2018)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:23.636000+00:00\", \"old_value\": \"2025-04-16 20:37:47.096000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--c89fa3ff-4773-4daf-8aec-d8f43f10116e",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-05-15 19:17:48.880000+00:00",
"modified": "2026-07-31 18:47:32.005000+00:00",
"name": "C0026",
"description": "[C0026](https://attack.mitre.org/campaigns/C0026) was a campaign identified in September 2022 that included the selective distribution of [KOPILUWAK](https://attack.mitre.org/software/S1075) and [QUIETCANARY](https://attack.mitre.org/software/S1076) malware to previous [ANDROMEDA](https://attack.mitre.org/software/S1074) malware victims in Ukraine through re-registered [ANDROMEDA](https://attack.mitre.org/software/S1074) C2 domains. Several tools and tactics used during [C0026](https://attack.mitre.org/campaigns/C0026) were consistent with historic [Turla](https://attack.mitre.org/groups/G0010) operations.(Citation: Mandiant Suspected Turla Campaign February 2023)",
"aliases": [
"C0026"
],
"first_seen": "2022-08-01 05:00:00+00:00",
"last_seen": "2022-09-01 04:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0026",
"external_id": "C0026"
},
{
"source_name": "Mandiant Suspected Turla Campaign February 2023",
"description": "Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023.",
"url": "https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Yoshihiro Kori, NEC Corporation",
"Manikantan Srinivasan, NEC Corporation India",
"Pooja Natarajan, NEC Corporation India"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Mandiant Suspected Turla Campaign February 2023)",
"x_mitre_last_seen_citation": "(Citation: Mandiant Suspected Turla Campaign February 2023)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:32.005000+00:00\", \"old_value\": \"2023-09-29 18:06:43.110000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--df74f7ad-b10d-431c-9f1d-a2bc18dadefa",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-06-30 19:28:30.616000+00:00",
"modified": "2026-07-31 18:47:32.962000+00:00",
"name": "C0027",
"description": "[C0027](https://attack.mitre.org/campaigns/C0027) was a financially-motivated campaign linked to [Scattered Spider](https://attack.mitre.org/groups/G1015) that targeted telecommunications and business process outsourcing (BPO) companies from at least June through December of 2022. During [C0027](https://attack.mitre.org/campaigns/C0027) [Scattered Spider](https://attack.mitre.org/groups/G1015) used various forms of social engineering, performed SIM swapping, and attempted to leverage access from victim environments to mobile carrier networks.(Citation: Crowdstrike TELCO BPO Campaign December 2022)\n",
"aliases": [
"C0027"
],
"first_seen": "2022-06-01 04:00:00+00:00",
"last_seen": "2022-12-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0027",
"external_id": "C0027"
},
{
"source_name": "Crowdstrike TELCO BPO Campaign December 2022",
"description": "Parisi, T. (2022, December 2). Not a SIMulation: CrowdStrike Investigations Reveal Intrusion Campaign Targeting Telco and BPO Companies. Retrieved June 30, 2023.",
"url": "https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Crowdstrike TELCO BPO Campaign December 2022)",
"x_mitre_last_seen_citation": "(Citation: Crowdstrike TELCO BPO Campaign December 2022)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:32.962000+00:00\", \"old_value\": \"2025-04-16 20:37:45.650000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--7ec2826c-0bf0-4b47-acae-fd683431a4ca",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-28 15:22:19.075000+00:00",
"modified": "2026-07-31 18:47:25.472000+00:00",
"name": "C0032",
"description": "[C0032](https://attack.mitre.org/campaigns/C0032) was an extended campaign suspected to involve the [Triton](https://attack.mitre.org/software/S1009) adversaries with related capabilities and techniques focused on gaining a foothold within IT environments. This campaign occurred in 2019 and was distinctly different from the [Triton Safety Instrumented System Attack](https://attack.mitre.org/campaigns/C0030).(Citation: FireEye TRITON 2019)",
"aliases": [
"C0032"
],
"first_seen": "2014-10-01 04:00:00+00:00",
"last_seen": "2017-01-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0032",
"external_id": "C0032"
},
{
"source_name": "FireEye TRITON 2019",
"description": "Miller, S, et al. (2019, April 10). TRITON Actor TTP Profile, Custom Attack Tools, Detections, and ATT&CK Mapping. Retrieved April 16, 2019.",
"url": "https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: FireEye TRITON 2019)",
"x_mitre_last_seen_citation": "(Citation: FireEye TRITON 2019)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:25.472000+00:00\", \"old_value\": \"2024-04-15 21:10:00.969000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--a82bc5ad-5f95-4c6a-9f25-aaf6f476a3c4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-28 18:00:04.123000+00:00",
"modified": "2026-07-31 20:48:20.147000+00:00",
"name": "C0033",
"description": "[C0033](https://attack.mitre.org/campaigns/C0033) was a [PROMETHIUM](https://attack.mitre.org/groups/G0056) campaign during which they used [StrongPity](https://attack.mitre.org/software/S0491) to target Android users. [C0033](https://attack.mitre.org/campaigns/C0033) was the first publicly documented mobile campaign for [PROMETHIUM](https://attack.mitre.org/groups/G0056), who previously used Windows-based techniques.(Citation: welivesec_strongpity)",
"aliases": [
"C0033"
],
"first_seen": "2016-05-01 07:00:00+00:00",
"last_seen": "2023-01-01 08:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0033",
"external_id": "C0033"
},
{
"source_name": "securelist_strongpity",
"description": "Baumgartner, K. (2016, October 3). On the StrongPity Waterhole Attacks Targeting Italian and Belgian Encryption Users. Retrieved March 28, 2024.",
"url": "https://securelist.com/on-the-strongpity-waterhole-attacks-targeting-italian-and-belgian-encryption-users/76147/"
},
{
"source_name": "welivesec_strongpity",
"description": "Stefanko, L. (2023, January 10). StrongPity espionage campaign targeting Android users. Retrieved January 31, 2023.",
"url": "https://www.welivesecurity.com/2023/01/10/strongpity-espionage-campaign-targeting-android-users/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Hiroki Nagahama, NEC Corporation",
"Manikantan Srinivasan, NEC Corporation India",
"Pooja Natarajan, NEC Corporation India"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_first_seen_citation": "(Citation: securelist_strongpity)",
"x_mitre_last_seen_citation": "(Citation: welivesec_strongpity)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:20.147000+00:00\", \"old_value\": \"2024-04-11 15:10:14.209000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--f9cc545e-b0ef-4b92-8884-a3a4427609f6",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-09-15 17:25:38.020000+00:00",
"modified": "2026-07-31 18:47:33.745000+00:00",
"name": "CostaRicto",
"description": "[CostaRicto](https://attack.mitre.org/campaigns/C0004) was a suspected hacker-for-hire cyber espionage campaign that targeted multiple industries worldwide, with a large number being financial institutions. [CostaRicto](https://attack.mitre.org/campaigns/C0004) actors targeted organizations in Europe, the Americas, Asia, Australia, and Africa, with a large concentration in South Asia (especially India, Bangladesh, and Singapore), using custom malware, open source tools, and a complex network of proxies and SSH tunnels.(Citation: BlackBerry CostaRicto November 2020)",
"aliases": [
"CostaRicto"
],
"first_seen": "2019-10-01 04:00:00+00:00",
"last_seen": "2020-11-01 04:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0004",
"external_id": "C0004"
},
{
"source_name": "BlackBerry CostaRicto November 2020",
"description": "The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.",
"url": "https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: BlackBerry CostaRicto November 2020)",
"x_mitre_last_seen_citation": "(Citation: BlackBerry CostaRicto November 2020)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:33.745000+00:00\", \"old_value\": \"2025-04-16 20:37:46.418000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--4fdd2487-26c1-494e-8702-ec5abe9aa1d9",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-01 18:21:04.698000+00:00",
"modified": "2026-07-31 18:47:22.237000+00:00",
"name": "Cutting Edge",
"description": "[Cutting Edge](https://attack.mitre.org/campaigns/C0029) was a campaign conducted by suspected China-nexus espionage actors, variously identified as UNC5221/UTA0178 and UNC5325, that began as early as December 2023 with the exploitation of zero-day vulnerabilities in Ivanti Connect Secure (previously Pulse Secure) VPN appliances. [Cutting Edge](https://attack.mitre.org/campaigns/C0029) targeted the U.S. defense industrial base and multiple sectors globally including telecommunications, financial, aerospace, and technology. [Cutting Edge](https://attack.mitre.org/campaigns/C0029) featured the use of defense evasion and living-off-the-land (LoTL) techniques along with the deployment of web shells and other custom malware.(Citation: Mandiant Cutting Edge January 2024)(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)(Citation: Volexity Ivanti Global Exploitation January 2024)(Citation: Mandiant Cutting Edge Part 2 January 2024)(Citation: Mandiant Cutting Edge Part 3 February 2024)",
"aliases": [
"Cutting Edge"
],
"first_seen": "2023-12-01 05:00:00+00:00",
"last_seen": "2024-02-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0029",
"external_id": "C0029"
},
{
"source_name": "Volexity Ivanti Global Exploitation January 2024",
"description": "Gurkok, C. et al. (2024, January 15). Ivanti Connect Secure VPN Exploitation Goes Global. Retrieved February 27, 2024.",
"url": "https://www.volexity.com/blog/2024/01/15/ivanti-connect-secure-vpn-exploitation-goes-global/"
},
{
"source_name": "Mandiant Cutting Edge Part 3 February 2024",
"description": "Lin, M. et al. (2024, February 27). Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts. Retrieved March 1, 2024.",
"url": "https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence"
},
{
"source_name": "Mandiant Cutting Edge Part 2 January 2024",
"description": "Lin, M. et al. (2024, January 31). Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation. Retrieved February 27, 2024.",
"url": "https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"
},
{
"source_name": "Mandiant Cutting Edge January 2024",
"description": "McLellan, T. et al. (2024, January 12). Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation. Retrieved February 27, 2024.",
"url": "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
},
{
"source_name": "Volexity Ivanti Zero-Day Exploitation January 2024",
"description": "Meltzer, M. et al. (2024, January 10). Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN. Retrieved February 27, 2024.",
"url": "https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Mandiant Cutting Edge January 2024)(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)",
"x_mitre_last_seen_citation": "(Citation: Mandiant Cutting Edge Part 3 February 2024)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:22.237000+00:00\", \"old_value\": \"2024-03-28 17:37:05.814000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--f494272a-c110-4574-be90-42c4957f7ae7",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-03-25 22:45:13.091000+00:00",
"modified": "2026-07-31 18:47:33.465000+00:00",
"name": "FLORAHOX Activity",
"description": "[FLORAHOX Activity](https://attack.mitre.org/campaigns/C0053) is conducted using a hybrid operational relay box (ORB) network, which combines two types of infrastructure: compromised devices and leased Virtual Private Servers (VPS). The compromised devices include end-of-life routers and IoT devices, while VPS space is commercially leased and managed by ORB network administrators. This hybrid ORB network allows adversaries to proxy and obscure malicious traffic, making the source of the traffic more difficult to trace.\n\nThe FLORAHOX ORB network has been leveraged by multiple cyber threat actors, including China-nexus actors like [ZIRCONIUM](https://attack.mitre.org/groups/G0128). These adversaries conduct espionage campaigns through [FLORAHOX Activity](https://attack.mitre.org/campaigns/C0053), relying on the ORB network's ability to funnel traffic through [Tor](https://attack.mitre.org/software/S0183) nodes, provisioned VPS servers, and compromised routers to obfuscate malicious traffic.(Citation: ORB Mandiant)",
"aliases": [
"FLORAHOX Activity"
],
"first_seen": "2019-01-01 05:00:00+00:00",
"last_seen": "2024-05-01 04:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0053",
"external_id": "C0053"
},
{
"source_name": "ORB Mandiant",
"description": "Raggi, Michael. (2024, May 22). IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders. Retrieved July 8, 2024.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-orb-networks"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: ORB Mandiant)",
"x_mitre_last_seen_citation": "(Citation: ORB Mandiant)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:33.465000+00:00\", \"old_value\": \"2025-03-27 21:19:26.432000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--26d9ebae-de59-427f-ae9a-349456bae4b1",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-09-07 13:40:09.750000+00:00",
"modified": "2026-07-31 18:47:18.256000+00:00",
"name": "Frankenstein",
"description": "[Frankenstein](https://attack.mitre.org/campaigns/C0001) was described by security researchers as a highly-targeted campaign conducted by moderately sophisticated and highly resourceful threat actors in early 2019. The unidentified actors primarily relied on open source tools, including [Empire](https://attack.mitre.org/software/S0363). The campaign name refers to the actors' ability to piece together several unrelated open-source tool components.(Citation: Talos Frankenstein June 2019)",
"aliases": [
"Frankenstein"
],
"first_seen": "2019-01-01 06:00:00+00:00",
"last_seen": "2019-04-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0001",
"external_id": "C0001"
},
{
"source_name": "Talos Frankenstein June 2019",
"description": "Adamitis, D. et al. (2019, June 4). It's alive: Threat actors cobble together open-source pieces into monstrous Frankenstein campaign. Retrieved May 11, 2020.",
"url": "https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Talos Frankenstein June 2019)",
"x_mitre_last_seen_citation": "(Citation: Talos Frankenstein June 2019)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:18.256000+00:00\", \"old_value\": \"2025-04-16 20:37:47.239000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "campaign",
"id": "campaign--1169ff24-b35f-4d8d-8cf3-643a2834227f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-11-20 23:15:36.728000+00:00",
"modified": "2026-07-31 20:48:13.258000+00:00",
"name": "FrostyGoop Incident",
"description": "[FrostyGoop Incident](https://attack.mitre.org/campaigns/C0041) took place in January 2024 against a municipal district heating company in Ukraine. Following initial access via likely exploitation of external facing services, [FrostyGoop](https://attack.mitre.org/software/S1165) was used to manipulate ENCO control systems via legitimate Modbus commands to impact the delivery of heating services to Ukrainian civilians.(Citation: Dragos FROSTYGOOP 2024)(Citation: Nozomi BUSTLEBERM 2024)",
"aliases": [
"FrostyGoop Incident"
],
"first_seen": "2024-01-01 07:00:00+00:00",
"last_seen": "2024-01-01 07:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0041",
"external_id": "C0041"
},
{
"source_name": "Dragos FROSTYGOOP 2024",
"description": "Mark Graham, Carolyn Ahlers, Kyle O'Meara; Dragos. (2024, July). Impact of FrostyGoop ICS Malware on Connected OT Systems. Retrieved November 20, 2024.",
"url": "https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf"
},
{
"source_name": "Nozomi BUSTLEBERM 2024",
"description": "Nozomi Networks Labs. (2024, July 24). Cyberwarfare Targeting OT: Protecting Against FrostyGoop/BUSTLEBERM Malware. Retrieved November 20, 2024.",
"url": "https://www.nozominetworks.com/blog/protecting-against-frostygoop-bustleberm-malware"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_first_seen_citation": "(Citation: Dragos FROSTYGOOP 2024)",
"x_mitre_last_seen_citation": "(Citation: Dragos FROSTYGOOP 2024)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:13.258000+00:00\", \"old_value\": \"2025-03-05 22:12:26.131000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--8d2bc130-89fe-466e-a4f9-6bce6129c2b8",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-09-20 17:29:09.547000+00:00",
"modified": "2026-07-31 18:47:26.674000+00:00",
"name": "FunnyDream",
"description": "[FunnyDream](https://attack.mitre.org/campaigns/C0007) was a suspected Chinese cyber espionage campaign that targeted government and foreign organizations in Malaysia, the Philippines, Taiwan, Vietnam, and other parts of Southeast Asia. Security researchers linked the [FunnyDream](https://attack.mitre.org/campaigns/C0007) campaign to possible Chinese-speaking threat actors through the use of the [Chinoxy](https://attack.mitre.org/software/S1041) backdoor and noted infrastructure overlap with the TAG-16 threat group.(Citation: Bitdefender FunnyDream Campaign November 2020)(Citation: Kaspersky APT Trends Q1 2020)(Citation: Recorded Future Chinese Activity in Southeast Asia December 2021)",
"aliases": [
"FunnyDream"
],
"first_seen": "2018-07-01 05:00:00+00:00",
"last_seen": "2020-11-01 04:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0007",
"external_id": "C0007"
},
{
"source_name": "Kaspersky APT Trends Q1 2020",
"description": "Global Research and Analysis Team. (2020, April 30). APT trends report Q1 2020. Retrieved September 19, 2022.",
"url": "https://securelist.com/apt-trends-report-q1-2020/96826/"
},
{
"source_name": "Recorded Future Chinese Activity in Southeast Asia December 2021",
"description": "Insikt Group. (2021, December 8). Chinese State-Sponsored Cyber Espionage Activity Supports Expansion of Regional Power and Influence in Southeast Asia. Retrieved September 19, 2022.",
"url": "https://go.recordedfuture.com/hubfs/reports/cta-2021-1208.pdf"
},
{
"source_name": "Bitdefender FunnyDream Campaign November 2020",
"description": "Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.",
"url": "https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Kaspersky APT Trends Q1 2020)",
"x_mitre_last_seen_citation": "(Citation: Bitdefender FunnyDream Campaign November 2020)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:26.674000+00:00\", \"old_value\": \"2025-04-16 20:37:45.985000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--7e21077d-2589-43a7-a5f9-490061289526",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-08-06 20:52:19.002000+00:00",
"modified": "2026-07-31 21:13:10.649000+00:00",
"name": "HomeLand Justice",
"description": "[HomeLand Justice](https://attack.mitre.org/campaigns/C0038) was a disruptive cyber campaign conducted by Iranian state-affiliated actors against Albanian government networks in July and September 2022. The activity combined ransomware, wiper malware, and data leak operations. Initial access for [HomeLand Justice](https://attack.mitre.org/campaigns/C0038) was established as early as May 2021, and threat actors moved laterally, exfiltrated sensitive information, and maintained persistence for approximately 14 months prior to the destructive phase of the operation. Responsibility was claimed by the \"HomeLand Justice\" front, which framed the campaign as retaliation against the Mujahedeen-e Khalq (MEK), an Iranian opposition group with a presence in Albania. Multiple Iran-nexus groups are assessed to have participated in the campaign, including [HEXANE](https://attack.mitre.org/groups/G1001) who probed victim infrastructure.(Citation: Mandiant ROADSWEEP August 2022)(Citation: Microsoft Albanian Government Attacks September 2022)(Citation: CISA Iran Albanian Attacks September 2022) A second wave of attacks was launched in September 2022 using similar tactics following public attribution of the previous activity to Iran and the severing of diplomatic ties between Iran and Albania.(Citation: CISA Iran Albanian Attacks September 2022)\n\n",
"aliases": [
"HomeLand Justice"
],
"first_seen": "2021-05-01 04:00:00+00:00",
"last_seen": "2022-09-01 04:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0038",
"external_id": "C0038"
},
{
"source_name": "CISA Iran Albanian Attacks September 2022",
"description": "CISA. (2022, September 23). AA22-264A Iranian State Actors Conduct Cyber Operations Against the Government of Albania. Retrieved August 6, 2024.",
"url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a"
},
{
"source_name": "Mandiant ROADSWEEP August 2022",
"description": "Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"
},
{
"source_name": "Microsoft Albanian Government Attacks September 2022",
"description": "MSTIC. (2022, September 8). Microsoft investigates Iranian attacks against the Albanian government. Retrieved August 6, 2024.",
"url": "https://www.microsoft.com/en-us/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Aung Kyaw Min Naing, @Nolan"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Mandiant ROADSWEEP August 2022)(Citation: Microsoft Albanian Government Attacks September 2022)(Citation: CISA Iran Albanian Attacks September 2022)",
"x_mitre_last_seen_citation": "(Citation: CISA Iran Albanian Attacks September 2022)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 21:13:10.649000+00:00\", \"old_value\": \"2026-04-23 02:24:58.492000+00:00\"}}, \"iterable_item_removed\": {\"root['x_mitre_domains'][1]\": \"ics-attack\"}}",
"previous_version": "1.1"
},
{
"type": "campaign",
"id": "campaign--4b7f9839-4822-4c19-8a1f-70bb61ba97e1",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-11-21 22:45:01.292000+00:00",
"modified": "2026-07-31 18:47:21.276000+00:00",
"name": "Indian Critical Infrastructure Intrusions",
"description": "[Indian Critical Infrastructure Intrusions](https://attack.mitre.org/campaigns/C0043) is a sequence of intrusions from 2021 through early 2022 linked to People\u2019s Republic of China (PRC) threat actors, particularly [RedEcho](https://attack.mitre.org/groups/G1042) and Threat Activity Group 38 (TAG38). The intrusions appear focused on IT system breach in Indian electric utility entities and logistics firms, as well as potentially managed service providers operating within India. Although focused on OT-operating entities, there is no evidence this campaign was able to progress beyond IT breach and information gathering to OT environment access.(Citation: RecordedFuture RedEcho 2021)(Citation: RecordedFuture RedEcho 2022)",
"aliases": [
"Indian Critical Infrastructure Intrusions"
],
"first_seen": "2021-01-01 07:00:00+00:00",
"last_seen": "2022-04-01 06:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0043",
"external_id": "C0043"
},
{
"source_name": "RecordedFuture RedEcho 2021",
"description": "Recorded Future Insikt Group. (2021, February). China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions. Retrieved November 21, 2024.",
"url": "https://go.recordedfuture.com/hubfs/reports/cta-2021-0228.pdf"
},
{
"source_name": "RecordedFuture RedEcho 2022",
"description": "Recorded Future Insikt Group. (2022, April 6). Continued Targeting of Indian Power Grid Assets by Chinese State-Sponsored Activity Group. Retrieved November 21, 2024.",
"url": "https://go.recordedfuture.com/hubfs/reports/ta-2022-0406.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: RecordedFuture RedEcho 2021)",
"x_mitre_last_seen_citation": "(Citation: RecordedFuture RedEcho 2022)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:21.276000+00:00\", \"old_value\": \"2025-03-13 20:55:26.608000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--58c4fd17-88f5-433a-8242-e9cac31f3c45",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-02-18 16:00:42.489000+00:00",
"modified": "2026-07-31 18:47:23.400000+00:00",
"name": "J-magic Campaign",
"description": "The [J-magic Campaign](https://attack.mitre.org/campaigns/C0050) was active from mid-2023 to at least mid-2024 and featured the use of the [J-magic](https://attack.mitre.org/software/S1203) backdoor, a custom cd00r variant tailored for use against Juniper routers. The [J-magic Campaign](https://attack.mitre.org/campaigns/C0050) targeted Junos OS routers serving as VPN gateways primarily in the semiconductor, energy, manufacturing, and IT sectors. (Citation: Lumen J-Magic JAN 2025)",
"aliases": [
"J-magic Campaign"
],
"first_seen": "2023-06-01 04:00:00+00:00",
"last_seen": "2024-06-01 04:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0050",
"external_id": "C0050"
},
{
"source_name": "Lumen J-Magic JAN 2025",
"description": "Black Lotus Labs. (2025, January 23). The J-Magic Show: Magic Packets and Where to find them. Retrieved February 17, 2025.",
"url": "https://blog.lumen.com/the-j-magic-show-magic-packets-and-where-to-find-them/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Lumen J-Magic JAN 2025)",
"x_mitre_last_seen_citation": "(Citation: Lumen J-Magic JAN 2025)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:23.400000+00:00\", \"old_value\": \"2025-02-19 20:00:20.463000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--7ab2f1a1-26af-4204-ad84-d640fde391da",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-11-25 20:35:10.872000+00:00",
"modified": "2026-07-31 21:13:47.266000+00:00",
"name": "Juicy Mix",
"description": "[Juicy Mix](https://attack.mitre.org/campaigns/C0044) was a campaign conducted by [OilRig](https://attack.mitre.org/groups/G0049) throughout 2022 that targeted Israeli organizations with the [Mango](https://attack.mitre.org/software/S1169) backdoor.(Citation: ESET OilRig Campaigns Sep 2023)",
"aliases": [
"Juicy Mix"
],
"first_seen": "2022-01-01 05:00:00+00:00",
"last_seen": "2022-12-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0044",
"external_id": "C0044"
},
{
"source_name": "ESET OilRig Campaigns Sep 2023",
"description": "Hromcova, Z. and Burgher, A. (2023, September 21). OilRig\u2019s Outer Space and Juicy Mix: Same ol\u2019 rig, new drill pipes. Retrieved November 21, 2024.",
"url": "https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: ESET OilRig Campaigns Sep 2023)",
"x_mitre_last_seen_citation": "(Citation: ESET OilRig Campaigns Sep 2023)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 21:13:47.266000+00:00\", \"old_value\": \"2024-11-25 22:05:20.281000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}, \"iterable_item_removed\": {\"root['x_mitre_domains'][1]\": \"ics-attack\"}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--0c259854-4044-4f6c-ac49-118d484b3e3b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-06-10 18:57:09.920000+00:00",
"modified": "2026-07-31 18:47:16.890000+00:00",
"name": "KV Botnet Activity",
"description": "[KV Botnet Activity](https://attack.mitre.org/campaigns/C0035) consisted of exploitation of primarily \u201cend-of-life\u201d small office-home office (SOHO) equipment from manufacturers such as Cisco, NETGEAR, and DrayTek. [KV Botnet Activity](https://attack.mitre.org/campaigns/C0035) was used by [Volt Typhoon](https://attack.mitre.org/groups/G1017) to obfuscate connectivity to victims in multiple critical infrastructure segments, including energy and telecommunication companies and entities based on the US territory of Guam. While the KV Botnet is the most prominent element of this campaign, it overlaps with another botnet cluster referred to as the JDY cluster.(Citation: Lumen KVBotnet 2023) This botnet was disrupted by US law enforcement entities in early 2024 after periods of activity from October 2022 through January 2024.(Citation: DOJ KVBotnet 2024)",
"aliases": [
"KV Botnet Activity"
],
"first_seen": "2022-10-01 04:00:00+00:00",
"last_seen": "2024-01-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0035",
"external_id": "C0035"
},
{
"source_name": "Lumen KVBotnet 2023",
"description": "Black Lotus Labs. (2023, December 13). Routers Roasting On An Open Firewall: The KV-Botnet Investigation. Retrieved June 10, 2024.",
"url": "https://blog.lumen.com/routers-roasting-on-an-open-firewall-the-kv-botnet-investigation/"
},
{
"source_name": "DOJ KVBotnet 2024",
"description": "US Department of Justice. (2024, January 31). U.S. Government Disrupts Botnet People\u2019s Republic of China Used to Conceal Hacking of Critical Infrastructure. Retrieved June 10, 2024.",
"url": "https://www.justice.gov/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Lumen KVBotnet 2023)",
"x_mitre_last_seen_citation": "(Citation: DOJ KVBotnet 2024)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:16.890000+00:00\", \"old_value\": \"2024-10-03 10:11:13.072000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--b66bc597-399c-4e4d-828a-1ed4a7f1fb15",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-02-03 19:41:59.392000+00:00",
"modified": "2026-07-31 18:47:32.005000+00:00",
"name": "Leviathan Australian Intrusions",
"description": "[Leviathan Australian Intrusions](https://attack.mitre.org/campaigns/C0049) consisted of at least two long-term intrusions against victims in Australia by [Leviathan](https://attack.mitre.org/groups/G0065), relying on similar tradecraft such as external service exploitation followed by extensive credential capture and re-use to enable privilege escalation and lateral movement. [Leviathan Australian Intrusions](https://attack.mitre.org/campaigns/C0049) were focused on exfiltrating sensitive data including valid credentials for the victim organizations.(Citation: CISA Leviathan 2024)",
"aliases": [
"Leviathan Australian Intrusions"
],
"first_seen": "2022-04-01 06:00:00+00:00",
"last_seen": "2022-09-01 06:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0049",
"external_id": "C0049"
},
{
"source_name": "CISA Leviathan 2024",
"description": "CISA et al. (2024, July 8). People\u2019s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action. Retrieved February 3, 2025.",
"url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: CISA Leviathan 2024)",
"x_mitre_last_seen_citation": "(Citation: CISA Leviathan 2024)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:32.005000+00:00\", \"old_value\": \"2025-03-14 12:46:03.740000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--ae407e32-87e0-4d92-8705-3ae25d504d8a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-09-08 13:31:37.391000+00:00",
"modified": "2026-07-31 18:47:29.891000+00:00",
"name": "Night Dragon",
"description": "[Night Dragon](https://attack.mitre.org/campaigns/C0002) was a cyber espionage campaign that targeted oil, energy, and petrochemical companies, along with individuals and executives in Kazakhstan, Taiwan, Greece, and the United States. The unidentified threat actors searched for information related to oil and gas field production systems, financials, and collected data from SCADA systems. Based on the observed techniques, tools, and network activities, security researchers assessed the campaign involved a threat group based in China.(Citation: McAfee Night Dragon)",
"aliases": [
"Night Dragon"
],
"first_seen": "2009-11-01 04:00:00+00:00",
"last_seen": "2011-02-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0002",
"external_id": "C0002"
},
{
"source_name": "McAfee Night Dragon",
"description": "McAfee\u00ae Foundstone\u00ae Professional Services and McAfee Labs\u2122. (2011, February 10). Global Energy Cyberattacks: \u201cNight Dragon\u201d. Retrieved February 19, 2018.",
"url": "https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: McAfee Night Dragon)",
"x_mitre_last_seen_citation": "(Citation: McAfee Night Dragon)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:29.891000+00:00\", \"old_value\": \"2024-04-11 00:36:23.822000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "campaign",
"id": "campaign--8a7c55ea-f363-4a03-b4c5-fa3fdb132d8f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-17 20:03:43.454000+00:00",
"modified": "2026-07-31 18:47:26.133000+00:00",
"name": "Operation AkaiRy\u016b",
"description": "[Operation AkaiRy\u016b](https://attack.mitre.org/campaigns/C0060) (Japanese for RedDragon) was a cyberespionage spearphishing campaign conducted by [MirrorFace](https://attack.mitre.org/groups/G1054) between June and September 2024 against entities in Japan and Central Europe. [Operation AkaiRy\u016b](https://attack.mitre.org/campaigns/C0060) notably included the first reported targeting of a European entity by [MirrorFace](https://attack.mitre.org/groups/G1054), as well as their use of [UPPERCUT](https://attack.mitre.org/software/S0275), which was thought to be exclusive to [menuPass](https://attack.mitre.org/groups/G0045).(Citation: ESET MirrorFace 2025)(Citation: Trend Micro Earth Kasha Anel NOV 2024)",
"aliases": [
"Operation AkaiRy\u016b",
"AkaiRy\u016b"
],
"first_seen": "2004-06-01 04:00:00+00:00",
"last_seen": "2004-09-01 04:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0060",
"external_id": "C0060"
},
{
"source_name": "ESET MirrorFace 2025",
"description": " Dominik Breitenbacher. (2025, March 18). Operation AkaiRy\u016b: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.",
"url": "https://www.welivesecurity.com/en/eset-research/operation-akairyu-mirrorface-invites-europe-expo-2025-revives-anel-backdoor/"
},
{
"source_name": "Trend Micro Earth Kasha Anel NOV 2024",
"description": "Hiroaki, H. (2024, November 26). Guess Who\u2019s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.",
"url": "https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Dominik Breitenbacher, ESET"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: ESET MirrorFace 2025)(Citation: Trend Micro Earth Kasha Anel NOV 2024)",
"x_mitre_last_seen_citation": "(Citation: ESET MirrorFace 2025)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:26.133000+00:00\", \"old_value\": \"2026-05-12 15:12:00.730000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--93c23946-49af-41f4-ac03-40f9ffc7419b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-09-22 20:07:47.208000+00:00",
"modified": "2026-07-31 18:47:27.459000+00:00",
"name": "Operation CuckooBees",
"description": "[Operation CuckooBees](https://attack.mitre.org/campaigns/C0012) was a cyber espionage campaign targeting technology and manufacturing companies in East Asia, Western Europe, and North America since at least 2019. Security researchers noted the goal of [Operation CuckooBees](https://attack.mitre.org/campaigns/C0012), which was still ongoing as of May 2022, was likely the theft of proprietary information, research and development documents, source code, and blueprints for various technologies. Researchers assessed [Operation CuckooBees](https://attack.mitre.org/campaigns/C0012) was conducted by actors affiliated with [Winnti Group](https://attack.mitre.org/groups/G0044), [APT41](https://attack.mitre.org/groups/G0096), and BARIUM.(Citation: Cybereason OperationCuckooBees May 2022)",
"aliases": [
"Operation CuckooBees"
],
"first_seen": "2019-12-01 07:00:00+00:00",
"last_seen": "2022-05-01 06:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0012",
"external_id": "C0012"
},
{
"source_name": "Cybereason OperationCuckooBees May 2022",
"description": "Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.",
"url": "https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-winnti-techniques"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Andrea Serrano Urea, Telef\u00f3nica Tech"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Cybereason OperationCuckooBees May 2022)",
"x_mitre_last_seen_citation": "(Citation: Cybereason OperationCuckooBees May 2022)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:27.459000+00:00\", \"old_value\": \"2025-04-16 20:37:46.274000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "campaign",
"id": "campaign--75ea699b-bff5-4541-b9b7-df4996c9db3c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-19 18:07:20.152000+00:00",
"modified": "2026-07-31 18:47:23.901000+00:00",
"name": "Operation Digital Eye",
"description": "[Operation Digital Eye](https://attack.mitre.org/campaigns/C0061) was conducted in June and July of 2024 by suspected People's Republic of China (PRC)-nexus threat actors targeting business-to-business IT service providers in Southern Europe. [Operation Digital Eye](https://attack.mitre.org/campaigns/C0061) activity included the use of Visual Studio Code tunnels for command and control (C2) and custom lateral movement capabilities. Overlaps in tooling between Digital Eye and previous China-nexus campaigns, Operation Soft Cell and Operation Tainted Love, indicate the potential use of shared vendors or digital quartermasters.(Citation: sentinelone operationDigitalEye Dec 2024)",
"aliases": [
"Operation Digital Eye"
],
"first_seen": "2024-06-01 04:00:00+00:00",
"last_seen": "2024-07-01 04:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0061",
"external_id": "C0061"
},
{
"source_name": "sentinelone operationDigitalEye Dec 2024",
"description": "Aleksandar Milenkoski, Luigi Martire. (2024, December 10). Operation Digital Eye | Chinese APT Compromises Critical Digital Infrastructure via Visual Studio Code Tunnels. Retrieved February 27, 2025.",
"url": "https://www.sentinelone.com/labs/operation-digital-eye-chinese-apt-compromises-critical-digital-infrastructure-via-visual-studio-code-tunnels/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: sentinelone operationDigitalEye Dec 2024)",
"x_mitre_last_seen_citation": "(Citation: sentinelone operationDigitalEye Dec 2024)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:23.901000+00:00\", \"old_value\": \"2026-04-24 02:28:18.653000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--0257b35b-93ef-4a70-80dd-ad5258e6045b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-03-17 13:37:42.596000+00:00",
"modified": "2026-07-31 21:14:21.859000+00:00",
"name": "Operation Dream Job",
"description": "[Operation Dream Job](https://attack.mitre.org/campaigns/C0022) was a cyber espionage operation likely conducted by [Lazarus Group](https://attack.mitre.org/groups/G0032) that targeted the defense, aerospace, government, and other sectors in the United States, Israel, Australia, Russia, and India. In at least one case, the cyber actors tried to monetize their network access to conduct a business email compromise (BEC) operation. In 2020, security researchers noted overlapping TTPs, to include fake job lures and code similarities, between [Operation Dream Job](https://attack.mitre.org/campaigns/C0022), Operation North Star, and Operation Interception; by 2022 security researchers described [Operation Dream Job](https://attack.mitre.org/campaigns/C0022) as an umbrella term covering both Operation Interception and Operation North Star.(Citation: ClearSky Lazarus Aug 2020)(Citation: McAfee Lazarus Jul 2020)(Citation: ESET Lazarus Jun 2020)(Citation: The Hacker News Lazarus Aug 2022)",
"aliases": [
"Operation Dream Job",
"Operation North Star",
"Operation Interception"
],
"first_seen": "2019-09-01 04:00:00+00:00",
"last_seen": "2020-08-01 04:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0022",
"external_id": "C0022"
},
{
"source_name": "Operation Interception",
"description": "(Citation: ESET Lazarus Jun 2020)"
},
{
"source_name": "Operation North Star",
"description": "(Citation: McAfee Lazarus Jul 2020)(Citation: McAfee Lazarus Nov 2020)"
},
{
"source_name": "McAfee Lazarus Nov 2020",
"description": "Beek, C. (2020, November 5). Operation North Star: Behind The Scenes. Retrieved December 20, 2021.",
"url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/"
},
{
"source_name": "ESET Lazarus Jun 2020",
"description": "Breitenbacher, D and Osis, K. (2020, June 17). OPERATION IN(TER)CEPTION: Targeted Attacks Against European Aerospace and Military Companies. Retrieved December 20, 2021.",
"url": "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_Operation_Interception.pdf"
},
{
"source_name": "McAfee Lazarus Jul 2020",
"description": "Cashman, M. (2020, July 29). Operation North Star Campaign. Retrieved December 20, 2021.",
"url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-a-job-offer-thats-too-good-to-be-true/?hilite=%27Operation%27%2C%27North%27%2C%27Star%27"
},
{
"source_name": "ClearSky Lazarus Aug 2020",
"description": "ClearSky Research Team. (2020, August 13). Operation 'Dream Job' Widespread North Korean Espionage Campaign. Retrieved December 20, 2021.",
"url": "https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"
},
{
"source_name": "The Hacker News Lazarus Aug 2022",
"description": "Lakshmanan, R. (2022, August 17). North Korea Hackers Spotted Targeting Job Seekers with macOS Malware. Retrieved April 10, 2023.",
"url": "https://thehackernews.com/2022/08/north-korea-hackers-spotted-targeting.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: ESET Lazarus Jun 2020)",
"x_mitre_last_seen_citation": "(Citation: ClearSky Lazarus Aug 2020)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 21:14:21.859000+00:00\", \"old_value\": \"2024-04-11 00:31:21.576000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}, \"iterable_item_removed\": {\"root['x_mitre_domains'][1]\": \"ics-attack\"}}",
"previous_version": "1.2"
},
{
"type": "campaign",
"id": "campaign--4603cf2f-06d0-4970-9c5d-5071b08c817f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-09-29 20:00:38.136000+00:00",
"modified": "2026-07-31 20:48:14.337000+00:00",
"name": "Operation Dust Storm",
"description": "[Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) was a long-standing persistent cyber espionage campaign that targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countries. By 2015, the [Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) threat actors shifted from government and defense-related intelligence targets to Japanese companies or Japanese subdivisions of larger foreign organizations supporting Japan's critical infrastructure, including electricity generation, oil and natural gas, finance, transportation, and construction.(Citation: Cylance Dust Storm)\n\n[Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) threat actors also began to use Android backdoors in their operations by 2015, with all identified victims at the time residing in Japan or South Korea.(Citation: Cylance Dust Storm)",
"aliases": [
"Operation Dust Storm"
],
"first_seen": "2010-01-01 07:00:00+00:00",
"last_seen": "2016-02-01 06:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0016",
"external_id": "C0016"
},
{
"source_name": "Cylance Dust Storm",
"description": "Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.",
"url": "https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_first_seen_citation": "(Citation: Cylance Dust Storm)",
"x_mitre_last_seen_citation": "(Citation: Cylance Dust Storm)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:14.337000+00:00\", \"old_value\": \"2024-04-11 00:30:42.003000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "campaign",
"id": "campaign--7854c1a0-f06c-4876-98a4-4bbd34751b05",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-03-23 17:51:58.539000+00:00",
"modified": "2026-07-31 18:47:24.650000+00:00",
"name": "Operation Ghost",
"description": "[Operation Ghost](https://attack.mitre.org/campaigns/C0023) was an [APT29](https://attack.mitre.org/groups/G0016) campaign starting in 2013 that included operations against ministries of foreign affairs in Europe and the Washington, D.C. embassy of a European Union country. During [Operation Ghost](https://attack.mitre.org/campaigns/C0023), [APT29](https://attack.mitre.org/groups/G0016) used new families of malware and leveraged web services, steganography, and unique C2 infrastructure for each victim.(Citation: ESET Dukes October 2019)\n",
"aliases": [
"Operation Ghost"
],
"first_seen": "2013-09-01 04:00:00+00:00",
"last_seen": "2019-10-01 04:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0023",
"external_id": "C0023"
},
{
"source_name": "ESET Dukes October 2019",
"description": "Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.",
"url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: ESET Dukes October 2019)",
"x_mitre_last_seen_citation": "(Citation: ESET Dukes October 2019)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:24.650000+00:00\", \"old_value\": \"2025-04-16 20:37:47.386000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--4553292d-12c6-4a93-934d-12160370d4e0",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-09-16 21:08:54.358000+00:00",
"modified": "2026-07-31 18:47:19.919000+00:00",
"name": "Operation Honeybee",
"description": "[Operation Honeybee](https://attack.mitre.org/campaigns/C0006) was a campaign that targeted humanitarian aid and inter-Korean affairs organizations from at least late 2017 through early 2018. [Operation Honeybee](https://attack.mitre.org/campaigns/C0006) initially targeted South Korea, but expanded to include Vietnam, Singapore, Japan, Indonesia, Argentina, and Canada. Security researchers assessed the threat actors were likely Korean speakers based on metadata used in both lure documents and executables, and named the campaign \"Honeybee\" after the author name discovered in malicious Word documents.(Citation: McAfee Honeybee) ",
"aliases": [
"Operation Honeybee"
],
"first_seen": "2017-08-01 05:00:00+00:00",
"last_seen": "2018-02-01 06:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0006",
"external_id": "C0006"
},
{
"source_name": "McAfee Honeybee",
"description": "Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018.",
"url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: McAfee Honeybee)",
"x_mitre_last_seen_citation": "(Citation: McAfee Honeybee)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:19.919000+00:00\", \"old_value\": \"2024-04-11 00:30:09.195000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "campaign",
"id": "campaign--455b011a-2510-49ab-a96f-2f84d6a80189",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-01-15 19:56:55.070000+00:00",
"modified": "2026-07-31 18:47:20.105000+00:00",
"name": "Operation MidnightEclipse",
"description": "[Operation MidnightEclipse](https://attack.mitre.org/campaigns/C0048) was a campaign conducted in March and April 2024 that involved initial exploit of zero-day vulnerability CVE-2024-3400, a critical command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS.(Citation: Volexity UPSTYLE 2024)(Citation: Palo Alto MidnightEclipse APR 2024)",
"aliases": [
"Operation MidnightEclipse"
],
"first_seen": "2024-03-01 05:00:00+00:00",
"last_seen": "2024-04-01 04:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0048",
"external_id": "C0048"
},
{
"source_name": "Palo Alto MidnightEclipse APR 2024",
"description": "Unit 42. (2024, April 12). Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 . Retrieved January 15, 2025.",
"url": "https://unit42.paloaltonetworks.com/cve-2024-3400/"
},
{
"source_name": "Volexity UPSTYLE 2024",
"description": "Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.",
"url": "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Volexity UPSTYLE 2024)",
"x_mitre_last_seen_citation": "(Citation: Volexity UPSTYLE 2024)(Citation: Palo Alto MidnightEclipse APR 2024)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:20.105000+00:00\", \"old_value\": \"2025-01-15 23:25:55.678000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--37764c78-2a99-46d1-a7ea-6454b9bf93a0",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-09-26 21:18:34.075000+00:00",
"modified": "2026-07-31 18:47:19.685000+00:00",
"name": "Operation Sharpshooter",
"description": "[Operation Sharpshooter](https://attack.mitre.org/campaigns/C0013) was a global cyber espionage campaign that targeted nuclear, defense, government, energy, and financial companies, with many located in Germany, Turkey, the United Kingdom, and the United States. Security researchers noted the campaign shared many similarities with previous [Lazarus Group](https://attack.mitre.org/groups/G0032) operations, including fake job recruitment lures and shared malware code.(Citation: McAfee Sharpshooter December 2018)(Citation: Bleeping Computer Op Sharpshooter March 2019)(Citation: Threatpost New Op Sharpshooter Data March 2019) ",
"aliases": [
"Operation Sharpshooter"
],
"first_seen": "2017-09-01 05:00:00+00:00",
"last_seen": "2019-03-01 06:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0013",
"external_id": "C0013"
},
{
"source_name": "Bleeping Computer Op Sharpshooter March 2019",
"description": "I. Ilascu. (2019, March 3). Op 'Sharpshooter' Connected to North Korea's Lazarus Group. Retrieved September 26, 2022.",
"url": "https://www.bleepingcomputer.com/news/security/op-sharpshooter-connected-to-north-koreas-lazarus-group/"
},
{
"source_name": "Threatpost New Op Sharpshooter Data March 2019",
"description": "L. O'Donnell. (2019, March 3). RSAC 2019: New Operation Sharpshooter Data Reveals Higher Complexity, Scope. Retrieved September 26, 2022.",
"url": "https://threatpost.com/sharpshooter-complexity-scope/142359/"
},
{
"source_name": "McAfee Sharpshooter December 2018",
"description": "Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.",
"url": "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Threatpost New Op Sharpshooter Data March 2019)",
"x_mitre_last_seen_citation": "(Citation: Threatpost New Op Sharpshooter Data March 2019)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:19.685000+00:00\", \"old_value\": \"2025-04-16 20:37:47.743000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--4c840263-bbda-440d-a22b-674679ddebf1",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-09-16 15:32:41.893000+00:00",
"modified": "2026-07-31 18:47:21.598000+00:00",
"name": "Operation Spalax",
"description": "[Operation Spalax](https://attack.mitre.org/campaigns/C0005) was a campaign that primarily targeted Colombian government organizations and private companies, particularly those associated with the energy and metallurgical industries. The [Operation Spalax](https://attack.mitre.org/campaigns/C0005) threat actors distributed commodity malware and tools using generic phishing topics related to COVID-19, banking, and law enforcement action. Security researchers noted indicators of compromise and some infrastructure overlaps with other campaigns dating back to April 2018, including at least one separately attributed to [APT-C-36](https://attack.mitre.org/groups/G0099), however identified enough differences to report this as separate, unattributed activity.(Citation: ESET Operation Spalax Jan 2021) ",
"aliases": [
"Operation Spalax"
],
"first_seen": "2019-11-01 05:00:00+00:00",
"last_seen": "2021-01-01 06:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0005",
"external_id": "C0005"
},
{
"source_name": "ESET Operation Spalax Jan 2021",
"description": "M. Porolli. (2021, January 21). Operation Spalax: Targeted malware attacks in Colombia. Retrieved September 16, 2022.",
"url": "https://www.welivesecurity.com/2021/01/12/operation-spalax-targeted-malware-attacks-colombia/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: ESET Operation Spalax Jan 2021)",
"x_mitre_last_seen_citation": "(Citation: ESET Operation Spalax Jan 2021)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:21.598000+00:00\", \"old_value\": \"2026-05-12 15:12:00.730000+00:00\"}}}",
"previous_version": "1.1"
},
{
"type": "campaign",
"id": "campaign--b03d5112-e23a-4ac8-add0-be7502d24eff",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-09-27 14:15:23.984000+00:00",
"modified": "2026-07-31 18:47:30.910000+00:00",
"name": "Operation Wocao",
"description": "[Operation Wocao](https://attack.mitre.org/campaigns/C0014) was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and the United States. The suspected China-based actors compromised government organizations and managed service providers, as well as aviation, construction, energy, finance, health care, insurance, offshore engineering, software development, and transportation companies.(Citation: FoxIT Wocao December 2019)\n\nSecurity researchers assessed the [Operation Wocao](https://attack.mitre.org/campaigns/C0014) actors used similar TTPs and tools as APT20, suggesting a possible overlap. [Operation Wocao](https://attack.mitre.org/campaigns/C0014) was named after an observed command line entry by one of the threat actors, possibly out of frustration from losing webshell access.(Citation: FoxIT Wocao December 2019)",
"aliases": [
"Operation Wocao"
],
"first_seen": "2017-12-01 05:00:00+00:00",
"last_seen": "2019-12-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0014",
"external_id": "C0014"
},
{
"source_name": "FoxIT Wocao December 2019",
"description": "Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China\u2019s hidden hacking groups. Retrieved October 8, 2020.",
"url": "https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Erik Schamper, @Schamperr, Fox-IT",
"Maarten van Dantzig, @MaartenVDantzig, Fox-IT"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: FoxIT Wocao December 2019)",
"x_mitre_last_seen_citation": "(Citation: FoxIT Wocao December 2019)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:30.910000+00:00\", \"old_value\": \"2026-05-12 15:12:00.730000+00:00\"}}}",
"previous_version": "1.2"
},
{
"type": "campaign",
"id": "campaign--a1f5df89-ec82-45ef-b229-4ca6a407dc4f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-11-21 21:08:27.153000+00:00",
"modified": "2026-07-31 21:15:08.800000+00:00",
"name": "Outer Space",
"description": "[Outer Space](https://attack.mitre.org/campaigns/C0042) was a campaign conducted by [OilRig](https://attack.mitre.org/groups/G0049) throughout 2021 that used the [SampleCheck5000](https://attack.mitre.org/software/S1168) downloader and [Solar](https://attack.mitre.org/software/S1166) backdoor to target Israeli organizations.(Citation: ESET OilRig Campaigns Sep 2023)",
"aliases": [
"Outer Space"
],
"first_seen": "2021-01-01 05:00:00+00:00",
"last_seen": "2021-12-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0042",
"external_id": "C0042"
},
{
"source_name": "ESET OilRig Campaigns Sep 2023",
"description": "Hromcova, Z. and Burgher, A. (2023, September 21). OilRig\u2019s Outer Space and Juicy Mix: Same ol\u2019 rig, new drill pipes. Retrieved November 21, 2024.",
"url": "https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: ESET OilRig Campaigns Sep 2023)",
"x_mitre_last_seen_citation": "(Citation: ESET OilRig Campaigns Sep 2023)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 21:15:08.800000+00:00\", \"old_value\": \"2024-11-25 22:07:13.513000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}, \"iterable_item_removed\": {\"root['x_mitre_domains'][1]\": \"ics-attack\"}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--81e89fb4-8d07-4d8a-82f4-bf084f9d5d53",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-07-17 19:42:07.269000+00:00",
"modified": "2026-07-31 18:47:25.913000+00:00",
"name": "Pikabot Distribution February 2024",
"description": "[Pikabot](https://attack.mitre.org/software/S1145) was distributed in [Pikabot Distribution February 2024](https://attack.mitre.org/campaigns/C0036) using malicious emails with embedded links leading to malicious ZIP archives requiring user interaction for follow-on infection. The version of [Pikabot](https://attack.mitre.org/software/S1145) distributed featured significant changes over the 2023 variant, including reduced code complexity and simplified obfuscation mechanisms.(Citation: Elastic Pikabot 2024)(Citation: Zscaler Pikabot 2024)",
"aliases": [
"Pikabot Distribution February 2024"
],
"first_seen": "2024-02-01 05:00:00+00:00",
"last_seen": "2024-02-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0036",
"external_id": "C0036"
},
{
"source_name": "Elastic Pikabot 2024",
"description": "Daniel Stepanic & Salim Bitam. (2024, February 23). PIKABOT, I choose you!. Retrieved July 12, 2024.",
"url": "https://www.elastic.co/security-labs/pikabot-i-choose-you"
},
{
"source_name": "Zscaler Pikabot 2024",
"description": "Nikolaos Pantazopoulos. (2024, February 12). The (D)Evolution of Pikabot. Retrieved July 17, 2024.",
"url": "https://www.zscaler.com/blogs/security-research/d-evolution-pikabot"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Inna Danilevich, U.S. Bank"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Elastic Pikabot 2024)",
"x_mitre_last_seen_citation": "(Citation: Elastic Pikabot 2024)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:25.913000+00:00\", \"old_value\": \"2024-10-28 19:02:07.114000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--e7511089-1076-4a3b-984d-1a0a8afe31e9",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-06-04 16:03:15.537000+00:00",
"modified": "2026-07-31 18:47:33.282000+00:00",
"name": "Quad7 Activity",
"description": " Quad7 Activity, also known as CovertNetwork-1658 or the 7777 Botnet, is a network of compromised small office/home office (SOHO) routers. (Citation: Bitsight 7777 Botnet) (Citation: Microsoft Storm-0940) The botnet was initially composed primarily of TP-Link routers and was named Quad7 due to compromised devices exposing TCP port 7777 with the distinctive banner xlogin. Later activity showed a significant increase in compromised Asus routers and the addition of new ports and banners, including TCP port 63256 displaying alogin. Quad7 infrastructure functions as a collection of egress IPs that various China-affiliated threat actors have used to conduct password-spraying and brute-force operations. (Citation: Bitsight 7777 Botnet)(Citation: Medium 777-Botnet) Microsoft has reported that Storm-0940 leveraged credentials obtained through Quad7 Activity to target organizations in North America and Europe, including government agencies, non-governmental organizations, think tanks, law firms, energy firms, IT providers, and defense industrial base entities. (Citation: Microsoft Storm-0940)",
"aliases": [
"Quad7 Activity"
],
"first_seen": "2023-08-01 04:00:00+00:00",
"last_seen": "2025-08-01 04:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0055",
"external_id": "C0055"
},
{
"source_name": "Bitsight 7777 Botnet",
"description": "Batista, Jo\u00e3o. Gi7w0rm. (2024, August 27). Retrieved June 5, 2025.",
"url": "https://www.bitsight.com/blog/7777-botnet-insights-multi-target-botnet"
},
{
"source_name": "Medium 777-Botnet",
"description": "Gi7w0rm. (2023, October 19). The curious case of the 7777-Botnet. Retrieved June 5, 2025.",
"url": "https://gi7w0rm.medium.com/the-curious-case-of-the-7777-botnet-86e3464c3ffd"
},
{
"source_name": "Microsoft Storm-0940",
"description": "Microsoft Threat Intelligence. (2024, October 31). Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network. Retrieved June 4, 2025.",
"url": "https://www.microsoft.com/en-us/security/blog/2024/10/31/chinese-threat-actor-storm-0940-uses-credentials-from-password-spray-attacks-from-a-covert-network/"
},
{
"source_name": "TP-Link Quad 7 AUG 2025",
"description": "TP-Link . (2025, August 29). Technical News and Reports about Quad 7 (7777) Botnet aka CovertNetwork-1658. Retrieved October 10, 2025.",
"url": "https://www.tp-link.com/us/support/faq/4365/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Microsoft Storm-0940)",
"x_mitre_last_seen_citation": "(Citation: TP-Link Quad 7 AUG 2025)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:33.282000+00:00\", \"old_value\": \"2025-10-24 03:37:52.324000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--276671b5-5425-48db-ad65-c8c2564a969b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-01-14 22:38:27.986000+00:00",
"modified": "2026-07-31 18:47:18.644000+00:00",
"name": "RedDelta Modified PlugX Infection Chain Operations",
"description": "[RedDelta Modified PlugX Infection Chain Operations](https://attack.mitre.org/campaigns/C0047) was executed by [Mustang Panda](https://attack.mitre.org/groups/G0129) from mid-2023 through the end of 2024 against multiple entities in East and Southeast Asia. [RedDelta Modified PlugX Infection Chain Operations](https://attack.mitre.org/campaigns/C0047) involved phishing to deliver malicious files or links to users prompting follow-on installer downloads to load [PlugX](https://attack.mitre.org/software/S0013) on victim machines in a persistent state.(Citation: Recorded Future RedDelta 2025)",
"aliases": [
"RedDelta Modified PlugX Infection Chain Operations"
],
"first_seen": "2023-07-01 06:00:00+00:00",
"last_seen": "2024-12-01 07:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0047",
"external_id": "C0047"
},
{
"source_name": "Recorded Future RedDelta 2025",
"description": "Insikt Group. (2025, January 9). Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain. Retrieved January 14, 2025.",
"url": "https://go.recordedfuture.com/hubfs/reports/cta-cn-2025-0109.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Recorded Future RedDelta 2025)",
"x_mitre_last_seen_citation": "(Citation: Recorded Future RedDelta 2025)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:18.644000+00:00\", \"old_value\": \"2025-04-02 15:50:35.356000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--35879bf3-0a21-4cc1-9e42-6de917a22501",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-06-24 15:14:52.789000+00:00",
"modified": "2026-07-31 18:47:19.448000+00:00",
"name": "RedPenguin",
"description": "The [RedPenguin](https://attack.mitre.org/campaigns/C0056) project was launched by Juniper in July 2024 to investigate reported malware infections of Juniper MX Series routers. [RedPenguin](https://attack.mitre.org/campaigns/C0056) activity was separately attributed to [UNC3886](https://attack.mitre.org/groups/G1048) and included the deployment of multiple custom versions of the publicly-available TINYSHELL backdoor on Juniper routers.(Citation: Juniper RedPenguin MAR 2025)(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)",
"aliases": [
"RedPenguin"
],
"first_seen": "2024-07-01 04:00:00+00:00",
"last_seen": "2025-03-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0056",
"external_id": "C0056"
},
{
"source_name": "Juniper RedPenguin MAR 2025",
"description": "Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.",
"url": "https://supportportal.juniper.net/sfc/servlet.shepherd/document/download/069Dp00000FzdmIIAR?operationContext=S1"
},
{
"source_name": "Mandiant UNC3886 Juniper Routers MAR 2025",
"description": "Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Juniper RedPenguin MAR 2025)(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)",
"x_mitre_last_seen_citation": "(Citation: Juniper RedPenguin MAR 2025)(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:19.448000+00:00\", \"old_value\": \"2026-05-12 15:12:00.729000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--83e1f587-34da-44cc-b65b-a72479cb1616",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-03-25 22:32:28.946000+00:00",
"modified": "2026-07-31 18:47:26.080000+00:00",
"name": "SPACEHOP Activity",
"description": "[SPACEHOP Activity](https://attack.mitre.org/campaigns/C0052) is conducted through commercially leased Virtual Private Servers (VPS), otherwise known as provisioned Operational Relay Box (ORB) networks. The network leveraged for SPACEHOP Activity enabled China-nexus cyber threat actors \u2013 such as [APT5](https://attack.mitre.org/groups/G1023) and [Ke3chang](https://attack.mitre.org/groups/G0004) \u2013 to perform network reconnaissance scanning and vulnerability exploitation. SPACEHOP Activity has historically targeted entities in North America, Europe, and the Middle East.(Citation: ORB Mandiant) ",
"aliases": [
"SPACEHOP Activity"
],
"first_seen": "2019-01-01 05:00:00+00:00",
"last_seen": "2024-05-01 04:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0052",
"external_id": "C0052"
},
{
"source_name": "ORB Mandiant",
"description": "Raggi, Michael. (2024, May 22). IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders. Retrieved July 8, 2024.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-orb-networks"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: ORB Mandiant)",
"x_mitre_last_seen_citation": "(Citation: ORB Mandiant)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:26.080000+00:00\", \"old_value\": \"2025-03-27 21:18:00.302000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--9cea8bec-07c5-422b-84b8-99d3128ce570",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-10-22 14:02:44.965000+00:00",
"modified": "2026-07-31 20:48:17.935000+00:00",
"name": "Salesforce Data Exfiltration",
"description": "The [Salesforce Data Exfiltration](https://attack.mitre.org/campaigns/C0059) campaign began in October 2024 with financially-motivated threat actor UNC6040 using [Spearphishing Voice](https://attack.mitre.org/techniques/T1598/004) (vishing) to compromise corporate Salesforce instances for large-scale data theft and extortion. Following the initial data theft, victim organizations received extortion demands from a separate threat actor, UNC6240, who claimed to be the \u201cShinyHunters\u201d group. The observed infrastructure and TTPs used during the [Salesforce Data Exfiltration](https://attack.mitre.org/campaigns/C0059) campaign overlap with those used by threat groups with suspected ties to the broader collective known as \"The Com.\u201d These overlaps could plausibly be the result of associated actors operating within the same communities and are not necessarily an indication of a direct operational relationship.(Citation: FBI Salesforce Data Theft SEP 2025)(Citation: Google Salesforce JUN 2025)",
"aliases": [
"Salesforce Data Exfiltration"
],
"first_seen": "2004-10-01 04:00:00+00:00",
"last_seen": "2025-09-01 04:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0059",
"external_id": "C0059"
},
{
"source_name": "FBI Salesforce Data Theft SEP 2025",
"description": "FBI Cyber Division. (2025, September 12). Cyber Criminal Groups UNC6040 and UNC6395 Compromising Salesforce Instances for Data Theft and Extortion. Retrieved October 22, 2025.",
"url": "https://www.ic3.gov/CSA/2025/250912.pdf"
},
{
"source_name": "Google Salesforce JUN 2025",
"description": "Google Threat Intelligence Group. (2025, June 4). The Cost of a Call: From Voice Phishing to Data Extortion. Retrieved October 22, 2025.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: FBI Salesforce Data Theft SEP 2025)",
"x_mitre_last_seen_citation": "(Citation: FBI Salesforce Data Theft SEP 2025)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:17.935000+00:00\", \"old_value\": \"2025-10-24 04:09:52.046000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--57899965-b171-48ed-bbb4-8faffa3d836a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-12-02 19:35:14.473000+00:00",
"modified": "2026-07-31 18:47:22.958000+00:00",
"name": "ShadowRay",
"description": "[ShadowRay](https://attack.mitre.org/campaigns/C0045) was a campaign that began in late 2023 targeting the education, cryptocurrency, biopharma, and other sectors through a vulnerability (CVE-2023-48022) in the Ray AI framework named ShadowRay. According to security researchers [ShadowRay](https://attack.mitre.org/campaigns/C0045) was the first known instance of AI workloads being activley exploited in the wild through vulnerabilities in AI infrastructure. CVE-2023-48022, which allows access to compute resources and sensitive data for exposed instances, remains unpatched and has been disputed by the vendor as they maintain that Ray is not intended for use outside of a strictly controlled network environment.(Citation: Oligo ShadowRay Campaign MAR 2024)",
"aliases": [
"ShadowRay"
],
"first_seen": "2023-09-01 04:00:00+00:00",
"last_seen": "2024-03-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0045",
"external_id": "C0045"
},
{
"source_name": "Oligo ShadowRay Campaign MAR 2024",
"description": "Lumelsly, A. et al. (2024, March 26). ShadowRay: First Known Attack Campaign Targeting AI Workloads Actively Exploited In The Wild. Retrieved December 2, 2024.",
"url": "https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Shun Miyazaki, NEC Corporation",
"Sareena Karapoola, NEC Corporation India",
"Pooja Natarajan, NEC Corporation India"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Oligo ShadowRay Campaign MAR 2024)",
"x_mitre_last_seen_citation": "(Citation: Oligo ShadowRay Campaign MAR 2024)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:22.958000+00:00\", \"old_value\": \"2024-12-02 22:01:07.830000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--1a0576df-df21-4775-843e-844d8a58a94b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-10-15 19:31:55.608000+00:00",
"modified": "2026-07-31 18:47:16.890000+00:00",
"name": "SharePoint ToolShell Exploitation",
"description": "The [SharePoint ToolShell Exploitation](https://attack.mitre.org/campaigns/C0058) campaign was conducted in July 2025 and encompassed the first waves of exploitation against incompletely patched spoofing (CVE-2025-49706) and remote code execution (CVE-2025-49704) vulnerabilities affecting on-premises Microsoft SharePoint servers. Later patched and updated as CVE-2025-53770 and CVE-2025-53771, the ToolShell vulnerabilities were widely exploited including by China-based ransomware actor Storm-2603 and espionage actors [Threat Group-3390](https://attack.mitre.org/groups/G0027) and [ZIRCONIUM](https://attack.mitre.org/groups/G0128). [SharePoint ToolShell Exploitation](https://attack.mitre.org/campaigns/C0058) targeted multiple regions and industries including finance, education, energy, and healthcare across Asia, Europe, and the United States.(Citation: Microsoft SharePoint Exploit JUL 2025)(Citation: Palo Alto SharePoint Vulnerabilities JUL 2025)(Citation: Eye Research ToolShell JUL 2025)(Citation: ESET ToolShell JUL 2025)(Citation: Trend Micro SharePoint Attacks JUL 2025)\n",
"aliases": [
"SharePoint ToolShell Exploitation"
],
"first_seen": "2025-07-01 04:00:00+00:00",
"last_seen": "2025-07-01 04:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0058",
"external_id": "C0058"
},
{
"source_name": "Trend Micro SharePoint Attacks JUL 2025",
"description": " Trend Micro Research. (2022, July 22). Proactive Security Insights for SharePoint Attacks (CVE-2025-53770 and CVE-2025-53771). Retrieved October 15, 2025.",
"url": "https://www.trendmicro.com/en_us/research/25/g/cve-2025-53770-and-cve-2025-53771-sharepoint-attacks.html"
},
{
"source_name": "ESET ToolShell JUL 2025",
"description": "ESET Research. (2025, July 24). ToolShell: An all-you-can-eat buffet for threat actors. Retrieved October 15, 2025.",
"url": "https://www.welivesecurity.com/en/eset-research/toolshell-an-all-you-can-eat-buffet-for-threat-actors/"
},
{
"source_name": "Eye Research ToolShell JUL 2025",
"description": "Eye Security. (2025, July 19). SharePoint Under Siege: ToolShell Exploit (CVE-2025-49706 & CVE-2025-49704). Retrieved October 15, 2025.",
"url": "https://research.eye.security/sharepoint-under-siege/"
},
{
"source_name": "Microsoft SharePoint Exploit JUL 2025",
"description": "Microsoft Threat Intelligence. (2025, July 22). Disrupting active exploitation of on-premises SharePoint vulnerabilities. Retrieved October 15, 2025.",
"url": "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/#storm-2603"
},
{
"source_name": "Palo Alto SharePoint Vulnerabilities JUL 2025",
"description": "Unit 42. (2025, July 31). Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated). Retrieved October 15, 2025.",
"url": "https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Wai Linn Oo, Kernellix Co.,Ltd."
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Microsoft SharePoint Exploit JUL 2025)",
"x_mitre_last_seen_citation": "(Citation: Palo Alto SharePoint Vulnerabilities JUL 2025)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:16.890000+00:00\", \"old_value\": \"2026-04-23 18:46:50.936000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--808d6b30-df4e-4341-8248-724da4bac650",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-03-24 14:59:26.744000+00:00",
"modified": "2026-07-31 18:47:25.784000+00:00",
"name": "SolarWinds Compromise",
"description": "The [SolarWinds Compromise](https://attack.mitre.org/campaigns/C0024) was a sophisticated supply chain cyber operation conducted by [APT29](https://attack.mitre.org/groups/G0016) that was discovered in mid-December 2020. [APT29](https://attack.mitre.org/groups/G0016) used customized malware to inject malicious code into the SolarWinds Orion software build process that was later distributed through a normal software update; they also used password spraying, token theft, API abuse, spear phishing, and other supply chain attacks to compromise user accounts and leverage their associated access. Victims of this campaign included government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East. This activity has been labled the StellarParticle campaign in industry reporting.(Citation: CrowdStrike StellarParticle January 2022) Industry reporting also initially referred to the actors involved in this campaign as UNC2452, NOBELIUM, Dark Halo, and SolarStorm.(Citation: SolarWinds Advisory Dec 2020)(Citation: SolarWinds Sunburst Sunspot Update January 2021)(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Volexity SolarWinds)(Citation: CrowdStrike StellarParticle January 2022)(Citation: Unit 42 SolarStorm December 2020)(Citation: Microsoft Analyzing Solorigate Dec 2020)(Citation: Microsoft Internal Solorigate Investigation Blog) \n\nIn April 2021, the US and UK governments attributed the [SolarWinds Compromise](https://attack.mitre.org/campaigns/C0024) to Russia's Foreign Intelligence Service (SVR); public statements included citations to [APT29](https://attack.mitre.org/groups/G0016), Cozy Bear, and The Dukes.(Citation: NSA Joint Advisory SVR SolarWinds April 2021)(Citation: UK NSCS Russia SolarWinds April 2021)(Citation: Mandiant UNC2452 APT29 April 2022) The US government assessed that of the approximately 18,000 affected public and private sector customers of Solar Winds\u2019 Orion product, a much smaller number were compromised by follow-on [APT29](https://attack.mitre.org/groups/G0016) activity on their systems.(Citation: USG Joint Statement SolarWinds January 2021) ",
"aliases": [
"SolarWinds Compromise"
],
"first_seen": "2019-08-01 05:00:00+00:00",
"last_seen": "2021-01-01 06:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0024",
"external_id": "C0024"
},
{
"source_name": "Volexity SolarWinds",
"description": "Cash, D. et al. (2020, December 14). Dark Halo Leverages SolarWinds Compromise to Breach Organizations. Retrieved December 29, 2020.",
"url": "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/"
},
{
"source_name": "CrowdStrike StellarParticle January 2022",
"description": "CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022.",
"url": "https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/"
},
{
"source_name": "USG Joint Statement SolarWinds January 2021",
"description": "FBI, CISA, ODNI, NSA. (2022, January 5). Joint Statement by the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Office of the Director of National Intelligence (ODNI), and the National Security Agency (NSA). Retrieved March 26, 2023.",
"url": "https://www.cisa.gov/news-events/news/joint-statement-federal-bureau-investigation-fbi-cybersecurity-and-infrastructure"
},
{
"source_name": "FireEye SUNBURST Backdoor December 2020",
"description": "FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.",
"url": "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
},
{
"source_name": "Mandiant UNC2452 APT29 April 2022",
"description": "Mandiant. (2022, April 27). Assembling the Russian Nesting Doll: UNC2452 Merged into APT29. Retrieved March 26, 2023.",
"url": "https://www.mandiant.com/resources/blog/unc2452-merged-into-apt29"
},
{
"source_name": "MSTIC NOBELIUM May 2021",
"description": "Microsoft Threat Intelligence Center (MSTIC). (2021, May 27). New sophisticated email-based attack from NOBELIUM. Retrieved May 28, 2021.",
"url": "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
},
{
"source_name": "Microsoft Internal Solorigate Investigation Blog",
"description": "MSRC Team. (2021, February 18). Microsoft Internal Solorigate Investigation \u2013 Final Update. Retrieved May 14, 2021.",
"url": "https://msrc-blog.microsoft.com/2021/02/18/microsoft-internal-solorigate-investigation-final-update/"
},
{
"source_name": "Microsoft Analyzing Solorigate Dec 2020",
"description": "MSTIC. (2020, December 18). Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers . Retrieved January 5, 2021.",
"url": "https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/"
},
{
"source_name": "NSA Joint Advisory SVR SolarWinds April 2021",
"description": "NSA, FBI, DHS. (2021, April 15). Russian SVR Targets U.S. and Allied Networks. Retrieved April 16, 2021.",
"url": "https://media.defense.gov/2021/Apr/15/2002621240/-1/-1/0/CSA_SVR_TARGETS_US_ALLIES_UOO13234021.PDF/CSA_SVR_TARGETS_US_ALLIES_UOO13234021.PDF"
},
{
"source_name": "SolarWinds Advisory Dec 2020",
"description": "SolarWinds. (2020, December 24). SolarWinds Security Advisory. Retrieved February 22, 2021.",
"url": "https://www.solarwinds.com/sa-overview/securityadvisory"
},
{
"source_name": "SolarWinds Sunburst Sunspot Update January 2021",
"description": "Sudhakar Ramakrishna . (2021, January 11). New Findings From Our Investigation of SUNBURST. Retrieved January 13, 2021.",
"url": "https://orangematter.solarwinds.com/2021/01/11/new-findings-from-our-investigation-of-sunburst/"
},
{
"source_name": "UK NSCS Russia SolarWinds April 2021",
"description": "UK NCSC. (2021, April 15). UK and US call out Russia for SolarWinds compromise. Retrieved April 16, 2021.",
"url": "https://www.ncsc.gov.uk/news/uk-and-us-call-out-russia-for-solarwinds-compromise"
},
{
"source_name": "Unit 42 SolarStorm December 2020",
"description": "Unit 42. (2020, December 23). SolarStorm Supply Chain Attack Timeline. Retrieved March 24, 2023.",
"url": "https://unit42.paloaltonetworks.com/solarstorm-supply-chain-attack-timeline/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Unit 42 SolarStorm December 2020)",
"x_mitre_last_seen_citation": "(Citation: MSTIC NOBELIUM May 2021)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:25.784000+00:00\", \"old_value\": \"2025-09-19 15:16:28.463000+00:00\"}}}",
"previous_version": "1.1"
},
{
"type": "campaign",
"id": "campaign--45a98f02-852f-49b2-94c0-c63207bebbbf",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-25 17:47:37.619000+00:00",
"modified": "2026-07-31 20:48:13.868000+00:00",
"name": "Triton Safety Instrumented System Attack",
"description": "[Triton Safety Instrumented System Attack](https://attack.mitre.org/campaigns/C0030) was a campaign employed by [TEMP.Veles](https://attack.mitre.org/groups/G0088) which leveraged the [Triton](https://attack.mitre.org/software/S1009) malware framework against a petrochemical organization.(Citation: Triton-EENews-2017) The malware and techniques used within this campaign targeted specific Triconex [Safety Controller](https://attack.mitre.org/assets/A0010)s within the environment.(Citation: FireEye TRITON 2018) The incident was eventually discovered due to a safety trip that occurred as a result of an issue in the malware.(Citation: FireEye TRITON 2017)\n",
"aliases": [
"Triton Safety Instrumented System Attack"
],
"first_seen": "2017-06-01 04:00:00+00:00",
"last_seen": "2017-08-01 04:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0030",
"external_id": "C0030"
},
{
"source_name": "Triton-EENews-2017",
"description": "Blake Sobczak. (2019, March 7). The inside story of the world\u2019s most dangerous malware. Retrieved March 25, 2024.",
"url": "https://www.eenews.net/articles/the-inside-story-of-the-worlds-most-dangerous-malware/"
},
{
"source_name": "FireEye TRITON 2017",
"description": "Johnson, B, et. al. (2017, December 14). Attackers Deploy New ICS Attack Framework \"TRITON\" and Cause Operational Disruption to Critical Infrastructure. Retrieved January 6, 2021.",
"url": "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html"
},
{
"source_name": "FireEye TRITON 2018",
"description": "Miller, S. Reese, E. (2018, June 7). A Totally Tubular Treatise on TRITON and TriStation. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20200618231942/https://www.fireeye.com/blog/threat-research/2018/06/totally-tubular-treatise-on-triton-and-tristation.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_first_seen_citation": "(Citation: Triton-EENews-2017)",
"x_mitre_last_seen_citation": "(Citation: Triton-EENews-2017)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:13.868000+00:00\", \"old_value\": \"2026-05-12 15:12:00.729000+00:00\"}}}",
"previous_version": "1.1"
},
{
"type": "campaign",
"id": "campaign--af0ec65a-caa9-40ef-b1c7-21b71fbf3a10",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-08-27 18:34:35.056000+00:00",
"modified": "2026-07-31 18:47:29.960000+00:00",
"name": "Versa Director Zero Day Exploitation",
"description": "[Versa Director Zero Day Exploitation](https://attack.mitre.org/campaigns/C0039) was conducted by [Volt Typhoon](https://attack.mitre.org/groups/G1017) from early June through August 2024 as zero-day exploitation of Versa Director servers controlling software-defined wide area network (SD-WAN) applications. Since tracked as CVE-2024-39717, exploitation focused on credential capture from compromised Versa Director servers at managed service providers (MSPs) and internet service providers (ISPs) to enable follow-on access to service provider clients. [Versa Director Zero Day Exploitation](https://attack.mitre.org/campaigns/C0039) was followed by the delivery of the [VersaMem](https://attack.mitre.org/software/S1154) web shell for both credential theft and follow-on code execution.(Citation: Lumen Versa 2024)",
"aliases": [
"Versa Director Zero Day Exploitation"
],
"first_seen": "2024-06-01 06:00:00+00:00",
"last_seen": "2024-08-01 06:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0039",
"external_id": "C0039"
},
{
"source_name": "Lumen Versa 2024",
"description": "Black Lotus Labs. (2024, August 27). Taking The Crossroads: The Versa Director Zero-Day Exploitaiton. Retrieved August 27, 2024.",
"url": "https://blog.lumen.com/taking-the-crossroads-the-versa-director-zero-day-exploitation/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: Lumen Versa 2024)",
"x_mitre_last_seen_citation": "(Citation: Lumen Versa 2024)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:29.960000+00:00\", \"old_value\": \"2024-09-28 09:54:33.751000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--57541e3b-657e-463a-a4ab-ca08d7ea9965",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-07-17 20:23:22.945000+00:00",
"modified": "2026-07-31 18:47:22.789000+00:00",
"name": "Water Curupira Pikabot Distribution",
"description": "[Pikabot](https://attack.mitre.org/software/S1145) was distributed in [Water Curupira Pikabot Distribution](https://attack.mitre.org/campaigns/C0037) throughout 2023 by an entity linked to BlackBasta ransomware deployment via email attachments. This activity followed the take-down of [QakBot](https://attack.mitre.org/software/S0650), with several technical overlaps and similarities with [QakBot](https://attack.mitre.org/software/S0650), indicating a possible connection. The identified activity led to the deployment of tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154), while coinciding with campaigns delivering [DarkGate](https://attack.mitre.org/software/S1111) and [IcedID](https://attack.mitre.org/software/S0483) en route to ransomware deployment.(Citation: TrendMicro Pikabot 2024)",
"aliases": [
"Water Curupira Pikabot Distribution"
],
"first_seen": "2023-01-01 05:00:00+00:00",
"last_seen": "2023-12-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0037",
"external_id": "C0037"
},
{
"source_name": "TrendMicro Pikabot 2024",
"description": "Shinji Robert Arasawa, Joshua Aquino, Charles Steven Derion, Juhn Emmanuel Atanque, Francisrey Joshua Castillo, John Carlo Marquez, Henry Salcedo, John Rainier Navato, Arianne Dela Cruz, Raymart Yambot & Ian Kenefick. (2024, January 9). Black Basta-Affiliated Water Curupira\u2019s Pikabot Spam Campaign. Retrieved July 17, 2024.",
"url": "https://www.trendmicro.com/en_us/research/24/a/a-look-into-pikabot-spam-wave-campaign.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Inna Danilevich, U.S. Bank"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_first_seen_citation": "(Citation: TrendMicro Pikabot 2024)",
"x_mitre_last_seen_citation": "(Citation: TrendMicro Pikabot 2024)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:47:22.789000+00:00\", \"old_value\": \"2026-05-12 15:12:00.730000+00:00\"}}}",
"previous_version": "1.0"
}
],
"revocations": [],
"deprecations": [],
"deletions": []
},
"assets": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [],
"revocations": [],
"deprecations": [],
"deletions": []
},
"mitigations": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [],
"revocations": [],
"deprecations": [],
"deletions": []
},
"datasources": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [],
"revocations": [],
"deprecations": [],
"deletions": []
},
"datacomponents": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [],
"revocations": [],
"deprecations": [],
"deletions": []
},
"detectionstrategies": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--cfedfc6c-6e31-481b-be1e-e23a760fec44",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-10-21 15:10:28.402000+00:00",
"modified": "2026-07-31 18:48:38.565000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0187",
"external_id": "DET0187"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detect Disabled Windows Event Log",
"x_mitre_analytic_refs": [
"x-mitre-analytic--705168ad-1701-453c-9aea-c75029492b89"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:38.565000+00:00\", \"old_value\": \"2026-05-12 16:30:18.390000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--48923678-0fb6-4d14-986b-2f6adeb8c421",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-16 16:45:43.694000+00:00",
"modified": "2026-07-31 18:48:33.947000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0899",
"external_id": "DET0899"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detect Social Engineering",
"x_mitre_analytic_refs": [
"x-mitre-analytic--54bb8256-cbe8-4088-9cff-b03711bd7841",
"x-mitre-analytic--983e1849-6af7-491e-9605-46b9bf54bbd1",
"x-mitre-analytic--e817eb45-0830-476d-9fd7-8e8acb14af8a",
"x-mitre-analytic--f238e0f3-7354-4304-9101-69cefd8446fc",
"x-mitre-analytic--fc19b602-2811-418f-aa98-1b49f1355743"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:33.947000+00:00\", \"old_value\": \"2026-05-12 16:30:18.390000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--488ef272-b2fa-4501-ab6e-97e3ac01816c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-16 17:34:53.603000+00:00",
"modified": "2026-07-31 18:48:33.686000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0901",
"external_id": "DET0901"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detect Windows Firewall",
"x_mitre_analytic_refs": [
"x-mitre-analytic--702db8b6-641f-4526-a0d0-a5a62c499508"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:33.686000+00:00\", \"old_value\": \"2026-05-12 16:30:18.390000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--8577b89d-01e2-4423-8657-caff7ed22737",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-10-21 15:10:28.402000+00:00",
"modified": "2026-07-31 18:48:36.110000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0563",
"external_id": "DET0563"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection Strategy for Defense Impairment via Prevent Command History Logging across OS platforms.",
"x_mitre_analytic_refs": [
"x-mitre-analytic--1f69e126-e849-43a1-9fca-b5c63a154daa",
"x-mitre-analytic--2a5f1993-7035-4d94-b9d1-7edb1850d4e1",
"x-mitre-analytic--91870bc8-3a81-4d90-84e4-26c99b5642ef",
"x-mitre-analytic--8ed1a27f-3a60-441d-b92d-dc7b086db459",
"x-mitre-analytic--77450309-6789-4025-9817-d908c4ac9e5b"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:36.110000+00:00\", \"old_value\": \"2026-05-12 16:30:18.390000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--f0190654-2eda-42a7-9a4d-6edc95aada02",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-10-21 15:10:28.402000+00:00",
"modified": "2026-07-31 18:48:39.906000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0289",
"external_id": "DET0289"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection Strategy for Disable or Modify Cloud Log",
"x_mitre_analytic_refs": [
"x-mitre-analytic--a788e3ed-8faf-4443-bb26-fd530ca930d1",
"x-mitre-analytic--8e0f5333-9fc0-4f03-ae12-cf98903e08ea",
"x-mitre-analytic--e42656e7-6a0e-492e-82b6-90d0d5667993",
"x-mitre-analytic--967f7636-1547-4db7-921a-1b84f312a2cd"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:39.906000+00:00\", \"old_value\": \"2026-05-12 16:30:18.391000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--1d769567-7e82-47f4-8dc8-5a503f524134",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-10-21 15:10:28.402000+00:00",
"modified": "2026-07-31 18:48:31.788000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0062",
"external_id": "DET0062"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection Strategy for Disable or Modify Linux Audit System Log",
"x_mitre_analytic_refs": [
"x-mitre-analytic--3e9734aa-b9b4-4716-927c-27c2c2aa972e"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:31.788000+00:00\", \"old_value\": \"2026-05-12 16:30:18.390000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--da1e3af8-d79b-44ff-a907-ae107c110671",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-10-21 15:10:28.402000+00:00",
"modified": "2026-07-31 18:48:38.827000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0595",
"external_id": "DET0595"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection Strategy for Exploitation for Stealth",
"x_mitre_analytic_refs": [
"x-mitre-analytic--e5b0fcab-05e5-4687-a1a9-dd382a19980b",
"x-mitre-analytic--ecf26d05-48ef-43b2-bfc3-4ea331be735b",
"x-mitre-analytic--88d9dbea-cc85-4c94-a368-e5c1a603854b",
"x-mitre-analytic--458038e6-60a2-47d2-bd55-675e77f0e279",
"x-mitre-analytic--77c3b78a-fb34-4040-9dda-057e8eca3362"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:38.827000+00:00\", \"old_value\": \"2026-05-12 16:30:18.391000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--ded7322c-64ba-4f6b-9aca-77a537798cab",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-23 18:44:43.178000+00:00",
"modified": "2026-07-31 18:48:39.114000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0920",
"external_id": "DET0920"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection Strategy for Invisible Unicode",
"x_mitre_analytic_refs": [
"x-mitre-analytic--1a9f097a-d5b9-424d-ae20-19ed73eb9dcf",
"x-mitre-analytic--a32c4f38-feaf-4291-9dad-3043114b4d37",
"x-mitre-analytic--6195e912-ed73-4ec7-a03b-097631ec0b26"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:39.114000+00:00\", \"old_value\": \"2026-05-12 16:30:18.391000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--fecfb9f9-645e-4e09-ba21-05bc60722688",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-10-21 15:10:28.402000+00:00",
"modified": "2026-07-31 18:48:40.729000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0311",
"external_id": "DET0311"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection for Spoofing Tool UI across OS Platforms",
"x_mitre_analytic_refs": [
"x-mitre-analytic--0f4ec296-008e-42aa-95b2-6e4e351d730c",
"x-mitre-analytic--d1feb97f-3683-49f5-b5a8-b54d58de3444",
"x-mitre-analytic--d9eb3056-115b-496a-89f7-be38470ff022"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:40.729000+00:00\", \"old_value\": \"2026-05-12 16:30:18.391000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--a27b9b6b-b4b9-425c-885b-ab52834f0974",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-23 14:58:03.627000+00:00",
"modified": "2026-07-31 18:48:36.948000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0918",
"external_id": "DET0918"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Audio-Visual Content",
"x_mitre_analytic_refs": [
"x-mitre-analytic--33712883-6871-4147-8272-7cd1c6c64ad6"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:36.948000+00:00\", \"old_value\": \"2026-05-12 16:30:18.390000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--3a3820cd-260b-43d0-b5af-89b7ba81a044",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-16 17:13:38.727000+00:00",
"modified": "2026-07-31 18:48:33.407000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0900",
"external_id": "DET0900"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Defense Impairment",
"x_mitre_analytic_refs": [
"x-mitre-analytic--7ec436a3-dd31-4d23-a51b-0e03d3c474bd",
"x-mitre-analytic--c6fb992c-387e-49ee-beaf-a1351aded262",
"x-mitre-analytic--f46639b5-4d99-4d52-8da9-112a468cc6d8",
"x-mitre-analytic--9df50fd3-bbad-43ce-b511-1bf995f1b583",
"x-mitre-analytic--47df93f9-b33f-4333-95b6-b3cca9418a4d"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:33.407000+00:00\", \"old_value\": \"2026-05-12 16:30:18.390000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--a21019ad-f6d2-4806-be7b-01ba27c63147",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-10-21 15:10:28.402000+00:00",
"modified": "2026-07-31 18:48:36.649000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0497",
"external_id": "DET0497"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Defense Impairment through Disabled or Modified Tools across OS Platforms.",
"x_mitre_analytic_refs": [
"x-mitre-analytic--7faf6f37-f074-4b9d-be19-618c3516486d",
"x-mitre-analytic--bda03bab-3f0b-4bd0-8a8f-77bcb2b1ee7d",
"x-mitre-analytic--9e9a5111-038b-4c68-a8bc-6d094723def4",
"x-mitre-analytic--5d329e39-a38b-47cd-8d3d-fa7515280fd7",
"x-mitre-analytic--f421cbe1-d42e-45e9-adad-12c6ed0a5cb8",
"x-mitre-analytic--e542342f-5a08-408d-b292-797bcb2da5eb",
"x-mitre-analytic--2b990a38-dedf-4a9a-9bd2-9a805c2f1b46"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:36.649000+00:00\", \"old_value\": \"2026-05-12 16:30:18.390000+00:00\"}}}",
"previous_version": "1.1"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--732ae9e0-1ff8-40bf-bc13-ea3a0bb6fee0",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-23 14:53:10.855000+00:00",
"modified": "2026-07-31 18:48:35.317000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0916",
"external_id": "DET0916"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Generate Content",
"x_mitre_analytic_refs": [
"x-mitre-analytic--360eb601-28db-4418-8474-ad2a432ce534"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:35.317000+00:00\", \"old_value\": \"2026-05-12 16:30:18.390000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--e2c3189b-34cf-4160-bc9f-2dcf4df451c6",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-23 14:59:37.388000+00:00",
"modified": "2026-07-31 18:48:39.378000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0919",
"external_id": "DET0919"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Query Public AI Services",
"x_mitre_analytic_refs": [
"x-mitre-analytic--255379f1-e115-4f3c-835a-23c8d279847e"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:39.378000+00:00\", \"old_value\": \"2026-05-12 16:30:18.391000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--2729a43c-3f8d-4fee-b2bd-f773436d051b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-10-21 15:10:28.402000+00:00",
"modified": "2026-07-31 18:48:32.069000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0588",
"external_id": "DET0588"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Remote Service Session Hijacking for RDP.",
"x_mitre_analytic_refs": [
"x-mitre-analytic--be773ad4-9e5f-4063-910a-99a3cab90582"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:32.069000+00:00\", \"old_value\": \"2026-05-12 16:30:18.390000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--7c1262bb-c0d1-4e0c-bab8-a232f7bed9d5",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-10-23 17:50:38.555000+00:00",
"modified": "2026-07-31 18:48:35.846000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0897",
"external_id": "DET0897"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Selective Exclusion",
"x_mitre_analytic_refs": [
"x-mitre-analytic--098f0607-df17-4291-a1b1-a8e3374c075a"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:35.846000+00:00\", \"old_value\": \"2026-05-12 16:34:50.682000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--ad21a251-e824-4368-a04c-8a480ee653cc",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-10-23 17:54:46.514000+00:00",
"modified": "2026-07-31 18:48:37.215000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0898",
"external_id": "DET0898"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Spoofed User-Agent",
"x_mitre_analytic_refs": [
"x-mitre-analytic--b73489af-2e95-4f41-b82e-327a84da2a1d",
"x-mitre-analytic--acabb18b-e2d6-4531-92bb-4165f0a16595",
"x-mitre-analytic--29ca0e06-e848-44cd-821a-24576276a8af"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:37.215000+00:00\", \"old_value\": \"2026-05-12 16:34:50.688000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--3a114d11-0850-4c33-b828-359e59b15250",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-10-21 15:10:28.402000+00:00",
"modified": "2026-07-31 18:48:33.141000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0306",
"external_id": "DET0306"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Unauthorized Network Firewall Rule Modification",
"x_mitre_analytic_refs": [
"x-mitre-analytic--17ce541a-23fa-4b33-affc-c6ba906e9956"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:33.141000+00:00\", \"old_value\": \"2026-05-12 16:30:18.390000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--bbda89d6-a007-4ba9-bfd0-cb03344fc540",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-23 14:56:39.987000+00:00",
"modified": "2026-07-31 18:48:37.492000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0917",
"external_id": "DET0917"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Written Content",
"x_mitre_analytic_refs": [
"x-mitre-analytic--3c500af0-d284-48c3-b23b-a22f8b77649d"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 18:48:37.492000+00:00\", \"old_value\": \"2026-05-12 16:30:18.390000+00:00\"}}}",
"previous_version": "1.0"
}
],
"revocations": [],
"deprecations": [],
"deletions": []
},
"analytics": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [],
"revocations": [],
"deprecations": [],
"deletions": []
}
},
"mobile-attack": {
"techniques": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [],
"revocations": [],
"deprecations": [],
"deletions": []
},
"software": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [],
"revocations": [],
"deprecations": [],
"deletions": []
},
"groups": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [
{
"type": "intrusion-set",
"id": "intrusion-set--8332952e-b86b-486b-acc3-1c2a85d39394",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-26 18:38:00.759000+00:00",
"modified": "2026-07-31 20:48:39.666000+00:00",
"name": "APT-C-23",
"description": "[APT-C-23](https://attack.mitre.org/groups/G1028) is a threat group that has been active since at least 2014.(Citation: symantec_mantis) [APT-C-23](https://attack.mitre.org/groups/G1028) has primarily focused its operations on the Middle East, including Israeli military assets. [APT-C-23](https://attack.mitre.org/groups/G1028) has developed mobile spyware targeting Android and iOS devices since 2017.(Citation: welivesecurity_apt-c-23)",
"aliases": [
"APT-C-23",
"Mantis",
"Arid Viper",
"Desert Falcon",
"TAG-63",
"Grey Karkadann",
"Big Bang APT",
"Two-tailed Scorpion"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1028",
"external_id": "G1028"
},
{
"source_name": "Big Bang APT",
"description": "(Citation: checkpoint_interactive_map_apt-c-23) "
},
{
"source_name": "Grey Karkadann",
"description": "(Citation: sentinelone_israel_hamas_war)"
},
{
"source_name": "Mantis",
"description": "(Citation: symantec_mantis)(Citation: sentinelone_israel_hamas_war)"
},
{
"source_name": "Two-tailed Scorpion",
"description": "(Citation: welivesecurity_apt-c-23)"
},
{
"source_name": "Arid Viper",
"description": "(Citation: welivesecurity_apt-c-23)(Citation: sentinelone_israel_hamas_war)(Citation: fb_arid_viper)"
},
{
"source_name": "Desert Falcon",
"description": "(Citation: welivesecurity_apt-c-23)(Citation: sentinelone_israel_hamas_war)(Citation: fb_arid_viper)"
},
{
"source_name": "fb_arid_viper",
"description": "Flossman, M., Scott, M. (2021, April). Technical Paper // Taking Action Against Arid Viper. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20231126111812/https:/about.fb.com/wp-content/uploads/2021/04/Technical-threat-report-Arid-Viper-April-2021.pdf"
},
{
"source_name": "sentinelone_israel_hamas_war",
"description": "Hegel, T., Milenkoski, A. (2023, October 24). The Israel-Hamas War | Cyber Domain State-Sponsored Activity of Interest. Retrieved March 4, 2024.",
"url": "https://web.archive.org/web/20240208234008/www.sentinelone.com/labs/the-israel-hamas-war-cyber-domain-state-sponsored-activity-of-interest/"
},
{
"source_name": "checkpoint_interactive_map_apt-c-23",
"description": "Kayal, A. (2018, August 26). Interactive Mapping of APT-C-23. Retrieved March 4, 2024.",
"url": "https://web.archive.org/web/20230604112435/https://research.checkpoint.com/2018/interactive-mapping-of-apt-c-23/"
},
{
"source_name": "welivesecurity_apt-c-23",
"description": "Stefanko, L. (2020, September 30). APT\u2011C\u201123 group evolves its Android spyware. Retrieved March 4, 2024.",
"url": "https://web.archive.org/web/20201123042131/www.welivesecurity.com/2020/09/30/aptc23-group-evolves-its-android-spyware/"
},
{
"source_name": "symantec_mantis",
"description": "Symantec Threat Hunter Team. (2023, April 4). Mantis: New Tooling Used in Attacks Against Palestinian Targets. Retrieved March 4, 2024.",
"url": "https://web.archive.org/web/20231227054130/https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/mantis-palestinian-attacks"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Sittikorn Sangrattanapitak"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:39.666000+00:00\", \"old_value\": \"2024-11-17 20:01:55.806000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--bef4c620-0787-42a8-a96d-b7eb6e85917c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:48.664000+00:00",
"modified": "2026-07-31 20:48:44.067000+00:00",
"name": "APT28",
"description": "[APT28](https://attack.mitre.org/groups/G0007) is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub August 2020)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021) This group has been active since at least 2004.(Citation: DOJ GRU Indictment Jul 2018)(Citation: Ars Technica GRU indictment Jul 2018)(Citation: Crowdstrike DNC June 2016)(Citation: FireEye APT28)(Citation: SecureWorks TG-4127)(Citation: FireEye APT28 January 2017)(Citation: GRIZZLY STEPPE JAR)(Citation: Sofacy DealersChoice)(Citation: Palo Alto Sofacy 06-2018)(Citation: Symantec APT28 Oct 2018)(Citation: ESET Zebrocy May 2019)\n\n[APT28](https://attack.mitre.org/groups/G0007) reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.(Citation: Crowdstrike DNC June 2016) In 2018, the US indicted five GRU Unit 26165 officers associated with [APT28](https://attack.mitre.org/groups/G0007) for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.(Citation: US District Court Indictment GRU Oct 2018) Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as [Sandworm Team](https://attack.mitre.org/groups/G0034). ",
"aliases": [
"APT28",
"IRON TWILIGHT",
"SNAKEMACKEREL",
"Swallowtail",
"Group 74",
"Sednit",
"Sofacy",
"Pawn Storm",
"Fancy Bear",
"STRONTIUM",
"Tsar Team",
"Threat Group-4127",
"TG-4127",
"Forest Blizzard",
"FROZENLAKE",
"GruesomeLarch"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0007",
"external_id": "G0007"
},
{
"source_name": "SNAKEMACKEREL",
"description": "(Citation: Accenture SNAKEMACKEREL Nov 2018)"
},
{
"source_name": "Fancy Bear",
"description": "(Citation: Crowdstrike DNC June 2016)(Citation: Kaspersky Sofacy)(Citation: ESET Sednit Part 3)(Citation: Ars Technica GRU indictment Jul 2018)(Citation: Talos Seduploader Oct 2017)(Citation: Symantec APT28 Oct 2018)(Citation: Securelist Sofacy Feb 2018)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)"
},
{
"source_name": "Tsar Team",
"description": "(Citation: ESET Sednit Part 3)(Citation: Talos Seduploader Oct 2017)(Citation: Talos Seduploader Oct 2017)"
},
{
"source_name": "APT28",
"description": "(Citation: FireEye APT28) (Citation: SecureWorks TG-4127) (Citation: Crowdstrike DNC June 2016) (Citation: Kaspersky Sofacy) (Citation: ESET Sednit Part 3) (Citation: Ars Technica GRU indictment Jul 2018)(Citation: Talos Seduploader Oct 2017)(Citation: Symantec APT28 Oct 2018)(Citation: Securelist Sofacy Feb 2018)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)"
},
{
"source_name": "STRONTIUM",
"description": "(Citation: Kaspersky Sofacy)(Citation: ESET Sednit Part 3)(Citation: Microsoft STRONTIUM Aug 2019)(Citation: Microsoft STRONTIUM New Patterns Cred Harvesting Sept 2020)(Citation: TrendMicro Pawn Storm Dec 2020)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)"
},
{
"source_name": "FROZENLAKE",
"description": "(Citation: Leonard TAG 2023)"
},
{
"source_name": "Forest Blizzard",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "GruesomeLarch",
"description": "(Citation: Nearest Neighbor Volexity)"
},
{
"source_name": "IRON TWILIGHT",
"description": "(Citation: Secureworks IRON TWILIGHT Profile)(Citation: Secureworks IRON TWILIGHT Active Measures March 2017)"
},
{
"source_name": "Threat Group-4127",
"description": "(Citation: SecureWorks TG-4127)"
},
{
"source_name": "TG-4127",
"description": "(Citation: SecureWorks TG-4127)"
},
{
"source_name": "Pawn Storm",
"description": "(Citation: SecureWorks TG-4127)(Citation: ESET Sednit Part 3)(Citation: TrendMicro Pawn Storm Dec 2020) "
},
{
"source_name": "Swallowtail",
"description": "(Citation: Symantec APT28 Oct 2018)"
},
{
"source_name": "Group 74",
"description": "(Citation: Talos Seduploader Oct 2017)"
},
{
"source_name": "Accenture SNAKEMACKEREL Nov 2018",
"description": "Accenture Security. (2018, November 29). SNAKEMACKEREL. Retrieved April 15, 2019.",
"url": "https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"
},
{
"source_name": "Crowdstrike DNC June 2016",
"description": "Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016.",
"url": "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
},
{
"source_name": "Leonard TAG 2023",
"description": "Billy Leonard. (2023, April 19). Ukraine remains Russia\u2019s biggest cyber focus in 2023. Retrieved March 1, 2024.",
"url": "https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"
},
{
"source_name": "US District Court Indictment GRU Oct 2018",
"description": "Brady, S . (2018, October 3). Indictment - United States vs Aleksei Sergeyevich Morenets, et al.. Retrieved October 1, 2020.",
"url": "https://www.justice.gov/opa/page/file/1098481/download"
},
{
"source_name": "GRIZZLY STEPPE JAR",
"description": "Department of Homeland Security and Federal Bureau of Investigation. (2016, December 29). GRIZZLY STEPPE \u2013 Russian Malicious Cyber Activity. Retrieved January 11, 2017.",
"url": "https://www.us-cert.gov/sites/default/files/publications/JAR_16-20296A_GRIZZLY%20STEPPE-2016-1229.pdf"
},
{
"source_name": "ESET Zebrocy May 2019",
"description": "ESET Research. (2019, May 22). A journey to Zebrocy land. Retrieved June 20, 2019.",
"url": "https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/"
},
{
"source_name": "ESET Sednit Part 3",
"description": "ESET. (2016, October). En Route with Sednit - Part 3: A Mysterious Downloader. Retrieved November 21, 2016.",
"url": "http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf"
},
{
"source_name": "Sofacy DealersChoice",
"description": "Falcone, R. (2018, March 15). Sofacy Uses DealersChoice to Target European Government Agency. Retrieved June 4, 2018.",
"url": "https://researchcenter.paloaltonetworks.com/2018/03/unit42-sofacy-uses-dealerschoice-target-european-government-agency/"
},
{
"source_name": "FireEye APT28 January 2017",
"description": "FireEye iSIGHT Intelligence. (2017, January 11). APT28: At the Center of the Storm. Retrieved November 17, 2024.",
"url": "https://www.mandiant.com/sites/default/files/2021-09/APT28-Center-of-Storm-2017.pdf"
},
{
"source_name": "FireEye APT28",
"description": "FireEye. (2015). APT28: A WINDOW INTO RUSSIA\u2019S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.",
"url": "https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"
},
{
"source_name": "Ars Technica GRU indictment Jul 2018",
"description": "Gallagher, S. (2018, July 27). How they did it (and will likely try again): GRU hackers vs. US elections. Retrieved September 13, 2018.",
"url": "https://arstechnica.com/information-technology/2018/07/from-bitly-to-x-agent-how-gru-hackers-targeted-the-2016-presidential-election/"
},
{
"source_name": "TrendMicro Pawn Storm Dec 2020",
"description": "Hacquebord, F., Remorin, L. (2020, December 17). Pawn Storm\u2019s Lack of Sophistication as a Strategy. Retrieved January 13, 2021.",
"url": "https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html"
},
{
"source_name": "Securelist Sofacy Feb 2018",
"description": "Kaspersky Lab's Global Research & Analysis Team. (2018, February 20). A Slice of 2017 Sofacy Activity. Retrieved November 27, 2018.",
"url": "https://securelist.com/a-slice-of-2017-sofacy-activity/83930/"
},
{
"source_name": "Kaspersky Sofacy",
"description": "Kaspersky Lab's Global Research and Analysis Team. (2015, December 4). Sofacy APT hits high profile targets with updated toolset. Retrieved December 10, 2015.",
"url": "https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/"
},
{
"source_name": "Nearest Neighbor Volexity",
"description": "Koessel, Sean. Adair, Steven. Lancaster, Tom. (2024, November 22). The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access. Retrieved February 25, 2025.",
"url": "https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/"
},
{
"source_name": "Palo Alto Sofacy 06-2018",
"description": "Lee, B., Falcone, R. (2018, June 06). Sofacy Group\u2019s Parallel Attacks. Retrieved June 18, 2018.",
"url": "https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"
},
{
"source_name": "Talos Seduploader Oct 2017",
"description": "Mercer, W., et al. (2017, October 22). \"Cyber Conflict\" Decoy Document Used in Real Cyber Conflict. Retrieved November 2, 2018.",
"url": "https://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft STRONTIUM New Patterns Cred Harvesting Sept 2020",
"description": "Microsoft Threat Intelligence Center (MSTIC). (2020, September 10). STRONTIUM: Detecting new patterns in credential harvesting. Retrieved September 11, 2020.",
"url": "https://www.microsoft.com/security/blog/2020/09/10/strontium-detecting-new-patters-credential-harvesting/"
},
{
"source_name": "Microsoft STRONTIUM Aug 2019",
"description": "MSRC Team. (2019, August 5). Corporate IoT \u2013 a path to intrusion. Retrieved August 16, 2019.",
"url": "https://msrc-blog.microsoft.com/2019/08/05/corporate-iot-a-path-to-intrusion/"
},
{
"source_name": "DOJ GRU Indictment Jul 2018",
"description": "Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved November 17, 2024.",
"url": "https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"
},
{
"source_name": "Cybersecurity Advisory GRU Brute Force Campaign July 2021",
"description": "NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.",
"url": "https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"
},
{
"source_name": "NSA/FBI Drovorub August 2020",
"description": "NSA/FBI. (2020, August). Russian GRU 85th GTsSS Deploys Previously Undisclosed Drovorub Malware. Retrieved August 25, 2020.",
"url": "https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF"
},
{
"source_name": "SecureWorks TG-4127",
"description": "SecureWorks Counter Threat Unit Threat Intelligence. (2016, June 16). Threat Group-4127 Targets Hillary Clinton Presidential Campaign. Retrieved August 3, 2016.",
"url": "https://www.secureworks.com/research/threat-group-4127-targets-hillary-clinton-presidential-campaign"
},
{
"source_name": "Secureworks IRON TWILIGHT Active Measures March 2017",
"description": "Secureworks CTU. (2017, March 30). IRON TWILIGHT Supports Active Measures. Retrieved February 28, 2022.",
"url": "https://www.secureworks.com/research/iron-twilight-supports-active-measures"
},
{
"source_name": "Secureworks IRON TWILIGHT Profile",
"description": "Secureworks CTU. (n.d.). IRON TWILIGHT. Retrieved February 28, 2022.",
"url": "https://www.secureworks.com/research/threat-profiles/iron-twilight"
},
{
"source_name": "Symantec APT28 Oct 2018",
"description": "Symantec Security Response. (2018, October 04). APT28: New Espionage Operations Target Military and Government Organizations. Retrieved November 14, 2018.",
"url": "https://www.symantec.com/blogs/election-security/apt28-espionage-military-government"
},
{
"source_name": "Sednit",
"description": "This designation has been used in reporting both to refer to the threat group and its associated malware [JHUHUGIT](https://attack.mitre.org/software/S0044).(Citation: FireEye APT28 January 2017)(Citation: SecureWorks TG-4127)(Citation: Kaspersky Sofacy)(Citation: Ars Technica GRU indictment Jul 2018)"
},
{
"source_name": "Sofacy",
"description": "This designation has been used in reporting both to refer to the threat group and its associated malware.(Citation: FireEye APT28)(Citation: SecureWorks TG-4127)(Citation: Crowdstrike DNC June 2016)(Citation: ESET Sednit Part 3)(Citation: Ars Technica GRU indictment Jul 2018)(Citation: Talos Seduploader Oct 2017)"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Drew Church, Splunk",
"Emily Ratliff, IBM",
"Richard Gold, Digital Shadows",
"S\u00e9bastien Ruel, CGI"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "5.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:44.067000+00:00\", \"old_value\": \"2026-05-12 15:12:00.732000+00:00\"}}}",
"previous_version": "5.3"
},
{
"type": "intrusion-set",
"id": "intrusion-set--18854f55-ac7c-4634-bd9a-352dd07613b7",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-09-23 13:43:36.945000+00:00",
"modified": "2026-07-31 20:48:26.542000+00:00",
"name": "APT41",
"description": "[APT41](https://attack.mitre.org/groups/G0096) is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, [APT41](https://attack.mitre.org/groups/G0096) has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.(Citation: apt41_mandiant) Notable behaviors include using a wide range of malware and tools to complete mission objectives. [APT41](https://attack.mitre.org/groups/G0096) overlaps at least partially with public reporting on groups including BARIUM and [Winnti Group](https://attack.mitre.org/groups/G0044).(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)\n",
"aliases": [
"APT41",
"Wicked Panda",
"Brass Typhoon",
"BARIUM"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0096",
"external_id": "G0096"
},
{
"source_name": "Wicked Panda",
"description": "(Citation: Crowdstrike GTR2020 Mar 2020)"
},
{
"source_name": "APT41",
"description": "(Citation: FireEye APT41 2019)"
},
{
"source_name": "Brass Typhoon",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "BARIUM",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Crowdstrike GTR2020 Mar 2020",
"description": "Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.",
"url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"
},
{
"source_name": "FireEye APT41 2019",
"description": "FireEye. (2019). Double DragonAPT41, a dual espionage andcyber crime operationAPT41. Retrieved September 23, 2019.",
"url": "https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"
},
{
"source_name": "FireEye APT41 Aug 2019",
"description": "Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.",
"url": "https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"
},
{
"source_name": "apt41_mandiant",
"description": "Mandiant. (n.d.). APT41, A DUAL ESPIONAGE AND CYBER CRIME OPERATION. Retrieved June 11, 2024.",
"url": "https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Group IB APT 41 June 2021",
"description": "Rostovcev, N. (2021, June 10). Big airline heist APT41 likely behind a third-party attack on Air India. Retrieved August 26, 2021.",
"url": "https://www.group-ib.com/blog/colunmtk-apt41/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Kyaw Pyiyt Htet, @KyawPyiytHtet",
"Nikita Rostovcev, Group-IB"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "4.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:26.542000+00:00\", \"old_value\": \"2025-06-11 20:13:29.024000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "4.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--7f848c02-4d1e-4808-a4ae-4670681370a9",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-06-01 20:26:53.880000+00:00",
"modified": "2026-07-31 20:48:39.235000+00:00",
"name": "BITTER",
"description": "[BITTER](https://attack.mitre.org/groups/G1002) is a suspected South Asian cyber espionage threat group that has been active since at least 2013. [BITTER](https://attack.mitre.org/groups/G1002) has targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Citation: Forcepoint BITTER Pakistan Oct 2016)",
"aliases": [
"BITTER",
"T-APT-17"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1002",
"external_id": "G1002"
},
{
"source_name": "T-APT-17",
"description": "(Citation: Cisco Talos Bitter Bangladesh May 2022)"
},
{
"source_name": "Forcepoint BITTER Pakistan Oct 2016",
"description": "Dela Paz, R. (2016, October 21). BITTER: a targeted attack against Pakistan. Retrieved June 1, 2022.",
"url": "https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"
},
{
"source_name": "Cisco Talos Bitter Bangladesh May 2022",
"description": "Raghuprasad, C . (2022, May 11). Bitter APT adds Bangladesh to their targets. Retrieved June 1, 2022.",
"url": "https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:39.235000+00:00\", \"old_value\": \"2024-04-11 02:52:27.131000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--049cef3b-22d5-4be6-b50c-9839c7a34fdd",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-01-27 16:55:39.688000+00:00",
"modified": "2026-07-31 20:48:23.673000+00:00",
"name": "Bouncing Golf",
"description": "[Bouncing Golf](https://attack.mitre.org/groups/G0097) is a cyberespionage campaign targeting Middle Eastern countries.(Citation: Trend Micro Bouncing Golf 2019)",
"aliases": [
"Bouncing Golf"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0097",
"external_id": "G0097"
},
{
"source_name": "Trend Micro Bouncing Golf 2019",
"description": "E. Xu, G. Guo. (2019, June 28). Mobile Cyberespionage Campaign \u2018Bouncing Golf\u2019 Affects Middle East. Retrieved January 27, 2020.",
"url": "https://blog.trendmicro.com/trendlabs-security-intelligence/mobile-cyberespionage-campaign-bouncing-golf-affects-middle-east/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:23.673000+00:00\", \"old_value\": \"2025-04-25 14:41:32.241000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--6eded342-33e5-4451-b6b2-e1c62863129f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-12-26 23:11:39.442000+00:00",
"modified": "2026-07-31 20:48:37.252000+00:00",
"name": "Confucius",
"description": "[Confucius](https://attack.mitre.org/groups/G0142) is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. Security researchers have noted similarities between [Confucius](https://attack.mitre.org/groups/G0142) and [Patchwork](https://attack.mitre.org/groups/G0040), particularly in their respective custom malware code and targets.(Citation: TrendMicro Confucius APT Feb 2018)(Citation: TrendMicro Confucius APT Aug 2021)(Citation: Uptycs Confucius APT Jan 2021)",
"aliases": [
"Confucius",
"Confucius APT"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0142",
"external_id": "G0142"
},
{
"source_name": "TrendMicro Confucius APT Feb 2018",
"description": "Lunghi, D and Horejsi, J. (2018, February 13). Deciphering Confucius: A Look at the Group's Cyberespionage Operations. Retrieved December 26, 2021.",
"url": "https://www.trendmicro.com/en_us/research/18/b/deciphering-confucius-cyberespionage-operations.html"
},
{
"source_name": "TrendMicro Confucius APT Aug 2021",
"description": "Lunghi, D. (2021, August 17). Confucius Uses Pegasus Spyware-related Lures to Target Pakistani Military. Retrieved December 26, 2021.",
"url": "https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html"
},
{
"source_name": "Uptycs Confucius APT Jan 2021",
"description": "Uptycs Threat Research Team. (2021, January 12). Confucius APT deploys Warzone RAT. Retrieved December 17, 2021.",
"url": "https://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:37.252000+00:00\", \"old_value\": \"2025-04-16 20:37:36.476000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--8a831aaa-f3e0-47a3-bed8-a9ced744dd12",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-10-17 00:14:20.652000+00:00",
"modified": "2026-07-31 20:48:40.500000+00:00",
"name": "Dark Caracal",
"description": "[Dark Caracal](https://attack.mitre.org/groups/G0070) is threat group that has been attributed to the Lebanese General Directorate of General Security (GDGS) and has operated since at least 2012. (Citation: Lookout Dark Caracal Jan 2018)",
"aliases": [
"Dark Caracal"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0070",
"external_id": "G0070"
},
{
"source_name": "Dark Caracal",
"description": "(Citation: Lookout Dark Caracal Jan 2018)"
},
{
"source_name": "Lookout Dark Caracal Jan 2018",
"description": "Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.",
"url": "https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:40.500000+00:00\", \"old_value\": \"2024-04-11 02:42:07.325000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.4"
},
{
"type": "intrusion-set",
"id": "intrusion-set--cc613a49-9bfa-4e22-98d1-15ffbb03f034",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-07-01 20:12:30.184000+00:00",
"modified": "2026-07-31 20:48:47.844000+00:00",
"name": "Earth Lusca",
"description": "[Earth Lusca](https://attack.mitre.org/groups/G1006) is a suspected China-based cyber espionage group that has been active since at least April 2019. [Earth Lusca](https://attack.mitre.org/groups/G1006) has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some [Earth Lusca](https://attack.mitre.org/groups/G1006) operations may be financially motivated.(Citation: TrendMicro EarthLusca 2022)\n\n[Earth Lusca](https://attack.mitre.org/groups/G1006) has used malware commonly used by other Chinese threat groups, including [APT41](https://attack.mitre.org/groups/G0096) and the [Winnti Group](https://attack.mitre.org/groups/G0044) cluster, however security researchers assess [Earth Lusca](https://attack.mitre.org/groups/G1006)'s techniques and infrastructure are separate.(Citation: TrendMicro EarthLusca 2022)",
"aliases": [
"Earth Lusca",
"TAG-22",
"Charcoal Typhoon",
"CHROMIUM",
"ControlX"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1006",
"external_id": "G1006"
},
{
"source_name": "Charcoal Typhoon",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "ControlX",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "CHROMIUM",
"description": "(Citation: Microsoft Threat Actor Naming July 2023) (Citation: Recorded Future RedHotel August 2023)"
},
{
"source_name": "TAG-22",
"description": "(Citation: Recorded Future TAG-22 July 2021)"
},
{
"source_name": "TrendMicro EarthLusca 2022",
"description": "Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca\u2019s Operations. Retrieved July 1, 2022.",
"url": "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"
},
{
"source_name": "Recorded Future TAG-22 July 2021",
"description": "INSIKT GROUP. (2021, July 8). Chinese State-Sponsored Activity Group TAG-22 Targets Nepal, the Philippines, and Taiwan Using Winnti and Other Tooling. Retrieved September 16, 2024.",
"url": "https://www.recordedfuture.com/research/chinese-group-tag-22-targets-nepal-philippines-taiwan"
},
{
"source_name": "Recorded Future RedHotel August 2023",
"description": "Insikt Group. (2023, August 8). RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale. Retrieved March 11, 2024.",
"url": "https://go.recordedfuture.com/hubfs/reports/cta-2023-0808.pdf"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:47.844000+00:00\", \"old_value\": \"2025-06-06 14:55:18.144000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--0ec2f388-bf0f-4b5c-97b1-fc736d26c25f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-08-26 15:03:02.577000+00:00",
"modified": "2026-07-31 20:48:24.117000+00:00",
"name": "Kimsuky",
"description": "[Kimsuky](https://attack.mitre.org/groups/G0094) is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. [Kimsuky](https://attack.mitre.org/groups/G0094) has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. [Kimsuky](https://attack.mitre.org/groups/G0094) operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing.(Citation: EST Kimsuky April 2019)(Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)(Citation: CISA AA20-301A Kimsuky)(Citation: Mandiant APT43 March 2024)(Citation: Proofpoint TA427 April 2024) \n\n[Kimsuky](https://attack.mitre.org/groups/G0094) was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).(Citation: Netscout Stolen Pencil Dec 2018)(Citation: EST Kimsuky SmokeScreen April 2019)(Citation: AhnLab Kimsuky Kabar Cobra Feb 2019) In 2023, [Kimsuky](https://attack.mitre.org/groups/G0094) was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance.(Citation: MSFT-AI)\n\nDPRK threat actor cluster boundaries overlap in open source reporting, with some security researchers consolidating all attributed North Korean state-sponsored cyber activity under [Lazarus Group](https://attack.mitre.org/groups/G0032), rather than tracking operationally distinct subgroups.",
"aliases": [
"Kimsuky",
"Black Banshee",
"Velvet Chollima",
"Emerald Sleet",
"THALLIUM",
"APT43",
"TA427",
"Springtail",
"Earth Kumiho",
"PatheticSlug"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0094",
"external_id": "G0094"
},
{
"source_name": "Cloudflare 2026 Threat Report New Threat Actors March 2026",
"description": " Cloudflare. (2026, March 3). Introducing the 2026 Cloudflare Threat Report. Retrieved April 18, 2026.",
"url": "https://blog.cloudflare.com/2026-threat-report/"
},
{
"source_name": "PatheticSlug",
"description": "(Citation: Cloudflare 2026 Threat Report New Threat Actors March 2026)"
},
{
"source_name": "Black Banshee",
"description": "(Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)"
},
{
"source_name": "THALLIUM",
"description": "(Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)(Citation: Mandiant APT43 March 2024)(Citation: Proofpoint TA427 April 2024)"
},
{
"source_name": "APT43",
"description": "(Citation: Mandiant APT43 March 2024)(Citation: Proofpoint TA427 April 2024)"
},
{
"source_name": "Emerald Sleet",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)(Citation: Proofpoint TA427 April 2024)"
},
{
"source_name": "TA427",
"description": "(Citation: Proofpoint TA427 April 2024)"
},
{
"source_name": "Earth Kumiho",
"description": "(Citation: Rapid7 Threat Landscape Actors March 2026)"
},
{
"source_name": "Kimsuky",
"description": "(Citation: Securelist Kimsuky Sept 2013)(Citation: Malwarebytes Kimsuky June 2021)"
},
{
"source_name": "Springtail",
"description": "(Citation: Symantec Troll Stealer 2024)"
},
{
"source_name": "Velvet Chollima",
"description": "(Citation: Zdnet Kimsuky Dec 2018)(Citation: ThreatConnect Kimsuky September 2020)(Citation: Malwarebytes Kimsuky June 2021)"
},
{
"source_name": "AhnLab Kimsuky Kabar Cobra Feb 2019",
"description": "AhnLab. (2019, February 28). Operation Kabar Cobra - Tenacious cyber-espionage campaign by Kimsuky Group. Retrieved September 29, 2021.",
"url": "https://global.ahnlab.com/global/upload/download/techreport/%5BAnalysis_Report%5DOperation%20Kabar%20Cobra.pdf"
},
{
"source_name": "EST Kimsuky April 2019",
"description": "Alyac. (2019, April 3). Kimsuky Organization Steals Operation Stealth Power. Retrieved August 13, 2019.",
"url": "https://blog.alyac.co.kr/2234"
},
{
"source_name": "Netscout Stolen Pencil Dec 2018",
"description": "ASERT team. (2018, December 5). STOLEN PENCIL Campaign Targets Academia. Retrieved February 5, 2019.",
"url": "https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/"
},
{
"source_name": "Zdnet Kimsuky Dec 2018",
"description": "Cimpanu, C.. (2018, December 5). Cyber-espionage group uses Chrome extension to infect victims. Retrieved August 26, 2019.",
"url": "https://www.zdnet.com/article/cyber-espionage-group-uses-chrome-extension-to-infect-victims/"
},
{
"source_name": "CISA AA20-301A Kimsuky",
"description": "CISA, FBI, CNMF. (2020, October 27). https://us-cert.cisa.gov/ncas/alerts/aa20-301a. Retrieved November 4, 2020.",
"url": "https://us-cert.cisa.gov/ncas/alerts/aa20-301a"
},
{
"source_name": "Cybereason Kimsuky November 2020",
"description": "Dahan, A. et al. (2020, November 2). Back to the Future: Inside the Kimsuky KGH Spyware Suite. Retrieved November 6, 2020.",
"url": "https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"
},
{
"source_name": "EST Kimsuky SmokeScreen April 2019",
"description": "ESTSecurity. (2019, April 17). Analysis of the APT Campaign \u2018Smoke Screen\u2019 targeting to Korea and US \ucd9c\ucc98: https://blog.alyac.co.kr/2243 [\uc774\uc2a4\ud2b8\uc2dc\ud050\ub9ac\ud2f0 \uc54c\uc57d \ube14\ub85c\uadf8]. Retrieved September 29, 2021.",
"url": "https://blog.alyac.co.kr/attachment/cfile5.uf@99A0CD415CB67E210DCEB3.pdf"
},
{
"source_name": "Malwarebytes Kimsuky June 2021",
"description": "Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.",
"url": "https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"
},
{
"source_name": "Proofpoint TA427 April 2024",
"description": "Lesnewich, G. et al. (2024, April 16). From Social Engineering to DMARC Abuse: TA427\u2019s Art of Information Gathering. Retrieved May 3, 2024.",
"url": "https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering"
},
{
"source_name": "Mandiant APT43 March 2024",
"description": "Mandiant. (2024, March 14). APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations. Retrieved May 3, 2024.",
"url": "https://services.google.com/fh/files/misc/apt43-report-en.pdf"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "MSFT-AI",
"description": "Microsoft Threat Intelligence. (2024, February 14). Staying ahead of threat actors in the age of AI. Retrieved March 11, 2024.",
"url": "https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/"
},
{
"source_name": "Rapid7 Threat Landscape Actors March 2026",
"description": "Rapid7. (2026, March 18). 2026 GLOBAL THREAT LANDSCAPE REPORT: Decoding the Accelerated Cyber Attack Cycle. Retrieved April 18, 2026.",
"url": "https://www.rapid7.com/cdn/assets/bltc1ddd6561ab54a26/69ba67de50ca691edcd3f5b7/rapid7-threat-landscape-report-2026.pdf"
},
{
"source_name": "Symantec Troll Stealer 2024",
"description": "Symantec Threat Hunter Team. (2024, May 16). Springtail: New Linux Backdoor Added to Toolkit. Retrieved January 17, 2025.",
"url": "https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage"
},
{
"source_name": "Securelist Kimsuky Sept 2013",
"description": "Tarakanov , D.. (2013, September 11). The \u201cKimsuky\u201d Operation: A North Korean APT?. Retrieved August 13, 2019.",
"url": "https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"
},
{
"source_name": "ThreatConnect Kimsuky September 2020",
"description": "ThreatConnect. (2020, September 28). Kimsuky Phishing Operations Putting In Work. Retrieved October 30, 2020.",
"url": "https://threatconnect.com/blog/kimsuky-phishing-operations-putting-in-work/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Dongwook Kim, KISA",
"Jaesang Oh, KC7 Foundation",
"Taewoo Lee, KISA",
"Wai Linn Oo, Kernellix Co.,Ltd."
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "5.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:24.117000+00:00\", \"old_value\": \"2026-04-23 18:46:50.938000+00:00\"}}}",
"previous_version": "5.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--d8bc9788-4f7d-41a9-9e9d-ee1ea18a8cf7",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-06-09 19:14:31.327000+00:00",
"modified": "2026-07-31 20:48:49.009000+00:00",
"name": "LAPSUS$",
"description": "[LAPSUS$](https://attack.mitre.org/groups/G1004) is cyber criminal threat group that has been active since at least mid-2021. [LAPSUS$](https://attack.mitre.org/groups/G1004) specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.(Citation: BBC LAPSUS Apr 2022)(Citation: MSTIC DEV-0537 Mar 2022)(Citation: UNIT 42 LAPSUS Mar 2022)",
"aliases": [
"LAPSUS$",
"DEV-0537",
"Strawberry Tempest"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1004",
"external_id": "G1004"
},
{
"source_name": "Strawberry Tempest",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "DEV-0537",
"description": "(Citation: MSTIC DEV-0537 Mar 2022)"
},
{
"source_name": "BBC LAPSUS Apr 2022",
"description": "BBC. (2022, April 1). LAPSUS: Two UK Teenagers Charged with Hacking for Gang. Retrieved June 9, 2022.",
"url": "https://www.bbc.com/news/technology-60953527"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "MSTIC DEV-0537 Mar 2022",
"description": "MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022.",
"url": "https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"
},
{
"source_name": "UNIT 42 LAPSUS Mar 2022",
"description": "UNIT 42. (2022, March 24). Threat Brief: Lapsus$ Group. Retrieved May 17, 2022.",
"url": "https://unit42.paloaltonetworks.com/lapsus-group/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"David Hughes, BT Security",
"Matt Brenton, Zurich Insurance Group",
"Fl\u00e1vio Costa, @Seguran\u00e7a Descomplicada",
"Caio Silva"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:49.009000+00:00\", \"old_value\": \"2025-04-21 19:40:47.538000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--7251b44b-6072-476c-b8d9-a6e32c355b28",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-09-25 18:11:05.672000+00:00",
"modified": "2026-07-31 20:48:38.550000+00:00",
"name": "MoustachedBouncer",
"description": "[MoustachedBouncer](https://attack.mitre.org/groups/G1019) is a cyberespionage group that has been active since at least 2014 targeting foreign embassies in Belarus.(Citation: MoustachedBouncer ESET August 2023)",
"aliases": [
"MoustachedBouncer"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1019",
"external_id": "G1019"
},
{
"source_name": "MoustachedBouncer ESET August 2023",
"description": "Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.",
"url": "https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:38.550000+00:00\", \"old_value\": \"2025-04-16 20:37:40.255000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--269e8108-68c6-4f99-b911-14b2e765dec2",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-04-18 17:59:24.739000+00:00",
"modified": "2026-07-31 20:48:29.347000+00:00",
"name": "MuddyWater",
"description": "[MuddyWater](https://attack.mitre.org/groups/G0069) is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).(Citation: CYBERCOM Iranian Intel Cyber January 2022) Since at least 2017, [MuddyWater](https://attack.mitre.org/groups/G0069) has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. [MuddyWater](https://attack.mitre.org/groups/G0069) has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, [MuddyWater](https://attack.mitre.org/groups/G0069) used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. (Citation: FalconFeeds_Iran_Mar2026)(Citation: Huntio_IranInfra_Mar2026)(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: ClearSky MuddyWater June 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: Talos MuddyWater Jan 2022)(Citation: NaumaanProofpoint_GlobalClickFix_April2025)(Citation: ESET_MuddyWater_Dec2025)(Citation: SymantecCarbonBlack_Seedworm_Mar2026) ",
"aliases": [
"MuddyWater",
"Earth Vetala",
"MERCURY",
"Static Kitten",
"Seedworm",
"TEMP.Zagros",
"Mango Sandstorm",
"TA450",
"MuddyKrill"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0069",
"external_id": "G0069"
},
{
"source_name": "Cloudflare 2026 Threat Report New Threat Actors March 2026",
"description": " Cloudflare. (2026, March 3). Introducing the 2026 Cloudflare Threat Report. Retrieved April 18, 2026.",
"url": "https://blog.cloudflare.com/2026-threat-report/"
},
{
"source_name": "MERCURY",
"description": "(Citation: Anomali Static Kitten February 2021)"
},
{
"source_name": "Static Kitten",
"description": "(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021)"
},
{
"source_name": "MuddyKrill",
"description": "(Citation: Cloudflare 2026 Threat Report New Threat Actors March 2026)"
},
{
"source_name": "TEMP.Zagros",
"description": "(Citation: FireEye MuddyWater Mar 2018)(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021)"
},
{
"source_name": "Mango Sandstorm",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "TA450",
"description": "(Citation: Proofpoint TA450 Phishing March 2024)"
},
{
"source_name": "Seedworm",
"description": "(Citation: Symantec MuddyWater Dec 2018)(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021)"
},
{
"source_name": "Earth Vetala",
"description": "(Citation: Trend Micro Muddy Water March 2021)"
},
{
"source_name": "MuddyWater",
"description": "(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)"
},
{
"source_name": "ClearSky MuddyWater Nov 2018",
"description": "ClearSky Cyber Security. (2018, November). MuddyWater Operations in Lebanon and Oman: Using an Israeli compromised domain for a two-stage campaign. Retrieved November 29, 2018.",
"url": "https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"
},
{
"source_name": "ClearSky MuddyWater June 2019",
"description": "ClearSky. (2019, June). Iranian APT group \u2018MuddyWater\u2019 Adds Exploits to Their Arsenal. Retrieved May 14, 2020.",
"url": "https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf"
},
{
"source_name": "CYBERCOM Iranian Intel Cyber January 2022",
"description": "Cyber National Mission Force. (2022, January 12). Iranian intel cyber suite of malware uses open source tools. Retrieved September 30, 2022.",
"url": "https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/"
},
{
"source_name": "ESET_MuddyWater_Dec2025",
"description": "ESET Research. (2025, December 2). MuddyWater: Snakes by the riverbank. Retrieved February 17, 2026.",
"url": "https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"
},
{
"source_name": "FalconFeeds_Iran_Mar2026",
"description": "FalconFeeds.io. (2026, March 5). The Digital Redoubt: Iran\u2019s National Information Network and the Asymmetry of Modern Cyber Conflict. Retrieved March 9, 2026.",
"url": "https://falconfeeds.io/blogs/the-digital-redoubt-irans-national-information-network-cyber-conflict"
},
{
"source_name": "DHS CISA AA22-055A MuddyWater February 2022",
"description": "FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.",
"url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"
},
{
"source_name": "Huntio_IranInfra_Mar2026",
"description": "Hunt.io. (2026, March 4). Iranian APT Infrastructure in Focus: Mapping State-Aligned Clusters During Geopolitical Escalation. Retrieved April 16, 2026.",
"url": "https://hunt.io/blog/iranian-apt-infrastructure-state-aligned-clusters"
},
{
"source_name": "Unit 42 MuddyWater Nov 2017",
"description": "Lancaster, T.. (2017, November 14). Muddying the Water: Targeted Attacks in the Middle East. Retrieved March 15, 2018.",
"url": "https://researchcenter.paloaltonetworks.com/2017/11/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/"
},
{
"source_name": "Talos MuddyWater Jan 2022",
"description": "Malhortra, A and Ventura, V. (2022, January 31). Iranian APT MuddyWater targets Turkish users via malicious PDFs, executables. Retrieved June 22, 2022.",
"url": "https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html"
},
{
"source_name": "Anomali Static Kitten February 2021",
"description": "Mele, G. et al. (2021, February 10). Probable Iranian Cyber Actors, Static Kitten, Conducting Cyberespionage Campaign Targeting UAE and Kuwait Government Agencies. Retrieved March 17, 2021.",
"url": "https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Proofpoint TA450 Phishing March 2024",
"description": "Miller, J. et al. (2024, March 21). Security Brief: TA450 Uses Embedded Links in PDF Attachments in Latest Campaign. Retrieved March 27, 2024.",
"url": "https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign"
},
{
"source_name": "NaumaanProofpoint_GlobalClickFix_April2025",
"description": "Naumaan, S., et al. (2025, April 17). Around the World in 90 Days: State-Sponsored Actors Try ClickFix . Retrieved January 21, 2026.",
"url": "https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"
},
{
"source_name": "Trend Micro Muddy Water March 2021",
"description": "Peretz, A. and Theck, E. (2021, March 5). Earth Vetala \u2013 MuddyWater Continues to Target Organizations in the Middle East. Retrieved March 18, 2021.",
"url": "https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"
},
{
"source_name": "Reaqta MuddyWater November 2017",
"description": "Reaqta. (2017, November 22). A dive into MuddyWater APT targeting Middle-East. Retrieved May 18, 2020.",
"url": "https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/"
},
{
"source_name": "FireEye MuddyWater Mar 2018",
"description": "Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018.",
"url": "https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"
},
{
"source_name": "Symantec MuddyWater Dec 2018",
"description": "Symantec DeepSight Adversary Intelligence Team. (2018, December 10). Seedworm: Group Compromises Government Agencies, Oil & Gas, NGOs, Telecoms, and IT Firms. Retrieved December 14, 2018.",
"url": "https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"
},
{
"source_name": "SymantecCarbonBlack_Seedworm_Mar2026",
"description": "Threat Hunter Team. (2026, March 5). Seedworm: Iranian APT on Networks of U.S. Bank, Airport, Software Company. Retrieved March 5, 2026.",
"url": "https://www.security.com/threat-intelligence/iran-cyber-threat-activity-us"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Daniyal Naeem, BT Security",
"Marco Pedrinazzi, @pedrinazziM",
"Ozer Sarilar, @ozersarilar, STM",
"Dragos Threat Intelligence"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "7.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:29.347000+00:00\", \"old_value\": \"2026-05-12 15:12:00.731000+00:00\"}}}",
"previous_version": "7.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--efed95ba-d7e8-47ff-8c53-99c42426ee7c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-01-16 16:13:52.465000+00:00",
"modified": "2026-07-31 20:48:51.011000+00:00",
"name": "PROMETHIUM",
"description": "[PROMETHIUM](https://attack.mitre.org/groups/G0056) is an activity group focused on espionage that has been active since at least 2012. The group has conducted operations globally with a heavy emphasis on Turkish targets. [PROMETHIUM](https://attack.mitre.org/groups/G0056) has demonstrated similarity to another activity group called [NEODYMIUM](https://attack.mitre.org/groups/G0055) due to overlapping victim and campaign characteristics.(Citation: Microsoft NEODYMIUM Dec 2016)(Citation: Microsoft SIR Vol 21)(Citation: Talos Promethium June 2020)",
"aliases": [
"PROMETHIUM",
"StrongPity"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0056",
"external_id": "G0056"
},
{
"source_name": "PROMETHIUM",
"description": "(Citation: Microsoft NEODYMIUM Dec 2016) (Citation: Microsoft SIR Vol 21)"
},
{
"source_name": "Microsoft SIR Vol 21",
"description": "Anthe, C. et al. (2016, December 14). Microsoft Security Intelligence Report Volume 21. Retrieved November 27, 2017.",
"url": "http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf"
},
{
"source_name": "Talos Promethium June 2020",
"description": "Mercer, W. et al. (2020, June 29). PROMETHIUM extends global reach with StrongPity3 APT. Retrieved July 20, 2020.",
"url": "https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"
},
{
"source_name": "Microsoft NEODYMIUM Dec 2016",
"description": "Microsoft. (2016, December 14). Twin zero-day attacks: PROMETHIUM and NEODYMIUM target individuals in Europe. Retrieved November 27, 2017.",
"url": "https://blogs.technet.microsoft.com/mmpc/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/"
},
{
"source_name": "StrongPity",
"description": "The name StrongPity has also been used to describe the group and the malware used by the group.(Citation: Bitdefender StrongPity June 2020)(Citation: Talos Promethium June 2020)"
},
{
"source_name": "Bitdefender StrongPity June 2020",
"description": "Tudorica, R. et al. (2020, June 30). StrongPity APT - Revealing Trojanized Tools, Working Hours and Infrastructure. Retrieved July 20, 2020.",
"url": "https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:51.011000+00:00\", \"old_value\": \"2024-04-19 19:35:15.637000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}, \"iterable_item_added\": {\"root['x_mitre_domains'][0]\": \"enterprise-attack\"}}",
"previous_version": "2.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--17862c7d-9e60-48a0-b48e-da4dc4c3f6b0",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:07.145000+00:00",
"modified": "2026-07-31 20:48:25.895000+00:00",
"name": "Patchwork",
"description": "[Patchwork](https://attack.mitre.org/groups/G0040) is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. [Patchwork](https://attack.mitre.org/groups/G0040) has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. [Patchwork](https://attack.mitre.org/groups/G0040) was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.(Citation: Cymmetria Patchwork) (Citation: Symantec Patchwork)(Citation: TrendMicro Patchwork Dec 2017)(Citation: Volexity Patchwork June 2018)",
"aliases": [
"Patchwork",
"Hangover Group",
"Dropping Elephant",
"Chinastrats",
"MONSOON",
"Operation Hangover"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0040",
"external_id": "G0040"
},
{
"source_name": "Patchwork",
"description": "(Citation: Cymmetria Patchwork) (Citation: Symantec Patchwork) (Citation: Securelist Dropping Elephant) (Citation: PaloAlto Patchwork Mar 2018) (Citation: Volexity Patchwork June 2018)"
},
{
"source_name": "Chinastrats",
"description": "(Citation: Securelist Dropping Elephant)"
},
{
"source_name": "Dropping Elephant",
"description": "(Citation: Symantec Patchwork) (Citation: Securelist Dropping Elephant) (Citation: PaloAlto Patchwork Mar 2018) (Citation: Volexity Patchwork June 2018)"
},
{
"source_name": "Hangover Group",
"description": "[Patchwork](https://attack.mitre.org/groups/G0040) and the Hangover Group have both been referenced as aliases for the threat group associated with Operation Monsoon.(Citation: PaloAlto Patchwork Mar 2018)(Citation: Unit 42 BackConfig May 2020)(Citation: Forcepoint Monsoon)"
},
{
"source_name": "Cymmetria Patchwork",
"description": "Cymmetria. (2016). Unveiling Patchwork - The Copy-Paste APT. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"
},
{
"source_name": "Operation Hangover May 2013",
"description": "Fagerland, S., et al. (2013, May). Operation Hangover: Unveiling an Indian Cyberattack Infrastructure. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20140424084220/http://enterprise-manage.norman.c.bitbit.net/resources/files/Unveiling_an_Indian_Cyberattack_Infrastructure.pdf"
},
{
"source_name": "Symantec Patchwork",
"description": "Hamada, J.. (2016, July 25). Patchwork cyberespionage group expands targets from governments to wide range of industries. Retrieved August 17, 2016.",
"url": "http://www.symantec.com/connect/blogs/patchwork-cyberespionage-group-expands-targets-governments-wide-range-industries"
},
{
"source_name": "Unit 42 BackConfig May 2020",
"description": "Hinchliffe, A. and Falcone, R. (2020, May 11). Updated BackConfig Malware Targeting Government and Military Organizations in South Asia. Retrieved June 17, 2020.",
"url": "https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"
},
{
"source_name": "Operation Hangover",
"description": "It is believed that the actors behind [Patchwork](https://attack.mitre.org/groups/G0040) are the same actors behind Operation Hangover. (Citation: Forcepoint Monsoon) (Citation: Operation Hangover May 2013)"
},
{
"source_name": "Securelist Dropping Elephant",
"description": "Kaspersky Lab's Global Research & Analysis Team. (2016, July 8). The Dropping Elephant \u2013 aggressive cyber-espionage in the Asian region. Retrieved August 3, 2016.",
"url": "https://securelist.com/the-dropping-elephant-actor/75328/"
},
{
"source_name": "PaloAlto Patchwork Mar 2018",
"description": "Levene, B. et al.. (2018, March 7). Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent. Retrieved March 31, 2018.",
"url": "https://researchcenter.paloaltonetworks.com/2018/03/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/"
},
{
"source_name": "TrendMicro Patchwork Dec 2017",
"description": "Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.",
"url": "https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"
},
{
"source_name": "Volexity Patchwork June 2018",
"description": "Meltzer, M, et al. (2018, June 07). Patchwork APT Group Targets US Think Tanks. Retrieved July 16, 2018.",
"url": "https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"
},
{
"source_name": "MONSOON",
"description": "MONSOON is the name of an espionage campaign; we use it here to refer to the actor group behind the campaign. (Citation: Forcepoint Monsoon) (Citation: PaloAlto Patchwork Mar 2018)"
},
{
"source_name": "Forcepoint Monsoon",
"description": "Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.",
"url": "https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.7",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:25.895000+00:00\", \"old_value\": \"2026-05-12 15:12:00.731000+00:00\"}}}",
"previous_version": "1.7"
},
{
"type": "intrusion-set",
"id": "intrusion-set--381fcf73-60f6-4ab2-9991-6af3cbc35192",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:04.588000+00:00",
"modified": "2026-07-31 20:48:32.342000+00:00",
"name": "Sandworm Team",
"description": "[Sandworm Team](https://attack.mitre.org/groups/G0034) is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) This group has been active since at least 2009.(Citation: iSIGHT Sandworm 2014)(Citation: CrowdStrike VOODOO BEAR)(Citation: USDOJ Sandworm Feb 2020)(Citation: NCSC Sandworm Feb 2020)\n\nIn October 2020, the US indicted six GRU Unit 74455 officers associated with [Sandworm Team](https://attack.mitre.org/groups/G0034) for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide [NotPetya](https://attack.mitre.org/software/S0368) attack, targeting of the 2017 French presidential campaign, the 2018 [Olympic Destroyer](https://attack.mitre.org/software/S0365) attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as [APT28](https://attack.mitre.org/groups/G0007).(Citation: US District Court Indictment GRU Oct 2018)",
"aliases": [
"Sandworm Team",
"ELECTRUM",
"Telebots",
"IRON VIKING",
"BlackEnergy (Group)",
"Quedagh",
"Voodoo Bear",
"IRIDIUM",
"Seashell Blizzard",
"FROZENBARENTS",
"APT44"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0034",
"external_id": "G0034"
},
{
"source_name": "Voodoo Bear",
"description": "(Citation: CrowdStrike VOODOO BEAR)(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)"
},
{
"source_name": "ELECTRUM",
"description": "(Citation: Dragos ELECTRUM)(Citation: UK NCSC Olympic Attacks October 2020)"
},
{
"source_name": "Sandworm Team",
"description": "(Citation: iSIGHT Sandworm 2014) (Citation: F-Secure BlackEnergy 2014) (Citation: InfoSecurity Sandworm Oct 2014)(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)"
},
{
"source_name": "Quedagh",
"description": "(Citation: iSIGHT Sandworm 2014) (Citation: F-Secure BlackEnergy 2014)(Citation: UK NCSC Olympic Attacks October 2020)"
},
{
"source_name": "FROZENBARENTS",
"description": "(Citation: Leonard TAG 2023)"
},
{
"source_name": "APT44",
"description": "(Citation: mandiant_apt44_unearthing_sandworm)"
},
{
"source_name": "IRIDIUM",
"description": "(Citation: Microsoft Prestige ransomware October 2022)"
},
{
"source_name": "Seashell Blizzard",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "BlackEnergy (Group)",
"description": "(Citation: NCSC Sandworm Feb 2020)(Citation: UK NCSC Olympic Attacks October 2020)"
},
{
"source_name": "Telebots",
"description": "(Citation: NCSC Sandworm Feb 2020)(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)"
},
{
"source_name": "IRON VIKING",
"description": "(Citation: Secureworks IRON VIKING )(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)"
},
{
"source_name": "Leonard TAG 2023",
"description": "Billy Leonard. (2023, April 19). Ukraine remains Russia\u2019s biggest cyber focus in 2023. Retrieved March 1, 2024.",
"url": "https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"
},
{
"source_name": "US District Court Indictment GRU Oct 2018",
"description": "Brady, S . (2018, October 3). Indictment - United States vs Aleksei Sergeyevich Morenets, et al.. Retrieved October 1, 2020.",
"url": "https://www.justice.gov/opa/page/file/1098481/download"
},
{
"source_name": "Dragos ELECTRUM",
"description": "Dragos. (2017, January 1). ELECTRUM Threat Profile. Retrieved June 10, 2020.",
"url": "https://www.dragos.com/resource/electrum/"
},
{
"source_name": "F-Secure BlackEnergy 2014",
"description": "F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016.",
"url": "https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf"
},
{
"source_name": "iSIGHT Sandworm 2014",
"description": "Hultquist, J.. (2016, January 7). Sandworm Team and the Ukrainian Power Authority Attacks. Retrieved October 6, 2017.",
"url": "https://www.fireeye.com/blog/threat-research/2016/01/ukraine-and-sandworm-team.html"
},
{
"source_name": "CrowdStrike VOODOO BEAR",
"description": "Meyers, A. (2018, January 19). Meet CrowdStrike\u2019s Adversary of the Month for January: VOODOO BEAR. Retrieved May 22, 2018.",
"url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-january-voodoo-bear/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft Prestige ransomware October 2022",
"description": "MSTIC. (2022, October 14). New \u201cPrestige\u201d ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023.",
"url": "https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"
},
{
"source_name": "InfoSecurity Sandworm Oct 2014",
"description": "Muncaster, P.. (2014, October 14). Microsoft Zero Day Traced to Russian \u2018Sandworm\u2019 Hackers. Retrieved October 6, 2017.",
"url": "https://www.infosecurity-magazine.com/news/microsoft-zero-day-traced-russian/"
},
{
"source_name": "NCSC Sandworm Feb 2020",
"description": "NCSC. (2020, February 20). NCSC supports US advisory regarding GRU intrusion set Sandworm. Retrieved June 10, 2020.",
"url": "https://www.ncsc.gov.uk/news/ncsc-supports-sandworm-advisory"
},
{
"source_name": "USDOJ Sandworm Feb 2020",
"description": "Pompeo, M. (2020, February 20). The United States Condemns Russian Cyber Attack Against the Country of Georgia. Retrieved September 12, 2024.",
"url": "https://2017-2021.state.gov/the-united-states-condemns-russian-cyber-attack-against-the-country-of-georgia/index.html"
},
{
"source_name": "mandiant_apt44_unearthing_sandworm",
"description": "Roncone, G. et al. (n.d.). APT44: Unearthing Sandworm. Retrieved July 11, 2024.",
"url": "https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf"
},
{
"source_name": "US District Court Indictment GRU Unit 74455 October 2020",
"description": "Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.",
"url": "https://www.justice.gov/opa/press-release/file/1328521/download"
},
{
"source_name": "Secureworks IRON VIKING ",
"description": "Secureworks. (2020, May 1). IRON VIKING Threat Profile. Retrieved June 10, 2020.",
"url": "https://www.secureworks.com/research/threat-profiles/iron-viking"
},
{
"source_name": "UK NCSC Olympic Attacks October 2020",
"description": "UK NCSC. (2020, October 19). UK exposes series of Russian cyber attacks against Olympic and Paralympic Games . Retrieved November 30, 2020.",
"url": "https://www.gov.uk/government/news/uk-exposes-series-of-russian-cyber-attacks-against-olympic-and-paralympic-games"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Dragos Threat Intelligence",
"Hakan KARABACAK"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "4.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:32.342000+00:00\", \"old_value\": \"2024-12-04 21:17:08.593000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "4.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--44d37b89-a739-4810-9111-0d2617a8939b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-07-05 17:54:54.789000+00:00",
"modified": "2026-07-31 20:48:33.778000+00:00",
"name": "Scattered Spider",
"description": "[Scattered Spider](https://attack.mitre.org/groups/G1015) is a native English-speaking cybercriminal group active since at least 2022. (Citation: CrowdStrike Scattered Spider Profile) (Citation: MSTIC Octo Tempest Operations October 2023) The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. (Citation: MSTIC Octo Tempest Operations October 2023)\n[Scattered Spider](https://attack.mitre.org/groups/G1015) relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. (Citation: CISA Scattered Spider Advisory November 2023) (Citation: CrowdStrike Scattered Spider BYOVD January 2023) (Citation: Crowdstrike TELCO BPO Campaign December 2022)\n[Scattered Spider](https://attack.mitre.org/groups/G1015) had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. (Citation: Mandiant UNC3944 May 2025)",
"aliases": [
"Scattered Spider",
"Roasted 0ktapus",
"Octo Tempest",
"Storm-0875",
"UNC3944"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1015",
"external_id": "G1015"
},
{
"source_name": "Roasted 0ktapus",
"description": "(Citation: CrowdStrike Scattered Spider BYOVD January 2023)"
},
{
"source_name": "UNC3944",
"description": "(Citation: Mandiant UNC3944 May 2025)(Citation: Mandiant VMware vSphere JUL 2025)"
},
{
"source_name": "Octo Tempest",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Storm-0875",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "CISA Scattered Spider Advisory November 2023",
"description": "CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.",
"url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"
},
{
"source_name": "CrowdStrike Scattered Spider BYOVD January 2023",
"description": "CrowdStrike. (2023, January 10). SCATTERED SPIDER Exploits Windows Security Deficiencies with Bring-Your-Own-Vulnerable-Driver Tactic in Attempt to Bypass Endpoint Security. Retrieved July 5, 2023.",
"url": "https://www.crowdstrike.com/blog/scattered-spider-attempts-to-avoid-detection-with-bring-your-own-vulnerable-driver-tactic/"
},
{
"source_name": "CrowdStrike Scattered Spider Profile",
"description": "CrowdStrike. (n.d.). Scattered Spider. Retrieved July 5, 2023.",
"url": "https://www.crowdstrike.com/adversaries/scattered-spider/"
},
{
"source_name": "Mandiant VMware vSphere JUL 2025",
"description": "Mandiant Incident Response. (2025, July 23). From Help Desk to Hypervisor: Defending Your VMware vSphere Estate from UNC3944. Retrieved October 13, 2025.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"
},
{
"source_name": "Mandiant UNC3944 May 2025",
"description": "Mandiant Incident Response. (2025, May 6). Defending Against UNC3944: Cybercrime Hardening Guidance from the Frontlines. Retrieved October 13, 2025.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "MSTIC Octo Tempest Operations October 2023",
"description": "Microsoft. (2023, October 25). Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction. Retrieved March 18, 2024.",
"url": "https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/"
},
{
"source_name": "Crowdstrike TELCO BPO Campaign December 2022",
"description": "Parisi, T. (2022, December 2). Not a SIMulation: CrowdStrike Investigations Reveal Intrusion Campaign Targeting Telco and BPO Companies. Retrieved June 30, 2023.",
"url": "https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:33.778000+00:00\", \"old_value\": \"2025-10-24 02:30:51.936000+00:00\"}}}",
"previous_version": "3.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--9b36c218-4d80-4ec6-a68d-cc2886bbe410",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-06-14 18:17:18.727000+00:00",
"modified": "2026-07-31 20:48:42.370000+00:00",
"name": "Star Blizzard",
"description": "[Star Blizzard](https://attack.mitre.org/groups/G1033) is a cyber espionage and influence group originating in Russia that has been active since at least 2019. [Star Blizzard](https://attack.mitre.org/groups/G1033) campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.(Citation: Microsoft Star Blizzard August 2022)(Citation: CISA Star Blizzard Advisory December 2023)(Citation: StarBlizzard)(Citation: Google TAG COLDRIVER January 2024)\n",
"aliases": [
"Star Blizzard",
"SEABORGIUM",
"Callisto Group",
"TA446",
"COLDRIVER"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1033",
"external_id": "G1033"
},
{
"source_name": "Callisto Group",
"description": "(Citation: CISA Star Blizzard Advisory December 2023)"
},
{
"source_name": "TA446",
"description": "(Citation: CISA Star Blizzard Advisory December 2023)"
},
{
"source_name": "COLDRIVER",
"description": "(Citation: Google TAG COLDRIVER January 2024)"
},
{
"source_name": "SEABORGIUM",
"description": "(Citation: Microsoft Star Blizzard August 2022)"
},
{
"source_name": "CISA Star Blizzard Advisory December 2023",
"description": "CISA, et al. (2023, December 7). Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spear-phishing Campaigns. Retrieved June 13, 2024.",
"url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a"
},
{
"source_name": "Microsoft Star Blizzard August 2022",
"description": "Microsoft Threat Intelligence. (2022, August 15). Disrupting SEABORGIUM\u2019s ongoing phishing operations. Retrieved June 13, 2024.",
"url": "https://www.microsoft.com/en-us/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/"
},
{
"source_name": "StarBlizzard",
"description": "Microsoft Threat Intelligence. (2023, December 7). Star Blizzard increases sophistication and evasion in ongoing attacks. Retrieved February 13, 2024.",
"url": "https://www.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks/"
},
{
"source_name": "Google TAG COLDRIVER January 2024",
"description": "Shields, W. (2024, January 18). Russian threat group COLDRIVER expands its targeting of Western officials to include the use of malware. Retrieved June 13, 2024.",
"url": "https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Aung Kyaw Min Naing, @Nolan"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:42.370000+00:00\", \"old_value\": \"2026-05-12 15:12:00.732000+00:00\"}}}",
"previous_version": "2.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--1f322d74-4822-4d60-8f64-414eea8a9258",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-04-02 18:58:36.186000+00:00",
"modified": "2026-07-31 20:48:28.893000+00:00",
"name": "UNC788",
"description": "[UNC788](https://attack.mitre.org/groups/G1029) is a group of hackers from Iran that has targeted people in the Middle East.(Citation: Meta Adversarial Threat Report 2022)",
"aliases": [
"UNC788"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1029",
"external_id": "G1029"
},
{
"source_name": "Meta Adversarial Threat Report 2022",
"description": "Agranovich, D., et al. (2022, April). Adversarial Threat Report. Retrieved April 2, 2024.",
"url": "https://about.fb.com/wp-content/uploads/2022/04/Meta-Quarterly-Adversarial-Threat-Report_Q1-2022.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Denise Tan"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:28.893000+00:00\", \"old_value\": \"2024-04-02 18:58:54.885000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--f8cb7b36-62ef-4488-8a6d-a7033e3271c1",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-05-24 17:02:44.226000+00:00",
"modified": "2026-07-31 20:48:52.082000+00:00",
"name": "WIRTE",
"description": "[WIRTE](https://attack.mitre.org/groups/G0090) is a cyberespionage actor, believed to be a subgroup of the Hamas-affiliated Gaza Cybergang, that has been active since at least August 2018. [WIRTE](https://attack.mitre.org/groups/G0090) has targeted diplomatic, financial, military, legal, and technology organizations across the Middle East, North Africa, and in Europe to gather intelligence. [WIRTE](https://attack.mitre.org/groups/G0090) has remained persistently active despite the ongoing Israel-Hamas conflict and has expanded their operations to include wiper malware attacks against Israeli targets.(Citation: Lab52 WIRTE Apr 2019)(Citation: Kaspersky WIRTE November 2021)(Citation: Check Point Wirte NOV 2024)(Citation: Palo Alto Ashen Lepus DEC 2025)",
"aliases": [
"WIRTE",
"Ashen Lepus"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0090",
"external_id": "G0090"
},
{
"source_name": "WIRTE",
"description": "(Citation: Lab52 WIRTE Apr 2019)"
},
{
"source_name": "Ashen Lepus",
"description": "(Citation: Palo Alto Ashen Lepus DEC 2025)"
},
{
"source_name": "Check Point Wirte NOV 2024",
"description": "Check Point. (2024, November 12). Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity. Retrieved April 20, 2026.",
"url": "https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"
},
{
"source_name": "Lab52 WIRTE Apr 2019",
"description": "S2 Grupo. (2019, April 2). WIRTE Group attacking the Middle East. Retrieved May 24, 2019.",
"url": "https://lab52.io/blog/wirte-group-attacking-the-middle-east/"
},
{
"source_name": "Palo Alto Ashen Lepus DEC 2025",
"description": "Unit 42. (2025, December 11). Hamas-Affiliated Ashen Lepus Targets Middle Eastern Diplomatic Entities With New AshTag Malware Suite. Retrieved April 20, 2026.",
"url": "https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"
},
{
"source_name": "Kaspersky WIRTE November 2021",
"description": "Yamout, M. (2021, November 29). WIRTE\u2019s campaign in the Middle East \u2018living off the land\u2019 since at least 2019. Retrieved February 1, 2022.",
"url": "https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Lab52 by S2 Grupo"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:52.082000+00:00\", \"old_value\": \"2026-04-23 02:15:29.965000+00:00\"}}}",
"previous_version": "3.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--afec6dc3-a18e-4b62-b1a4-5510e1a498d1",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-06-25 17:16:39.168000+00:00",
"modified": "2026-07-31 20:48:43.267000+00:00",
"name": "Windshift",
"description": "[Windshift](https://attack.mitre.org/groups/G0112) is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.(Citation: SANS Windshift August 2018)(Citation: objective-see windtail1 dec 2018)(Citation: objective-see windtail2 jan 2019)",
"aliases": [
"Windshift",
"Bahamut"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0112",
"external_id": "G0112"
},
{
"source_name": "Bahamut",
"description": "(Citation: SANS Windshift August 2018)"
},
{
"source_name": "SANS Windshift August 2018",
"description": "Karim, T. (2018, August). TRAILS OF WINDSHIFT. Retrieved November 17, 2024.",
"url": "https://www.scribd.com/document/661837258/WINDSHIFT-summit-archive-1554718868"
},
{
"source_name": "objective-see windtail1 dec 2018",
"description": "Wardle, Patrick. (2018, December 20). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 1). Retrieved October 3, 2019.",
"url": "https://objective-see.com/blog/blog_0x3B.html"
},
{
"source_name": "objective-see windtail2 jan 2019",
"description": "Wardle, Patrick. (2019, January 15). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 2). Retrieved October 3, 2019.",
"url": "https://objective-see.com/blog/blog_0x3D.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:43.267000+00:00\", \"old_value\": \"2024-11-17 14:15:51.850000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
}
],
"revocations": [],
"deprecations": [],
"deletions": []
},
"campaigns": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [
{
"type": "campaign",
"id": "campaign--a82bc5ad-5f95-4c6a-9f25-aaf6f476a3c4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-28 18:00:04.123000+00:00",
"modified": "2026-07-31 20:48:20.147000+00:00",
"name": "C0033",
"description": "[C0033](https://attack.mitre.org/campaigns/C0033) was a [PROMETHIUM](https://attack.mitre.org/groups/G0056) campaign during which they used [StrongPity](https://attack.mitre.org/software/S0491) to target Android users. [C0033](https://attack.mitre.org/campaigns/C0033) was the first publicly documented mobile campaign for [PROMETHIUM](https://attack.mitre.org/groups/G0056), who previously used Windows-based techniques.(Citation: welivesec_strongpity)",
"aliases": [
"C0033"
],
"first_seen": "2016-05-01 07:00:00+00:00",
"last_seen": "2023-01-01 08:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0033",
"external_id": "C0033"
},
{
"source_name": "securelist_strongpity",
"description": "Baumgartner, K. (2016, October 3). On the StrongPity Waterhole Attacks Targeting Italian and Belgian Encryption Users. Retrieved March 28, 2024.",
"url": "https://securelist.com/on-the-strongpity-waterhole-attacks-targeting-italian-and-belgian-encryption-users/76147/"
},
{
"source_name": "welivesec_strongpity",
"description": "Stefanko, L. (2023, January 10). StrongPity espionage campaign targeting Android users. Retrieved January 31, 2023.",
"url": "https://www.welivesecurity.com/2023/01/10/strongpity-espionage-campaign-targeting-android-users/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Hiroki Nagahama, NEC Corporation",
"Manikantan Srinivasan, NEC Corporation India",
"Pooja Natarajan, NEC Corporation India"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_first_seen_citation": "(Citation: securelist_strongpity)",
"x_mitre_last_seen_citation": "(Citation: welivesec_strongpity)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:20.147000+00:00\", \"old_value\": \"2024-04-11 15:10:14.209000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--4603cf2f-06d0-4970-9c5d-5071b08c817f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-09-29 20:00:38.136000+00:00",
"modified": "2026-07-31 20:48:14.337000+00:00",
"name": "Operation Dust Storm",
"description": "[Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) was a long-standing persistent cyber espionage campaign that targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countries. By 2015, the [Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) threat actors shifted from government and defense-related intelligence targets to Japanese companies or Japanese subdivisions of larger foreign organizations supporting Japan's critical infrastructure, including electricity generation, oil and natural gas, finance, transportation, and construction.(Citation: Cylance Dust Storm)\n\n[Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) threat actors also began to use Android backdoors in their operations by 2015, with all identified victims at the time residing in Japan or South Korea.(Citation: Cylance Dust Storm)",
"aliases": [
"Operation Dust Storm"
],
"first_seen": "2010-01-01 07:00:00+00:00",
"last_seen": "2016-02-01 06:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0016",
"external_id": "C0016"
},
{
"source_name": "Cylance Dust Storm",
"description": "Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.",
"url": "https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_first_seen_citation": "(Citation: Cylance Dust Storm)",
"x_mitre_last_seen_citation": "(Citation: Cylance Dust Storm)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:14.337000+00:00\", \"old_value\": \"2024-04-11 00:30:42.003000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1"
},
{
"type": "campaign",
"id": "campaign--d0695b5f-b761-49e0-b3e3-2e5307f8def3",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-03-28 14:45:30.132000+00:00",
"modified": "2026-07-31 20:48:21.820000+00:00",
"name": "Operation Triangulation",
"description": "[Operation Triangulation](https://attack.mitre.org/campaigns/C0054) is a mobile campaign targeting iOS devices.(Citation: SecureList OpTriangulation 01Jun2023) The unidentified actors used zero-click exploits in iMessage attachments to gain [Initial Access](https://attack.mitre.org/tactics/TA0027), then executed exploits and validators, such as [Binary Validator](https://attack.mitre.org/software/S1215) before finally executing the [TriangleDB](https://attack.mitre.org/software/S1216) implant. ",
"aliases": [
"Operation Triangulation"
],
"first_seen": "2019-01-01 08:00:00+00:00",
"last_seen": "2023-06-01 07:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0054",
"external_id": "C0054"
},
{
"source_name": "SecureList OpTriangulation 01Jun2023",
"description": "Kuznetsov, I., et al. (2023, June 1). Operation Triangulation: iOS devices targeted with previously unknown malware. Retrieved April 18, 2024.",
"url": "https://securelist.com/operation-triangulation/109842/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"mobile-attack"
],
"x_mitre_first_seen_citation": "(Citation: SecureList OpTriangulation 01Jun2023)",
"x_mitre_last_seen_citation": "(Citation: SecureList OpTriangulation 01Jun2023)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:21.820000+00:00\", \"old_value\": \"2025-03-28 15:23:16.915000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
}
],
"revocations": [],
"deprecations": [],
"deletions": []
},
"assets": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [],
"revocations": [],
"deprecations": [],
"deletions": []
},
"mitigations": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [],
"revocations": [],
"deprecations": [],
"deletions": []
},
"datasources": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [],
"revocations": [],
"deprecations": [],
"deletions": []
},
"datacomponents": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [],
"revocations": [],
"deprecations": [],
"deletions": []
},
"detectionstrategies": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [],
"revocations": [],
"deprecations": [],
"deletions": []
},
"analytics": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [],
"revocations": [],
"deprecations": [],
"deletions": []
}
},
"ics-attack": {
"techniques": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [],
"revocations": [],
"deprecations": [],
"deletions": []
},
"software": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [],
"revocations": [],
"deprecations": [],
"deletions": []
},
"groups": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [
{
"type": "intrusion-set",
"id": "intrusion-set--190242d7-73fc-4738-af68-20162f7a5aae",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:57.307000+00:00",
"modified": "2026-07-31 20:48:27.733000+00:00",
"name": "ALLANITE",
"description": "[ALLANITE](https://attack.mitre.org/groups/G1000) is a suspected Russian cyber espionage group, that has primarily targeted the electric utility sector within the United States and United Kingdom. The group's tactics and techniques are reportedly similar to [Dragonfly](https://attack.mitre.org/groups/G0035), although [ALLANITE](https://attack.mitre.org/groups/G1000)s technical capabilities have not exhibited disruptive or destructive abilities. It has been suggested that the group maintains a presence in ICS for the purpose of gaining understanding of processes and to maintain persistence. (Citation: Dragos)",
"aliases": [
"ALLANITE",
"Palmetto Fusion"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1000",
"external_id": "G1000"
},
{
"source_name": "Dragos",
"description": "Dragos Allanite Retrieved. 2019/10/27 ",
"url": "https://dragos.com/resource/allanite/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Dragos Threat Intelligence"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:27.733000+00:00\", \"old_value\": \"2025-04-16 21:26:23.407000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--fbd29c89-18ba-4c2d-b792-51c0adee049f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-04-18 17:59:24.739000+00:00",
"modified": "2026-07-31 20:48:52.730000+00:00",
"name": "APT33",
"description": "[APT33](https://attack.mitre.org/groups/G0064) is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.(Citation: FireEye APT33 Sept 2017)(Citation: FireEye APT33 Webinar Sept 2017)",
"aliases": [
"APT33",
"HOLMIUM",
"Elfin",
"Peach Sandstorm"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0064",
"external_id": "G0064"
},
{
"source_name": "APT33",
"description": "(Citation: FireEye APT33 Sept 2017) (Citation: FireEye APT33 Webinar Sept 2017)"
},
{
"source_name": "HOLMIUM",
"description": "(Citation: Microsoft Holmium June 2020)"
},
{
"source_name": "Peach Sandstorm",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Elfin",
"description": "(Citation: Symantec Elfin Mar 2019)"
},
{
"source_name": "FireEye APT33 Webinar Sept 2017",
"description": "Davis, S. and Carr, N. (2017, September 21). APT33: New Insights into Iranian Cyber Espionage Group. Retrieved February 15, 2018.",
"url": "https://www.brighttalk.com/webcast/10703/275683"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft Holmium June 2020",
"description": "Microsoft Threat Protection Intelligence Team. (2020, June 18). Inside Microsoft Threat Protection: Mapping attack chains from cloud to endpoint. Retrieved June 22, 2020.",
"url": "https://www.microsoft.com/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/"
},
{
"source_name": "FireEye APT33 Sept 2017",
"description": "O'Leary, J., et al. (2017, September 20). Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware. Retrieved February 15, 2018.",
"url": "https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html"
},
{
"source_name": "Symantec Elfin Mar 2019",
"description": "Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019.",
"url": "https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Dragos Threat Intelligence"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:52.730000+00:00\", \"old_value\": \"2024-04-11 16:06:34.700000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--00f67a77-86a4-4adf-be26-1a54fc713340",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-01-29 21:27:24.793000+00:00",
"modified": "2026-07-31 20:48:22.752000+00:00",
"name": "APT38",
"description": "[APT38](https://attack.mitre.org/groups/G0082) is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz August 2020) Active since at least 2014, [APT38](https://attack.mitre.org/groups/G0082) has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which [APT38](https://attack.mitre.org/groups/G0082) stole $81 million, as well as attacks against Bancomext (Citation: FireEye APT38 Oct 2018) and Banco de Chile (Citation: FireEye APT38 Oct 2018); some of their attacks have been destructive.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The Hood Blog 2017)\n\nNorth Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups.",
"aliases": [
"APT38",
"NICKEL GLADSTONE",
"BeagleBoyz",
"Bluenoroff",
"Stardust Chollima",
"Sapphire Sleet",
"COPERNICIUM"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0082",
"external_id": "G0082"
},
{
"source_name": "BeagleBoyz",
"description": "(Citation: CISA AA20-239A BeagleBoyz August 2020)"
},
{
"source_name": "Stardust Chollima",
"description": "(Citation: CrowdStrike Stardust Chollima Profile April 2018)(Citation: CrowdStrike GTR 2021 June 2021)"
},
{
"source_name": "APT38",
"description": "(Citation: FireEye APT38 Oct 2018)"
},
{
"source_name": "Bluenoroff",
"description": "(Citation: Kaspersky Lazarus Under The Hood Blog 2017)"
},
{
"source_name": "Sapphire Sleet",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "COPERNICIUM",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "NICKEL GLADSTONE",
"description": "(Citation: SecureWorks NICKEL GLADSTONE profile Sept 2021)"
},
{
"source_name": "CrowdStrike GTR 2021 June 2021",
"description": "CrowdStrike. (2021, June 7). CrowdStrike 2021 Global Threat Report. Retrieved September 29, 2021.",
"url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf"
},
{
"source_name": "DOJ North Korea Indictment Feb 2021",
"description": "Department of Justice. (2021, February 17). Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe. Retrieved June 9, 2021.",
"url": "https://www.justice.gov/opa/pr/three-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyberattacks-and"
},
{
"source_name": "CISA AA20-239A BeagleBoyz August 2020",
"description": "DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.",
"url": "https://us-cert.cisa.gov/ncas/alerts/aa20-239a"
},
{
"source_name": "FireEye APT38 Oct 2018",
"description": "FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.",
"url": "https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"
},
{
"source_name": "Kaspersky Lazarus Under The Hood Blog 2017",
"description": "GReAT. (2017, April 3). Lazarus Under the Hood. Retrieved April 17, 2019.",
"url": "https://securelist.com/lazarus-under-the-hood/77908/"
},
{
"source_name": "CrowdStrike Stardust Chollima Profile April 2018",
"description": "Meyers, Adam. (2018, April 6). Meet CrowdStrike\u2019s Adversary of the Month for April: STARDUST CHOLLIMA. Retrieved September 29, 2021.",
"url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-april-stardust-chollima/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "SecureWorks NICKEL GLADSTONE profile Sept 2021",
"description": "SecureWorks. (2021, September 29). NICKEL GLADSTONE Threat Profile. Retrieved September 29, 2021.",
"url": "https://www.secureworks.com/research/threat-profiles/nickel-gladstone"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Hiroki Nagahama, NEC Corporation",
"Manikantan Srinivasan, NEC Corporation India",
"Pooja Natarajan, NEC Corporation India"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "3.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:22.752000+00:00\", \"old_value\": \"2025-11-13 19:21:05.133000+00:00\"}}}",
"previous_version": "3.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--a07a367a-146c-45a8-a830-d3d337b9befa",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-25 19:57:07.829000+00:00",
"modified": "2026-07-31 20:48:42.789000+00:00",
"name": "CyberAv3ngers",
"description": "The [CyberAv3ngers](https://attack.mitre.org/groups/G1027) are a suspected Iranian Government Islamic Revolutionary Guard Corps (IRGC)-affiliated APT group. The [CyberAv3ngers](https://attack.mitre.org/groups/G1027) have been known to be active since at least 2020, with disputed and false claims of critical infrastructure compromises in Israel.(Citation: CISA AA23-335A IRGC-Affiliated December 2023)\n\nIn 2023, the [CyberAv3ngers](https://attack.mitre.org/groups/G1027) engaged in a global targeting and hacking of the Unitronics [Programmable Logic Controller (PLC)](https://attack.mitre.org/assets/A0003) with [Human-Machine Interface (HMI)](https://attack.mitre.org/assets/A0002). This PLC can be found in multiple sectors, including water and wastewater, energy, food and beverage manufacturing, and healthcare. The most notable feature of this attack was the defacement of the devices user interface.(Citation: CISA AA23-335A IRGC-Affiliated December 2023)",
"aliases": [
"CyberAv3ngers",
"Soldiers of Soloman"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1027",
"external_id": "G1027"
},
{
"source_name": "Soldiers of Soloman",
"description": "CyberAv3ngers reportedly has connections to the IRGC-linked group Soldiers of Solomon.(Citation: CISA AA23-335A IRGC-Affiliated December 2023)"
},
{
"source_name": "CISA AA23-335A IRGC-Affiliated December 2023",
"description": "DHS/CISA. (2023, December 1). IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities. Retrieved March 25, 2024.",
"url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:42.789000+00:00\", \"old_value\": \"2024-04-10 18:39:36.997000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--1c63d4ec-0a75-4daa-b1df-0d11af3d3cc1",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:05.217000+00:00",
"modified": "2026-07-31 20:48:28.048000+00:00",
"name": "Dragonfly",
"description": "[Dragonfly](https://attack.mitre.org/groups/G0035) is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022) Active since at least 2010, [Dragonfly](https://attack.mitre.org/groups/G0035) has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.(Citation: Symantec Dragonfly)(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Symantec Dragonfly Sept 2017)(Citation: Fortune Dragonfly 2.0 Sept 2017)(Citation: Gigamon Berserk Bear October 2021)(Citation: CISA AA20-296A Berserk Bear December 2020)(Citation: Symantec Dragonfly 2.0 October 2017)",
"aliases": [
"Dragonfly",
"TEMP.Isotope",
"DYMALLOY",
"Berserk Bear",
"TG-4192",
"Crouching Yeti",
"IRON LIBERTY",
"Energetic Bear",
"Ghost Blizzard",
"BROMINE"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0035",
"external_id": "G0035"
},
{
"source_name": "DYMALLOY",
"description": "(Citation: Dragos DYMALLOY )(Citation: UK GOV FSB Factsheet April 2022)"
},
{
"source_name": "Berserk Bear",
"description": "(Citation: Gigamon Berserk Bear October 2021)(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022)"
},
{
"source_name": "TEMP.Isotope",
"description": "(Citation: Mandiant Ukraine Cyber Threats January 2022)(Citation: Gigamon Berserk Bear October 2021)"
},
{
"source_name": "Ghost Blizzard",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "BROMINE",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Crouching Yeti",
"description": "(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Gigamon Berserk Bear October 2021)(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022)"
},
{
"source_name": "IRON LIBERTY",
"description": "(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Secureworks MCMD July 2019)(Citation: Secureworks Karagany July 2019)(Citation: UK GOV FSB Factsheet April 2022)"
},
{
"source_name": "TG-4192",
"description": "(Citation: Secureworks IRON LIBERTY July 2019)(Citation: UK GOV FSB Factsheet April 2022)"
},
{
"source_name": "Dragonfly",
"description": "(Citation: Symantec Dragonfly)(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Gigamon Berserk Bear October 2021)(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022)"
},
{
"source_name": "Energetic Bear",
"description": "(Citation: Symantec Dragonfly)(Citation: Secureworks IRON LIBERTY July 2019)(Citation: Secureworks MCMD July 2019)(Citation: Secureworks Karagany July 2019)(Citation: Gigamon Berserk Bear October 2021)(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV FSB Factsheet April 2022)"
},
{
"source_name": "CISA AA20-296A Berserk Bear December 2020",
"description": "CISA. (2020, December 1). Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets. Retrieved December 9, 2021.",
"url": "https://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions"
},
{
"source_name": "DOJ Russia Targeting Critical Infrastructure March 2022",
"description": "Department of Justice. (2022, March 24). Four Russian Government Employees Charged in Two Historical Hacking Campaigns Targeting Critical Infrastructure Worldwide. Retrieved April 5, 2022.",
"url": "https://www.justice.gov/opa/pr/four-russian-government-employees-charged-two-historical-hacking-campaigns-targeting-critical"
},
{
"source_name": "Dragos DYMALLOY ",
"description": "Dragos. (n.d.). DYMALLOY. Retrieved August 20, 2020.",
"url": "https://www.dragos.com/threat/dymalloy/"
},
{
"source_name": "Fortune Dragonfly 2.0 Sept 2017",
"description": "Hackett, R. (2017, September 6). Hackers Have Penetrated Energy Grid, Symantec Warns. Retrieved June 6, 2018.",
"url": "http://fortune.com/2017/09/06/hack-energy-grid-symantec/"
},
{
"source_name": "Mandiant Ukraine Cyber Threats January 2022",
"description": "Hultquist, J. (2022, January 20). Anticipating Cyber Threats as the Ukraine Crisis Escalates. Retrieved January 24, 2022.",
"url": "https://www.mandiant.com/resources/ukraine-crisis-cyber-threats"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Secureworks MCMD July 2019",
"description": "Secureworks. (2019, July 24). MCMD Malware Analysis. Retrieved August 13, 2020.",
"url": "https://www.secureworks.com/research/mcmd-malware-analysis"
},
{
"source_name": "Secureworks IRON LIBERTY July 2019",
"description": "Secureworks. (2019, July 24). Resurgent Iron Liberty Targeting Energy Sector. Retrieved August 12, 2020.",
"url": "https://www.secureworks.com/research/resurgent-iron-liberty-targeting-energy-sector"
},
{
"source_name": "Secureworks Karagany July 2019",
"description": "Secureworks. (2019, July 24). Updated Karagany Malware Targets Energy Sector. Retrieved August 12, 2020.",
"url": "https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector"
},
{
"source_name": "Gigamon Berserk Bear October 2021",
"description": "Slowik, J. (2021, October). THE BAFFLING BERSERK BEAR: A DECADE\u2019S ACTIVITY TARGETING CRITICAL INFRASTRUCTURE. Retrieved December 6, 2021.",
"url": "https://vblocalhost.com/uploads/VB2021-Slowik.pdf"
},
{
"source_name": "Symantec Dragonfly Sept 2017",
"description": "Symantec Security Response. (2014, July 7). Dragonfly: Western energy sector targeted by sophisticated attack group. Retrieved September 9, 2017.",
"url": "https://docs.broadcom.com/doc/dragonfly_threat_against_western_energy_suppliers"
},
{
"source_name": "Symantec Dragonfly",
"description": "Symantec Security Response. (2014, June 30). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.",
"url": "https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"
},
{
"source_name": "Symantec Dragonfly 2.0 October 2017",
"description": "Symantec. (2017, October 7). Dragonfly: Western energy sector targeted by sophisticated attack group. Retrieved April 19, 2022.",
"url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/dragonfly-energy-sector-cyber-attacks"
},
{
"source_name": "UK GOV FSB Factsheet April 2022",
"description": "UK Gov. (2022, April 5). Russia's FSB malign activity: factsheet. Retrieved April 5, 2022.",
"url": "https://www.gov.uk/government/publications/russias-fsb-malign-cyber-activity-factsheet/russias-fsb-malign-activity-factsheet"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Dragos Threat Intelligence"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "4.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:28.048000+00:00\", \"old_value\": \"2024-01-08 20:40:31.822000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "4.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--2a7914cf-dff3-428d-ab0f-1014d1c28aeb",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:06.015000+00:00",
"modified": "2026-07-31 20:48:30.435000+00:00",
"name": "FIN6",
"description": "[FIN6](https://attack.mitre.org/groups/G0037) is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)",
"aliases": [
"FIN6",
"Magecart Group 6",
"ITG08",
"Skeleton Spider",
"TAAL",
"Camouflage Tempest"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0037",
"external_id": "G0037"
},
{
"source_name": "Skeleton Spider",
"description": "(Citation: Crowdstrike Global Threat Report Feb 2018)"
},
{
"source_name": "FIN6",
"description": "(Citation: FireEye FIN6 April 2016)"
},
{
"source_name": "TAAL",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Camouflage Tempest",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Magecart Group 6",
"description": "(Citation: Security Intelligence ITG08 April 2020)"
},
{
"source_name": "ITG08",
"description": "(Citation: Security Intelligence More Eggs Aug 2019)"
},
{
"source_name": "Crowdstrike Global Threat Report Feb 2018",
"description": "CrowdStrike. (2018, February 26). CrowdStrike 2018 Global Threat Report. Retrieved October 10, 2018.",
"url": "https://crowdstrike.lookbookhq.com/global-threat-report-2018-web/cs-2018-global-threat-report"
},
{
"source_name": "FireEye FIN6 April 2016",
"description": "FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"
},
{
"source_name": "FireEye FIN6 Apr 2019",
"description": "McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019.",
"url": "https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Security Intelligence ITG08 April 2020",
"description": "Villadsen, O. (2020, April 7). ITG08 (aka FIN6) Partners With TrickBot Gang, Uses Anchor Framework. Retrieved October 8, 2020.",
"url": "https://securityintelligence.com/posts/itg08-aka-fin6-partners-with-trickbot-gang-uses-anchor-framework/"
},
{
"source_name": "Security Intelligence More Eggs Aug 2019",
"description": "Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.",
"url": "https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Center for Threat-Informed Defense (CTID)",
"Drew Church, Splunk"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "4.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:30.435000+00:00\", \"old_value\": \"2024-11-17 14:59:25.749000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "4.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--3753cc21-2dae-4dfb-8481-d004e74502cc",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:09.460000+00:00",
"modified": "2026-07-31 20:48:31.412000+00:00",
"name": "FIN7",
"description": "[FIN7](https://attack.mitre.org/groups/G0046) is a financially-motivated threat group that has been active since 2013. [FIN7](https://attack.mitre.org/groups/G0046) has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of [FIN7](https://attack.mitre.org/groups/G0046) was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, [FIN7](https://attack.mitre.org/groups/G0046) shifted operations to big game hunting (BGH), including use of [REvil](https://attack.mitre.org/software/S0496) ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the [Carbanak](https://attack.mitre.org/groups/G0008) Group, but multiple threat groups have been observed using [Carbanak](https://attack.mitre.org/software/S0030), leading these groups to be tracked separately.(Citation: FireEye FIN7 March 2017)(Citation: FireEye FIN7 April 2017)(Citation: FireEye CARBANAK June 2017)(Citation: FireEye FIN7 Aug 2018)(Citation: CrowdStrike Carbon Spider August 2021)(Citation: Mandiant FIN7 Apr 2022)(Citation: BiZone Lizar May 2021)",
"aliases": [
"FIN7",
"GOLD NIAGARA",
"ITG14",
"Carbon Spider",
"ELBRUS",
"Sangria Tempest"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0046",
"external_id": "G0046"
},
{
"source_name": "Carbon Spider",
"description": "(Citation: CrowdStrike Carbon Spider August 2021)"
},
{
"source_name": "FIN7",
"description": "(Citation: FireEye FIN7 March 2017) (Citation: FireEye FIN7 April 2017) (Citation: Morphisec FIN7 June 2017) (Citation: FireEye FIN7 Shim Databases) (Citation: FireEye FIN7 Aug 2018)"
},
{
"source_name": "ELBRUS",
"description": "(Citation: Microsoft Ransomware as a Service)"
},
{
"source_name": "Sangria Tempest",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "GOLD NIAGARA",
"description": "(Citation: Secureworks GOLD NIAGARA Threat Profile)"
},
{
"source_name": "Mandiant FIN7 Apr 2022",
"description": "Abdo, B., et al. (2022, April 4). FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7. Retrieved April 5, 2022.",
"url": "https://www.mandiant.com/resources/evolution-of-fin7"
},
{
"source_name": "FireEye CARBANAK June 2017",
"description": "Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018.",
"url": "https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html"
},
{
"source_name": "BiZone Lizar May 2021",
"description": "BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker\u2019s toolkit. Retrieved February 2, 2022.",
"url": "https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"
},
{
"source_name": "FireEye FIN7 April 2017",
"description": "Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017.",
"url": "https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"
},
{
"source_name": "FireEye FIN7 Aug 2018",
"description": "Carr, N., et al. (2018, August 01). On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation. Retrieved August 23, 2018.",
"url": "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
},
{
"source_name": "Secureworks GOLD NIAGARA Threat Profile",
"description": "CTU. (n.d.). GOLD NIAGARA. Retrieved September 21, 2021.",
"url": "https://www.secureworks.com/research/threat-profiles/gold-niagara"
},
{
"source_name": "FireEye FIN7 Shim Databases",
"description": "Erickson, J., McWhirt, M., Palombo, D. (2017, May 3). To SDB, Or Not To SDB: FIN7 Leveraging Shim Databases for Persistence. Retrieved July 18, 2017.",
"url": "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html"
},
{
"source_name": "Morphisec FIN7 June 2017",
"description": "Gorelik, M.. (2017, June 9). FIN7 Takes Another Bite at the Restaurant Industry. Retrieved July 13, 2017.",
"url": "http://blog.morphisec.com/fin7-attacks-restaurant-industry"
},
{
"source_name": "ITG14",
"description": "ITG14 shares campaign overlap with [FIN7](https://attack.mitre.org/groups/G0046).(Citation: IBM Ransomware Trends September 2020)"
},
{
"source_name": "CrowdStrike Carbon Spider August 2021",
"description": "Loui, E. and Reynolds, J. (2021, August 30). CARBON SPIDER Embraces Big Game Hunting, Part 1. Retrieved September 20, 2021.",
"url": "https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft Ransomware as a Service",
"description": "Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.",
"url": "https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"
},
{
"source_name": "FireEye FIN7 March 2017",
"description": "Miller, S., et al. (2017, March 7). FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings. Retrieved March 8, 2017.",
"url": "https://web.archive.org/web/20180808125108/https:/www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html"
},
{
"source_name": "IBM Ransomware Trends September 2020",
"description": "Singleton, C. and Kiefer, C. (2020, September 28). Ransomware 2020: Attack Trends Affecting Organizations Worldwide. Retrieved September 20, 2021.",
"url": "https://securityintelligence.com/posts/ransomware-2020-attack-trends-new-techniques-affecting-organizations-worldwide/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Edward Millington",
"Eric Loui, CrowdStrike Intelligence",
"Serhii Melnyk, Trustwave SpiderLabs"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "4.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:31.412000+00:00\", \"old_value\": \"2026-05-12 15:12:00.732000+00:00\"}}}",
"previous_version": "4.1"
},
{
"type": "intrusion-set",
"id": "intrusion-set--c77c5576-ca19-42ed-a36f-4b4486a84133",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-09-22 19:41:27.845000+00:00",
"modified": "2026-07-31 20:48:45.767000+00:00",
"name": "GOLD SOUTHFIELD",
"description": "[GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) is a financially motivated threat group active since at least 2018 that operates the [REvil](https://attack.mitre.org/software/S0496) Ransomware-as-a Service (RaaS). [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments. By early 2020, [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) started capitalizing on the new trend of stealing data and further extorting the victim to pay for their data to not get publicly leaked.(Citation: Secureworks REvil September 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: Secureworks GOLD SOUTHFIELD)(Citation: CrowdStrike Evolution of Pinchy Spider July 2021)",
"aliases": [
"GOLD SOUTHFIELD",
"Pinchy Spider"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0115",
"external_id": "G0115"
},
{
"source_name": "Pinchy Spider",
"description": "(Citation: CrowdStrike Evolution of Pinchy Spider July 2021)"
},
{
"source_name": "Secureworks REvil September 2019",
"description": "Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.",
"url": "https://www.secureworks.com/research/revil-sodinokibi-ransomware"
},
{
"source_name": "CrowdStrike Evolution of Pinchy Spider July 2021",
"description": "Meyers, Adam. (2021, July 6). The Evolution of PINCHY SPIDER from GandCrab to REvil. Retrieved March 28, 2023.",
"url": "https://www.crowdstrike.com/blog/the-evolution-of-revil-ransomware-and-pinchy-spider/"
},
{
"source_name": "Secureworks GandCrab and REvil September 2019",
"description": "Secureworks . (2019, September 24). REvil: The GandCrab Connection. Retrieved August 4, 2020.",
"url": "https://www.secureworks.com/blog/revil-the-gandcrab-connection"
},
{
"source_name": "Secureworks GOLD SOUTHFIELD",
"description": "Secureworks. (n.d.). GOLD SOUTHFIELD. Retrieved October 6, 2020.",
"url": "https://www.secureworks.com/research/threat-profiles/gold-southfield"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Thijn Bukkems, Amazon"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:45.767000+00:00\", \"old_value\": \"2025-04-16 20:37:38.397000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--f29b7c5e-2439-42ad-a86f-9f8984fafae3",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-10-17 00:14:20.652000+00:00",
"modified": "2026-07-31 20:48:51.374000+00:00",
"name": "HEXANE",
"description": "[HEXANE](https://attack.mitre.org/groups/G1001) is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. [HEXANE](https://attack.mitre.org/groups/G1001)'s TTPs appear similar to [APT33](https://attack.mitre.org/groups/G0064) and [OilRig](https://attack.mitre.org/groups/G0049) but due to differences in victims and tools it is tracked as a separate entity.(Citation: Dragos Hexane)(Citation: Kaspersky Lyceum October 2021)(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)",
"aliases": [
"HEXANE",
"Lyceum",
"Siamesekitten",
"Spirlin"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1001",
"external_id": "G1001"
},
{
"source_name": "Spirlin",
"description": "(Citation: Accenture Lyceum Targets November 2021)"
},
{
"source_name": "Siamesekitten",
"description": "(Citation: ClearSky Siamesekitten August 2021)"
},
{
"source_name": "Lyceum",
"description": "(Citation: SecureWorks August 2019)"
},
{
"source_name": "Accenture Lyceum Targets November 2021",
"description": "Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.",
"url": "https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns"
},
{
"source_name": "ClearSky Siamesekitten August 2021",
"description": "ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By \u201cSiamesekitten\u201d - Lyceum. Retrieved June 6, 2022.",
"url": "https://www.clearskysec.com/siamesekitten/"
},
{
"source_name": "Dragos Hexane",
"description": "Dragos. (n.d.). Hexane. Retrieved October 27, 2019.",
"url": "https://dragos.com/resource/hexane/"
},
{
"source_name": "Kaspersky Lyceum October 2021",
"description": "Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.",
"url": "https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"
},
{
"source_name": "SecureWorks August 2019",
"description": "SecureWorks 2019, August 27 LYCEUM Takes Center Stage in Middle East Campaign Retrieved. 2019/11/19 ",
"url": "https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Dragos Threat Intelligence",
"Mindaugas Gudzis, BT Security"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "2.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:51.374000+00:00\", \"old_value\": \"2026-05-12 15:12:00.732000+00:00\"}}}",
"previous_version": "2.3"
},
{
"type": "intrusion-set",
"id": "intrusion-set--c93fccb1-e8e8-42cf-ae33-2ad1d183913a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:03.807000+00:00",
"modified": "2026-07-31 20:48:46.106000+00:00",
"name": "Lazarus Group",
"description": "[Lazarus Group](https://attack.mitre.org/groups/G0032) is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). (Citation: US-CERT HIDDEN COBRA June 2017) (Citation: Treasury North Korean Cyber Groups September 2019) [Lazarus Group](https://attack.mitre.org/groups/G0032) has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by [Lazarus Group](https://attack.mitre.org/groups/G0032) correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.(Citation: Novetta Blockbuster)\n\nNorth Korea\u2019s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses \u201cLazarus Group\u201d as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.(Citation: Mandiant DPRK Laz Org Breakdown 2022)(Citation: Mandiant DPRK Groups 2023)(Citation: JPCert Blog Laz Subgroups 2025)\n\n",
"aliases": [
"Lazarus Group",
"Labyrinth Chollima",
"HIDDEN COBRA",
"Guardians of Peace",
"ZINC",
"NICKEL ACADEMY",
"Diamond Sleet"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0032",
"external_id": "G0032"
},
{
"source_name": "Labyrinth Chollima",
"description": "(Citation: CrowdStrike Labyrinth Chollima Feb 2022)"
},
{
"source_name": "Diamond Sleet",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "ZINC",
"description": "(Citation: Microsoft ZINC disruption Dec 2017)"
},
{
"source_name": "Lazarus Group",
"description": "(Citation: Novetta Blockbuster)"
},
{
"source_name": "NICKEL ACADEMY",
"description": "(Citation: Secureworks NICKEL ACADEMY Dec 2017)"
},
{
"source_name": "Guardians of Peace",
"description": "(Citation: US-CERT HIDDEN COBRA June 2017)"
},
{
"source_name": "CrowdStrike Labyrinth Chollima Feb 2022",
"description": "CrowdStrike. (2022, February 1). CrowdStrike Adversary Labyrinth Chollima. Retrieved February 1, 2022.",
"url": "https://web.archive.org/web/20210723190317/https://adversary.crowdstrike.com/en-US/adversary/labyrinth-chollima/"
},
{
"source_name": "Mandiant DPRK Groups 2023",
"description": "Michael Barnhart, Austin Larsen, Jeff Johnson, Taylor Long, Michelle Cantos, Adrian Hernandez. (2023, October 10). Assessed Cyber Structure and Alignments of North Korea in 2023. Retrieved August 25, 2025.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/north-korea-cyber-structure-alignment-2023"
},
{
"source_name": "Mandiant DPRK Laz Org Breakdown 2022",
"description": "Michael Barnhart, Michelle Cantos, Jeffery Johnson, Elias fox, Gary Freas, Dan Scott. (2022, March 23). Not So Lazarus: Mapping DPRK Cyber Threat Groups to Government Organizations. Retrieved September 9, 2025.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/mapping-dprk-groups-to-government/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Novetta Blockbuster",
"description": "Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.",
"url": "https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"
},
{
"source_name": "Secureworks NICKEL ACADEMY Dec 2017",
"description": "Secureworks. (2017, December 15). Media Alert - Secureworks Discovers North Korean Cyber Threat Group, Lazarus, Spearphishing Financial Executives of Cryptocurrency Companies. Retrieved December 27, 2017.",
"url": "https://www.secureworks.com/about/press/media-alert-secureworks-discovers-north-korean-cyber-threat-group-lazarus-spearphishing"
},
{
"source_name": "Microsoft ZINC disruption Dec 2017",
"description": "Smith, B. (2017, December 19). Microsoft and Facebook disrupt ZINC malware attack to protect customers and the internet from ongoing cyberthreats. Retrieved December 20, 2017.",
"url": "https://blogs.microsoft.com/on-the-issues/2017/12/19/microsoft-facebook-disrupt-zinc-malware-attack-protect-customers-internet-ongoing-cyberthreats/"
},
{
"source_name": "HIDDEN COBRA",
"description": "The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA.(Citation: US-CERT HIDDEN COBRA June 2017)(Citation: US-CERT HOPLIGHT Apr 2019)"
},
{
"source_name": "Treasury North Korean Cyber Groups September 2019",
"description": "US Treasury . (2019, September 13). Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups. Retrieved September 29, 2021.",
"url": "https://home.treasury.gov/news/press-releases/sm774"
},
{
"source_name": "US-CERT HIDDEN COBRA June 2017",
"description": "US-CERT. (2017, June 13). Alert (TA17-164A) HIDDEN COBRA \u2013 North Korea\u2019s DDoS Botnet Infrastructure. Retrieved July 13, 2017.",
"url": "https://www.us-cert.gov/ncas/alerts/TA17-164A"
},
{
"source_name": "US-CERT HOPLIGHT Apr 2019",
"description": "US-CERT. (2019, April 10). MAR-10135536-8 \u2013 North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019.",
"url": "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
},
{
"source_name": "JPCert Blog Laz Subgroups 2025",
"description": "\u4f50\u3005\u6728\u52c7\u4eba Hayato Sasaki. (2025, March 25). Tempted to Classifying APT Actors: Practical Challenges of Attribution in the Case of Lazarus\u2019s Subgroup. Retrieved August 25, 2025.",
"url": "https://blogs.jpcert.or.jp/en/2025/03/classifying-lazaruss-subgroup.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Kyaw Pyiyt Htet, @KyawPyiytHtet",
"Dragos Threat Intelligence",
"MyungUk Han, ASEC",
"Jun Hirata, NEC Corporation",
"Manikantan Srinivasan, NEC Corporation India",
"Pooja Natarajan, NEC Corporation India"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "5.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:46.106000+00:00\", \"old_value\": \"2026-05-12 15:12:00.732000+00:00\"}}}",
"previous_version": "5.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--4ca1929c-7d64-4aab-b849-badbfc0c760d",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-12-14 16:46:06.044000+00:00",
"modified": "2026-07-31 20:48:34.886000+00:00",
"name": "OilRig",
"description": "[OilRig](https://attack.mitre.org/groups/G0049) is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.(Citation: FireEye APT34 Dec 2017)(Citation: Palo Alto OilRig April 2017)(Citation: ClearSky OilRig Jan 2017)(Citation: Palo Alto OilRig May 2016)(Citation: Palo Alto OilRig Oct 2016)(Citation: Unit42 OilRig Playbook 2023)(Citation: Unit 42 QUADAGENT July 2018)",
"aliases": [
"OilRig",
"COBALT GYPSY",
"IRN2",
"APT34",
"Helix Kitten",
"Evasive Serpens",
"Hazel Sandstorm",
"EUROPIUM",
"ITG13",
"Earth Simnavaz",
"Crambus",
"TA452"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0049",
"external_id": "G0049"
},
{
"source_name": "IRN2",
"description": "(Citation: Crowdstrike Helix Kitten Nov 2018)"
},
{
"source_name": "ITG13",
"description": "(Citation: IBM ZeroCleare Wiper December 2019)"
},
{
"source_name": "Hazel Sandstorm",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "EUROPIUM",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "OilRig",
"description": "(Citation: Palo Alto OilRig April 2017) (Citation: ClearSky OilRig Jan 2017) (Citation: Palo Alto OilRig May 2016) (Citation: Palo Alto OilRig Oct 2016) (Citation: Unit 42 Playbook Dec 2017) (Citation: Unit 42 QUADAGENT July 2018)"
},
{
"source_name": "TA452",
"description": "(Citation: Proofpoint Iranian Aligned Attacks JAN 2020)"
},
{
"source_name": "COBALT GYPSY",
"description": "(Citation: Secureworks COBALT GYPSY Threat Profile)"
},
{
"source_name": "Crambus",
"description": "(Citation: Symantec Crambus OCT 2023)"
},
{
"source_name": "Earth Simnavaz",
"description": "(Citation: Trend Micro Earth Simnavaz October 2024)"
},
{
"source_name": "Helix Kitten",
"description": "(Citation: Unit 42 QUADAGENT July 2018)(Citation: Crowdstrike Helix Kitten Nov 2018)"
},
{
"source_name": "Evasive Serpens",
"description": "(Citation: Unit42 OilRig Playbook 2023)"
},
{
"source_name": "Check Point APT34 April 2021",
"description": "Check Point. (2021, April 8). Iran\u2019s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021.",
"url": "https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"
},
{
"source_name": "ClearSky OilRig Jan 2017",
"description": "ClearSky Cybersecurity. (2017, January 5). Iranian Threat Agent OilRig Delivers Digitally Signed Malware, Impersonates University of Oxford. Retrieved May 3, 2017.",
"url": "http://www.clearskysec.com/oilrig/"
},
{
"source_name": "Trend Micro Earth Simnavaz October 2024",
"description": "Fahmy, M. et al. (2024, October 11). Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against Middle East. Retrieved November 27, 2024.",
"url": "https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"
},
{
"source_name": "Palo Alto OilRig May 2016",
"description": "Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.",
"url": "http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"
},
{
"source_name": "Palo Alto OilRig April 2017",
"description": "Falcone, R.. (2017, April 27). OilRig Actors Provide a Glimpse into Development and Testing Efforts. Retrieved May 3, 2017.",
"url": "http://researchcenter.paloaltonetworks.com/2017/04/unit42-oilrig-actors-provide-glimpse-development-testing-efforts/"
},
{
"source_name": "Palo Alto OilRig Oct 2016",
"description": "Grunzweig, J. and Falcone, R.. (2016, October 4). OilRig Malware Campaign Updates Toolset and Expands Targets. Retrieved May 3, 2017.",
"url": "http://researchcenter.paloaltonetworks.com/2016/10/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/"
},
{
"source_name": "IBM ZeroCleare Wiper December 2019",
"description": "Kessem, L. (2019, December 4). New Destructive Wiper ZeroCleare Targets Energy Sector in the Middle East. Retrieved September 4, 2024.",
"url": "https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/"
},
{
"source_name": "Unit 42 QUADAGENT July 2018",
"description": "Lee, B., Falcone, R. (2018, July 25). OilRig Targets Technology Service Provider and Government Agency with QUADAGENT. Retrieved August 9, 2018.",
"url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"
},
{
"source_name": "Crowdstrike Helix Kitten Nov 2018",
"description": "Meyers, A. (2018, November 27). Meet CrowdStrike\u2019s Adversary of the Month for November: HELIX KITTEN. Retrieved December 18, 2018.",
"url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Proofpoint Iranian Aligned Attacks JAN 2020",
"description": "Proofpoint. (2020, January 10). Iranian State-Sponsored and Aligned Attacks: What You Need to Know and Steps to Protect Yourself. Retrieved January 16, 2025.",
"url": "https://www.proofpoint.com/us/corporate-blog/post/iranian-state-sponsored-and-aligned-attacks-what-you-need-know-and-steps-protect"
},
{
"source_name": "FireEye APT34 Dec 2017",
"description": "Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.",
"url": "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
},
{
"source_name": "Secureworks COBALT GYPSY Threat Profile",
"description": "Secureworks. (n.d.). COBALT GYPSY Threat Profile. Retrieved April 14, 2021.",
"url": "https://www.secureworks.com/research/threat-profiles/cobalt-gypsy"
},
{
"source_name": "Symantec Crambus OCT 2023",
"description": "Symantec Threat Hunter Team. (2023, October 19). Crambus: New Campaign Targets Middle Eastern Government. Retrieved November 27, 2024.",
"url": "https://www.security.com/threat-intelligence/crambus-middle-east-government"
},
{
"source_name": "APT34",
"description": "This group was previously tracked under two distinct groups, APT34 and OilRig, but was combined due to additional reporting giving higher confidence about the overlap of the activity.(Citation: Unit 42 QUADAGENT July 2018)(Citation: FireEye APT34 Dec 2017)(Citation: Check Point APT34 April 2021)"
},
{
"source_name": "Unit 42 Playbook Dec 2017",
"description": "Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.",
"url": "https://pan-unit42.github.io/playbook_viewer/"
},
{
"source_name": "Unit42 OilRig Playbook 2023",
"description": "Unit42. (2016, May 1). Evasive Serpens Unit 42 Playbook Viewer. Retrieved February 6, 2023.",
"url": "https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Robert Falcone",
"Bryan Lee",
"Dragos Threat Intelligence",
"Jaesang Oh, KC7 Foundation"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "5.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:34.886000+00:00\", \"old_value\": \"2026-05-12 15:12:00.732000+00:00\"}}}",
"previous_version": "5.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--381fcf73-60f6-4ab2-9991-6af3cbc35192",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:04.588000+00:00",
"modified": "2026-07-31 20:48:32.342000+00:00",
"name": "Sandworm Team",
"description": "[Sandworm Team](https://attack.mitre.org/groups/G0034) is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) This group has been active since at least 2009.(Citation: iSIGHT Sandworm 2014)(Citation: CrowdStrike VOODOO BEAR)(Citation: USDOJ Sandworm Feb 2020)(Citation: NCSC Sandworm Feb 2020)\n\nIn October 2020, the US indicted six GRU Unit 74455 officers associated with [Sandworm Team](https://attack.mitre.org/groups/G0034) for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide [NotPetya](https://attack.mitre.org/software/S0368) attack, targeting of the 2017 French presidential campaign, the 2018 [Olympic Destroyer](https://attack.mitre.org/software/S0365) attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as [APT28](https://attack.mitre.org/groups/G0007).(Citation: US District Court Indictment GRU Oct 2018)",
"aliases": [
"Sandworm Team",
"ELECTRUM",
"Telebots",
"IRON VIKING",
"BlackEnergy (Group)",
"Quedagh",
"Voodoo Bear",
"IRIDIUM",
"Seashell Blizzard",
"FROZENBARENTS",
"APT44"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0034",
"external_id": "G0034"
},
{
"source_name": "Voodoo Bear",
"description": "(Citation: CrowdStrike VOODOO BEAR)(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)"
},
{
"source_name": "ELECTRUM",
"description": "(Citation: Dragos ELECTRUM)(Citation: UK NCSC Olympic Attacks October 2020)"
},
{
"source_name": "Sandworm Team",
"description": "(Citation: iSIGHT Sandworm 2014) (Citation: F-Secure BlackEnergy 2014) (Citation: InfoSecurity Sandworm Oct 2014)(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)"
},
{
"source_name": "Quedagh",
"description": "(Citation: iSIGHT Sandworm 2014) (Citation: F-Secure BlackEnergy 2014)(Citation: UK NCSC Olympic Attacks October 2020)"
},
{
"source_name": "FROZENBARENTS",
"description": "(Citation: Leonard TAG 2023)"
},
{
"source_name": "APT44",
"description": "(Citation: mandiant_apt44_unearthing_sandworm)"
},
{
"source_name": "IRIDIUM",
"description": "(Citation: Microsoft Prestige ransomware October 2022)"
},
{
"source_name": "Seashell Blizzard",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "BlackEnergy (Group)",
"description": "(Citation: NCSC Sandworm Feb 2020)(Citation: UK NCSC Olympic Attacks October 2020)"
},
{
"source_name": "Telebots",
"description": "(Citation: NCSC Sandworm Feb 2020)(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)"
},
{
"source_name": "IRON VIKING",
"description": "(Citation: Secureworks IRON VIKING )(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)"
},
{
"source_name": "Leonard TAG 2023",
"description": "Billy Leonard. (2023, April 19). Ukraine remains Russia\u2019s biggest cyber focus in 2023. Retrieved March 1, 2024.",
"url": "https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"
},
{
"source_name": "US District Court Indictment GRU Oct 2018",
"description": "Brady, S . (2018, October 3). Indictment - United States vs Aleksei Sergeyevich Morenets, et al.. Retrieved October 1, 2020.",
"url": "https://www.justice.gov/opa/page/file/1098481/download"
},
{
"source_name": "Dragos ELECTRUM",
"description": "Dragos. (2017, January 1). ELECTRUM Threat Profile. Retrieved June 10, 2020.",
"url": "https://www.dragos.com/resource/electrum/"
},
{
"source_name": "F-Secure BlackEnergy 2014",
"description": "F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016.",
"url": "https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf"
},
{
"source_name": "iSIGHT Sandworm 2014",
"description": "Hultquist, J.. (2016, January 7). Sandworm Team and the Ukrainian Power Authority Attacks. Retrieved October 6, 2017.",
"url": "https://www.fireeye.com/blog/threat-research/2016/01/ukraine-and-sandworm-team.html"
},
{
"source_name": "CrowdStrike VOODOO BEAR",
"description": "Meyers, A. (2018, January 19). Meet CrowdStrike\u2019s Adversary of the Month for January: VOODOO BEAR. Retrieved May 22, 2018.",
"url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-january-voodoo-bear/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft Prestige ransomware October 2022",
"description": "MSTIC. (2022, October 14). New \u201cPrestige\u201d ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023.",
"url": "https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"
},
{
"source_name": "InfoSecurity Sandworm Oct 2014",
"description": "Muncaster, P.. (2014, October 14). Microsoft Zero Day Traced to Russian \u2018Sandworm\u2019 Hackers. Retrieved October 6, 2017.",
"url": "https://www.infosecurity-magazine.com/news/microsoft-zero-day-traced-russian/"
},
{
"source_name": "NCSC Sandworm Feb 2020",
"description": "NCSC. (2020, February 20). NCSC supports US advisory regarding GRU intrusion set Sandworm. Retrieved June 10, 2020.",
"url": "https://www.ncsc.gov.uk/news/ncsc-supports-sandworm-advisory"
},
{
"source_name": "USDOJ Sandworm Feb 2020",
"description": "Pompeo, M. (2020, February 20). The United States Condemns Russian Cyber Attack Against the Country of Georgia. Retrieved September 12, 2024.",
"url": "https://2017-2021.state.gov/the-united-states-condemns-russian-cyber-attack-against-the-country-of-georgia/index.html"
},
{
"source_name": "mandiant_apt44_unearthing_sandworm",
"description": "Roncone, G. et al. (n.d.). APT44: Unearthing Sandworm. Retrieved July 11, 2024.",
"url": "https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf"
},
{
"source_name": "US District Court Indictment GRU Unit 74455 October 2020",
"description": "Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.",
"url": "https://www.justice.gov/opa/press-release/file/1328521/download"
},
{
"source_name": "Secureworks IRON VIKING ",
"description": "Secureworks. (2020, May 1). IRON VIKING Threat Profile. Retrieved June 10, 2020.",
"url": "https://www.secureworks.com/research/threat-profiles/iron-viking"
},
{
"source_name": "UK NCSC Olympic Attacks October 2020",
"description": "UK NCSC. (2020, October 19). UK exposes series of Russian cyber attacks against Olympic and Paralympic Games . Retrieved November 30, 2020.",
"url": "https://www.gov.uk/government/news/uk-exposes-series-of-russian-cyber-attacks-against-olympic-and-paralympic-games"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Dragos Threat Intelligence",
"Hakan KARABACAK"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "4.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:32.342000+00:00\", \"old_value\": \"2024-12-04 21:17:08.593000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "4.2"
},
{
"type": "intrusion-set",
"id": "intrusion-set--9538b1a4-4120-4e2d-bf59-3b11fcab05a4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-04-16 15:14:38.533000+00:00",
"modified": "2026-07-31 20:48:41.930000+00:00",
"name": "TEMP.Veles",
"description": "[TEMP.Veles](https://attack.mitre.org/groups/G0088) is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing [TRITON](https://attack.mitre.org/software/S0609), a malware framework designed to manipulate industrial safety systems.(Citation: FireEye TRITON 2019)(Citation: FireEye TEMP.Veles 2018)(Citation: FireEye TEMP.Veles JSON April 2019)",
"aliases": [
"TEMP.Veles",
"XENOTIME"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0088",
"external_id": "G0088"
},
{
"source_name": "TEMP.Veles",
"description": "(Citation: FireEye TRITON 2019)"
},
{
"source_name": "Dragos Xenotime 2018",
"description": "Dragos, Inc.. (n.d.). Xenotime. Retrieved April 16, 2019.",
"url": "https://dragos.com/resource/xenotime/"
},
{
"source_name": "FireEye TEMP.Veles 2018",
"description": "FireEye Intelligence . (2018, October 23). TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers. Retrieved April 16, 2019.",
"url": "https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html"
},
{
"source_name": "FireEye TRITON 2019",
"description": "Miller, S, et al. (2019, April 10). TRITON Actor TTP Profile, Custom Attack Tools, Detections, and ATT&CK Mapping. Retrieved April 16, 2019.",
"url": "https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html"
},
{
"source_name": "FireEye TEMP.Veles JSON April 2019",
"description": "Miller, S., et al. (2019, April 10). TRITON Appendix C. Retrieved April 29, 2019.",
"url": "https://www.fireeye.com/content/dam/fireeye-www/blog/files/TRITON_Appendix_C.html"
},
{
"source_name": "Pylos Xenotime 2019",
"description": "Slowik, J.. (2019, April 12). A XENOTIME to Remember: Veles in the Wild. Retrieved April 16, 2019.",
"url": "https://pylos.co/2019/04/12/a-xenotime-to-remember-veles-in-the-wild/"
},
{
"source_name": "XENOTIME",
"description": "The activity group XENOTIME, as defined by Dragos, has overlaps with activity reported upon by FireEye about TEMP.Veles as well as the actors behind [TRITON](https://attack.mitre.org/software/S0609).(Citation: Dragos Xenotime 2018)(Citation: Pylos Xenotime 2019)(Citation: FireEye TRITON 2019)(Citation: FireEye TEMP.Veles 2018)"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Dragos Threat Intelligence"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:41.930000+00:00\", \"old_value\": \"2024-04-17 16:13:43.697000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.4"
},
{
"type": "intrusion-set",
"id": "intrusion-set--dd2d9ca6-505b-4860-a604-233685b802c7",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-05-12 18:15:29.396000+00:00",
"modified": "2026-07-31 20:48:49.730000+00:00",
"name": "Wizard Spider",
"description": "[Wizard Spider](https://attack.mitre.org/groups/G0102) is a Russia-based financially motivated threat group originally known for the creation and deployment of [TrickBot](https://attack.mitre.org/software/S0266) since at least 2016. [Wizard Spider](https://attack.mitre.org/groups/G0102) possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.(Citation: CrowdStrike Ryuk January 2019)(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)(Citation: CrowdStrike Wizard Spider October 2020)",
"aliases": [
"Wizard Spider",
"UNC1878",
"TEMP.MixMaster",
"Grim Spider",
"FIN12",
"GOLD BLACKBURN",
"ITG23",
"Periwinkle Tempest",
"DEV-0193",
"Pistachio Tempest",
"DEV-0237"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0102",
"external_id": "G0102"
},
{
"source_name": "Grim Spider",
"description": "(Citation: CrowdStrike Ryuk January 2019)(Citation: CrowdStrike Grim Spider May 2019)"
},
{
"source_name": "UNC1878",
"description": "(Citation: FireEye KEGTAP SINGLEMALT October 2020)"
},
{
"source_name": "TEMP.MixMaster",
"description": "(Citation: FireEye Ryuk and Trickbot January 2019)"
},
{
"source_name": "ITG23",
"description": "(Citation: IBM X-Force ITG23 Oct 2021)"
},
{
"source_name": "FIN12",
"description": "(Citation: Mandiant FIN12 Oct 2021)"
},
{
"source_name": "Periwinkle Tempest",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "DEV-0193",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "Pistachio Tempest",
"description": "(Citation: Microsoft_PistachioTempest_Jan2024)"
},
{
"source_name": "DEV-0237",
"description": "(Citation: Microsoft_PistachioTempest_Jan2024)"
},
{
"source_name": "GOLD BLACKBURN",
"description": "(Citation: Secureworks Gold Blackburn Mar 2022)"
},
{
"source_name": "DHS/CISA Ransomware Targeting Healthcare October 2020",
"description": "DHS/CISA. (2020, October 28). Ransomware Activity Targeting the Healthcare and Public Health Sector. Retrieved October 28, 2020.",
"url": "https://us-cert.cisa.gov/ncas/alerts/aa20-302a"
},
{
"source_name": "FireEye Ryuk and Trickbot January 2019",
"description": "Goody, K., et al (2019, January 11). A Nasty Trick: From Credential Theft Malware to Business Disruption. Retrieved May 12, 2020.",
"url": "https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html"
},
{
"source_name": "CrowdStrike Ryuk January 2019",
"description": "Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.",
"url": "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/"
},
{
"source_name": "CrowdStrike Grim Spider May 2019",
"description": "John, E. and Carvey, H. (2019, May 30). Unraveling the Spiderweb: Timelining ATT&CK Artifacts Used by GRIM SPIDER. Retrieved May 12, 2020.",
"url": "https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"
},
{
"source_name": "FireEye KEGTAP SINGLEMALT October 2020",
"description": "Kimberly Goody, Jeremy Kennelly, Joshua Shilko, Steve Elovitz, Douglas Bienstock. (2020, October 28). Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser. Retrieved October 28, 2020.",
"url": "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft_PistachioTempest_Jan2024",
"description": "Microsoft. (2024, January 25). Financially Motivated Threat Actor Pistachio Tempest. Retrieved December 15, 2025.",
"url": "https://www.microsoft.com/en-us/security/security-insider/threat-landscape/pistachio-tempest"
},
{
"source_name": "CrowdStrike Wizard Spider October 2020",
"description": "Podlosky, A., Hanel, A. et al. (2020, October 16). WIZARD SPIDER Update: Resilient, Reactive and Resolute. Retrieved June 15, 2021.",
"url": "https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"
},
{
"source_name": "Secureworks Gold Blackburn Mar 2022",
"description": "Secureworks Counter Threat Unit. (2022, March 1). Gold Blackburn Threat Profile. Retrieved June 15, 2023.",
"url": "https://www.secureworks.com/research/threat-profiles/gold-blackburn"
},
{
"source_name": "Mandiant FIN12 Oct 2021",
"description": "Shilko, J., et al. (2021, October 7). FIN12: The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets. Retrieved June 15, 2023.",
"url": "https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"
},
{
"source_name": "IBM X-Force ITG23 Oct 2021",
"description": "Villadsen, O., et al. (2021, October 13). Trickbot Rising - Gang Doubles Down on Infection Efforts to Amass Network Footholds. Retrieved June 15, 2023.",
"url": "https://securityintelligence.com/posts/trickbot-gang-doubles-down-enterprise-infection/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Edward Millington",
"Oleksiy Gayda"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "4.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:49.730000+00:00\", \"old_value\": \"2026-05-12 15:12:00.732000+00:00\"}}}",
"previous_version": "4.1"
}
],
"revocations": [],
"deprecations": [],
"deletions": []
},
"campaigns": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [
{
"type": "campaign",
"id": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-09-27 13:11:52.340000+00:00",
"modified": "2026-08-04 20:48:44.047000+00:00",
"name": "2015 Ukraine Electric Power Attack",
"description": "[2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028) was a [Sandworm Team](https://attack.mitre.org/groups/G0034) campaign during which they used [BlackEnergy](https://attack.mitre.org/software/S0089) (specifically BlackEnergy3) and [KillDisk](https://attack.mitre.org/software/S0607) to target and disrupt transmission and distribution substations within the Ukrainian power grid. This campaign was the first major public attack conducted against the Ukrainian power grid by Sandworm Team.",
"aliases": [
"2015 Ukraine Electric Power Attack"
],
"first_seen": "2015-12-01 05:00:00+00:00",
"last_seen": "2016-01-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0028",
"external_id": "C0028"
},
{
"source_name": "Booz Allen Hamilton",
"description": "Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.",
"url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_first_seen_citation": "(Citation: Booz Allen Hamilton)",
"x_mitre_last_seen_citation": "(Citation: Booz Allen Hamilton)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-08-04 20:48:44.047000+00:00\", \"old_value\": \"2024-12-18 18:59:44.199000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--aa73efef-1418-4dbe-b43c-87a498e97234",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-03-31 17:22:23.567000+00:00",
"modified": "2026-07-31 21:05:24.494000+00:00",
"name": "2016 Ukraine Electric Power Attack",
"description": "[2016 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0025) was a [Sandworm Team](https://attack.mitre.org/groups/G0034) campaign during which they used [Industroyer](https://attack.mitre.org/software/S0604) malware to target and disrupt distribution substations within the Ukrainian power grid. This campaign was the second major public attack conducted against Ukraine by [Sandworm Team](https://attack.mitre.org/groups/G0034).(Citation: ESET Industroyer)(Citation: Dragos Crashoverride 2018)",
"aliases": [
"2016 Ukraine Electric Power Attack"
],
"first_seen": "2016-12-01 05:00:00+00:00",
"last_seen": "2016-12-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0025",
"external_id": "C0025"
},
{
"source_name": "ESET Industroyer",
"description": "Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.",
"url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
},
{
"source_name": "Dragos Crashoverride 2018",
"description": "Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.",
"url": "https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_first_seen_citation": "(Citation: ESET Industroyer)(Citation: Dragos Crashoverride 2018)",
"x_mitre_last_seen_citation": "(Citation: ESET Industroyer)(Citation: Dragos Crashoverride 2018)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 21:05:24.494000+00:00\", \"old_value\": \"2025-04-16 20:37:46.567000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}, \"iterable_item_removed\": {\"root['x_mitre_domains'][2]\": \"mobile-attack\"}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--df8eb785-70f8-4300-b444-277ba849083d",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-27 19:43:25.703000+00:00",
"modified": "2026-07-31 21:11:04.731000+00:00",
"name": "2022 Ukraine Electric Power Attack",
"description": "The [2022 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0034) was a [Sandworm Team](https://attack.mitre.org/groups/G0034) campaign that used a combination of GOGETTER, Neo-REGEORG, [CaddyWiper](https://attack.mitre.org/software/S0693), and living of the land (LotL) techniques to gain access to a Ukrainian electric utility to send unauthorized commands from their SCADA system.(Citation: Mandiant-Sandworm-Ukraine-2022)(Citation: Dragos-Sandworm-Ukraine-2022) ",
"aliases": [
"2022 Ukraine Electric Power Attack"
],
"first_seen": "2022-06-01 04:00:00+00:00",
"last_seen": "2022-10-01 04:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0034",
"external_id": "C0034"
},
{
"source_name": "Dragos-Sandworm-Ukraine-2022",
"description": "Dragos, Inc.. (2023, December 11). ELECTRUM Targeted Ukrainian Electric Entity Using Custom Tools and CaddyWiper Malware, October 2022. Retrieved March 28, 2024.",
"url": "https://www.dragos.com/blog/new-details-electrum-ukraine-electric-sector-compromise-2022/"
},
{
"source_name": "Mandiant-Sandworm-Ukraine-2022",
"description": "Ken Proska, John Wolfram, Jared Wilson, Dan Black, Keith Lunden, Daniel Kapellmann Zafra, Nathan Brubaker, Tyler Mclellan, Chris Sistrunk. (2023, November 9). Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology. Retrieved March 28, 2024.",
"url": "https://www.mandiant.com/resources/blog/sandworm-disrupts-power-ukraine-operational-technology"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_first_seen_citation": "(Citation: Mandiant-Sandworm-Ukraine-2022)",
"x_mitre_last_seen_citation": "(Citation: Mandiant-Sandworm-Ukraine-2022)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 21:11:04.731000+00:00\", \"old_value\": \"2024-04-10 16:02:48.078000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}, \"iterable_item_removed\": {\"root['x_mitre_domains'][2]\": \"mobile-attack\"}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-22 19:33:22.532000+00:00",
"modified": "2026-07-31 20:48:19.151000+00:00",
"name": "2025 Poland Wiper Attacks",
"description": "[2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063) is a Russian state-sponsored campaign that conducted destructive cyberattacks against Polish energy infrastructure in December 2025. Targets included more than 30 wind and photovoltaic farms, a combined heat and power (CHP) plant, and a manufacturing sector company. The attacks on the distributed energy resources (DER) disrupted communications between affected facilities and the distribution system operator, but did not impact electricity generation or heat supply. Across the campaign, threat actors deployed two previously undocumented wiper tools, [DynoWiper](https://attack.mitre.org/software/S9038), a Windows-based wiper and [LazyWiper](https://attack.mitre.org/software/S9039), a PowerShell wiper, distributed via malicious Group Policy Objects. At the CHP plant, threat actors had maintained access since at least March 2025, using that foothold to obtain credentials and move laterally before attempting wiper deployment. Some reporting has assessed the activity to be consistent with Russian Federal Security Service (FSB) threat activity group [Dragonfly](https://attack.mitre.org/groups/G0035), also tracked as STATIC TUNDRA, while other reporting attributes the destructive wiper activities to the Russian General Staff Main Intelligence Directorate (GRU) threat activity group ELECTRUM, also tracked as [Sandworm Team](https://attack.mitre.org/groups/G0034).(Citation: CERT Polska)(Citation: Dragos ELECTRUM JAN 2026)(Citation: ESET DynoWiper JAN 2026)(Citation: ESET DynoWiper Update JAN 2026)",
"aliases": [
"2025 Poland Wiper Attacks",
"2025 Poland Wiper Campaign"
],
"first_seen": "2025-03-01 05:00:00+00:00",
"last_seen": "2025-12-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0063",
"external_id": "C0063"
},
{
"source_name": "CERT Polska",
"description": "CERT Polska. (2026, January 30). Energy Sector Incident Report \u2013 29 December. Retrieved April 22, 2026.",
"url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
},
{
"source_name": "ESET DynoWiper Update JAN 2026",
"description": "ESET. (2026, January 30). DynoWiper update: Technical analysis and attribution. Retrieved April 22, 2026.",
"url": "https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/"
},
{
"source_name": "ESET DynoWiper JAN 2026",
"description": "ESET. (2026, January 30). Russian Sandworm group attacks energy company in Poland with DynoWiper, ESET Research discovers. Retrieved April 22, 2026.",
"url": "https://www.eset.com/us/about/newsroom/research/eset-research-russian-sandwormapt-attacks-energy-company-poland-with-dynowiper/"
},
{
"source_name": "Dragos ELECTRUM JAN 2026",
"description": "https://5943619.hs-sites.com/hubfs/Reports/dragos-2025-poland-attack-report.pdf. (2026, January). ELECTRUM: CYBER ATTACK ON POLAND\u2019S ELECTRIC SYSTEM 2025. Retrieved April 22, 2026.",
"url": "https://5943619.hs-sites.com/hubfs/Reports/dragos-2025-poland-attack-report.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Dragos Threat Intelligence"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_first_seen_citation": "(Citation: CERT Polska)(Citation: Dragos ELECTRUM JAN 2026)",
"x_mitre_last_seen_citation": "(Citation: CERT Polska)(Citation: Dragos ELECTRUM JAN 2026)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:19.151000+00:00\", \"old_value\": \"2026-05-12 15:12:00.730000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--1169ff24-b35f-4d8d-8cf3-643a2834227f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-11-20 23:15:36.728000+00:00",
"modified": "2026-07-31 20:48:13.258000+00:00",
"name": "FrostyGoop Incident",
"description": "[FrostyGoop Incident](https://attack.mitre.org/campaigns/C0041) took place in January 2024 against a municipal district heating company in Ukraine. Following initial access via likely exploitation of external facing services, [FrostyGoop](https://attack.mitre.org/software/S1165) was used to manipulate ENCO control systems via legitimate Modbus commands to impact the delivery of heating services to Ukrainian civilians.(Citation: Dragos FROSTYGOOP 2024)(Citation: Nozomi BUSTLEBERM 2024)",
"aliases": [
"FrostyGoop Incident"
],
"first_seen": "2024-01-01 07:00:00+00:00",
"last_seen": "2024-01-01 07:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0041",
"external_id": "C0041"
},
{
"source_name": "Dragos FROSTYGOOP 2024",
"description": "Mark Graham, Carolyn Ahlers, Kyle O'Meara; Dragos. (2024, July). Impact of FrostyGoop ICS Malware on Connected OT Systems. Retrieved November 20, 2024.",
"url": "https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf"
},
{
"source_name": "Nozomi BUSTLEBERM 2024",
"description": "Nozomi Networks Labs. (2024, July 24). Cyberwarfare Targeting OT: Protecting Against FrostyGoop/BUSTLEBERM Malware. Retrieved November 20, 2024.",
"url": "https://www.nozominetworks.com/blog/protecting-against-frostygoop-bustleberm-malware"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_first_seen_citation": "(Citation: Dragos FROSTYGOOP 2024)",
"x_mitre_last_seen_citation": "(Citation: Dragos FROSTYGOOP 2024)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:13.258000+00:00\", \"old_value\": \"2025-03-05 22:12:26.131000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--70cab19e-1745-425e-b3db-c02cd5ff157a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-03-10 20:01:08.133000+00:00",
"modified": "2026-07-31 20:48:15.915000+00:00",
"name": "Maroochy Water Breach",
"description": "[Maroochy Water Breach](https://attack.mitre.org/campaigns/C0020) was an incident in 2000 where an adversary leveraged the local government\u2019s wastewater control system and stolen engineering equipment to disrupt and eventually release 800,000 liters of raw sewage into the local community.(Citation: Marshall Abrams July 2008)",
"aliases": [
"Maroochy Water Breach"
],
"first_seen": "2000-02-01 05:00:00+00:00",
"last_seen": "2000-04-01 05:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0020",
"external_id": "C0020"
},
{
"source_name": "Marshall Abrams July 2008",
"description": "Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 ",
"url": "https://www.mitre.org/sites/default/files/pdf/08_1145.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_first_seen_citation": "(Citation: Marshall Abrams July 2008)",
"x_mitre_last_seen_citation": "(Citation: Marshall Abrams July 2008)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:15.915000+00:00\", \"old_value\": \"2025-04-16 21:26:23.900000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
},
{
"type": "campaign",
"id": "campaign--45a98f02-852f-49b2-94c0-c63207bebbbf",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-25 17:47:37.619000+00:00",
"modified": "2026-07-31 20:48:13.868000+00:00",
"name": "Triton Safety Instrumented System Attack",
"description": "[Triton Safety Instrumented System Attack](https://attack.mitre.org/campaigns/C0030) was a campaign employed by [TEMP.Veles](https://attack.mitre.org/groups/G0088) which leveraged the [Triton](https://attack.mitre.org/software/S1009) malware framework against a petrochemical organization.(Citation: Triton-EENews-2017) The malware and techniques used within this campaign targeted specific Triconex [Safety Controller](https://attack.mitre.org/assets/A0010)s within the environment.(Citation: FireEye TRITON 2018) The incident was eventually discovered due to a safety trip that occurred as a result of an issue in the malware.(Citation: FireEye TRITON 2017)\n",
"aliases": [
"Triton Safety Instrumented System Attack"
],
"first_seen": "2017-06-01 04:00:00+00:00",
"last_seen": "2017-08-01 04:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0030",
"external_id": "C0030"
},
{
"source_name": "Triton-EENews-2017",
"description": "Blake Sobczak. (2019, March 7). The inside story of the world\u2019s most dangerous malware. Retrieved March 25, 2024.",
"url": "https://www.eenews.net/articles/the-inside-story-of-the-worlds-most-dangerous-malware/"
},
{
"source_name": "FireEye TRITON 2017",
"description": "Johnson, B, et. al. (2017, December 14). Attackers Deploy New ICS Attack Framework \"TRITON\" and Cause Operational Disruption to Critical Infrastructure. Retrieved January 6, 2021.",
"url": "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html"
},
{
"source_name": "FireEye TRITON 2018",
"description": "Miller, S. Reese, E. (2018, June 7). A Totally Tubular Treatise on TRITON and TriStation. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20200618231942/https://www.fireeye.com/blog/threat-research/2018/06/totally-tubular-treatise-on-triton-and-tristation.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_first_seen_citation": "(Citation: Triton-EENews-2017)",
"x_mitre_last_seen_citation": "(Citation: Triton-EENews-2017)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:13.868000+00:00\", \"old_value\": \"2026-05-12 15:12:00.729000+00:00\"}}}",
"previous_version": "1.1"
},
{
"type": "campaign",
"id": "campaign--8fda050f-470d-4401-994e-35c1a6c301de",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-25 19:58:53.090000+00:00",
"modified": "2026-07-31 20:48:17.564000+00:00",
"name": "Unitronics Defacement Campaign",
"description": "The [Unitronics Defacement Campaign](https://attack.mitre.org/campaigns/C0031) was a collection of intrusions across multiple sectors by the [CyberAv3ngers](https://attack.mitre.org/groups/G1027), where threat actors engaged in a seemingly opportunistic and global targeting and defacement of Unitronics Vision Series [Programmable Logic Controller (PLC)](https://attack.mitre.org/assets/A0003) with [Human-Machine Interface (HMI)](https://attack.mitre.org/assets/A0002). The sectors that these PLCs can be commonly found in are water and wastewater, energy, food and beverage manufacturing, and healthcare. The most notable feature of this attack was the defacement of the PLCs' HMIs.(Citation: CISA AA23-335A IRGC-Affiliated December 2023)(Citation: Frank Bajak and Marc Levy December 2023)",
"aliases": [
"Unitronics Defacement Campaign"
],
"first_seen": "2023-11-01 04:00:00+00:00",
"last_seen": "2023-11-01 04:00:00+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/campaigns/C0031",
"external_id": "C0031"
},
{
"source_name": "CISA AA23-335A IRGC-Affiliated December 2023",
"description": "DHS/CISA. (2023, December 1). IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities. Retrieved March 25, 2024.",
"url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a"
},
{
"source_name": "Frank Bajak and Marc Levy December 2023",
"description": "Frank Bajak and Marc Levy. (2023, December 2). Breaches by Iran-affiliated hackers spanned multiple U.S. states, federal agencies say. Retrieved March 25, 2024.",
"url": "https://apnews.com/article/hackers-iran-israel-water-utilities-critical-infrastructure-cisa-554b2aa969c8220016ab2ef94bd7635b"
},
{
"source_name": "Lisa Zahner December 2023",
"description": "Lisa Zahner. (2023, December 15). Hackers in Iran attack computer at Vero Utilities. Retrieved March 25, 2024.",
"url": "https://veronews.com/2023/12/15/hackers-in-iran-attack-computer-at-vero-utilities/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_first_seen_citation": "(Citation: CISA AA23-335A IRGC-Affiliated December 2023)",
"x_mitre_last_seen_citation": "(Citation: Lisa Zahner December 2023)",
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:17.564000+00:00\", \"old_value\": \"2024-04-15 19:37:46.084000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.0"
}
],
"revocations": [],
"deprecations": [],
"deletions": []
},
"assets": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [],
"revocations": [],
"deprecations": [],
"deletions": []
},
"mitigations": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [],
"revocations": [],
"deprecations": [],
"deletions": []
},
"datasources": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [],
"revocations": [],
"deprecations": [],
"deletions": []
},
"datacomponents": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [],
"revocations": [],
"deprecations": [],
"deletions": []
},
"detectionstrategies": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--930b268b-abf0-485f-9854-60c1cfdd2d33",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-10-21 15:10:28.402000+00:00",
"modified": "2026-07-31 20:48:56.122000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0748",
"external_id": "DET0748"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Autorun Image",
"x_mitre_analytic_refs": [
"x-mitre-analytic--2b751a3d-c680-46c9-b92b-55a9d24bd4f9"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:56.122000+00:00\", \"old_value\": \"2026-05-12 16:30:18.390000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--c779ee07-ee85-42fe-a2c1-14ce25766cdf",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-22 21:48:05.256000+00:00",
"modified": "2026-07-31 20:48:57.028000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0910",
"external_id": "DET0910"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Block Communications",
"x_mitre_analytic_refs": [
"x-mitre-analytic--3f052beb-d384-4ebe-b942-2c4ddeb95833"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:57.028000+00:00\", \"old_value\": \"2026-05-12 16:30:18.390000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--feb80c7a-96cd-4300-b344-4d75b176c9cb",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-22 22:42:31.791000+00:00",
"modified": "2026-07-31 20:48:57.971000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0911",
"external_id": "DET0911"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Block Ethernet",
"x_mitre_analytic_refs": [
"x-mitre-analytic--df7f8849-56a7-4e83-9fd7-a4f25227d960"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:57.971000+00:00\", \"old_value\": \"2026-05-12 16:30:18.391000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--6f318bab-df4a-4a51-b849-e9c2ab2f9c4c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-22 15:09:30.933000+00:00",
"modified": "2026-07-31 20:48:55.497000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0903",
"external_id": "DET0903"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Block Operational Technology Message",
"x_mitre_analytic_refs": [
"x-mitre-analytic--c556c91d-64a0-401c-9c41-18971eeca0f2"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:55.497000+00:00\", \"old_value\": \"2026-05-12 16:30:18.390000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--527668a3-cc0c-48c2-856a-a45615817366",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-22 22:56:48.997000+00:00",
"modified": "2026-07-31 20:48:54.649000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0912",
"external_id": "DET0912"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Block Wi-Fi",
"x_mitre_analytic_refs": [
"x-mitre-analytic--0b4e7cfa-9f9d-49b0-b5bf-afdf62058c5a"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:54.649000+00:00\", \"old_value\": \"2026-05-12 16:30:18.390000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--c4ddc0d7-0296-4d92-9ae1-1a4b7b5d1640",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-22 20:32:50.322000+00:00",
"modified": "2026-07-31 20:48:56.771000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0908",
"external_id": "DET0908"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Broadcast Discovery",
"x_mitre_analytic_refs": [
"x-mitre-analytic--f6324642-d17d-49d4-90b2-bab9d229d6fa"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:56.771000+00:00\", \"old_value\": \"2026-05-12 16:30:18.390000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--73773bb8-c63b-4d48-9b48-33440f12a514",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-22 15:56:01.514000+00:00",
"modified": "2026-07-31 20:48:55.817000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0904",
"external_id": "DET0904"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Firmware Modification",
"x_mitre_analytic_refs": [
"x-mitre-analytic--fc6641ac-5748-4498-89e9-d4ada2b6f88a"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:55.817000+00:00\", \"old_value\": \"2026-05-12 16:30:18.390000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--ff6456fc-576d-4da5-b561-b58f70961b15",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-22 16:29:50.802000+00:00",
"modified": "2026-07-31 20:48:58.228000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0905",
"external_id": "DET0905"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Insecure Credentials",
"x_mitre_analytic_refs": [
"x-mitre-analytic--1017530e-423d-4857-80b6-99891bf82d28"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:58.228000+00:00\", \"old_value\": \"2026-05-12 16:30:18.391000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--56bf71a3-a28b-4a8f-84ed-3a71449d47c0",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-22 20:46:31.212000+00:00",
"modified": "2026-07-31 20:48:54.962000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0909",
"external_id": "DET0909"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Multicast Discovery",
"x_mitre_analytic_refs": [
"x-mitre-analytic--67861309-0ba7-4713-843e-3def87e396ec"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:54.962000+00:00\", \"old_value\": \"2026-05-12 16:30:18.390000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--c1645705-a26f-45b2-aa68-ff5c93dfc0f4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-23 00:43:15.974000+00:00",
"modified": "2026-07-31 20:48:56.515000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0915",
"external_id": "DET0915"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Online Edit",
"x_mitre_analytic_refs": [
"x-mitre-analytic--22b202f2-d4dd-44dd-b5e1-791ff2aef8ed"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:56.515000+00:00\", \"old_value\": \"2026-05-12 16:30:18.390000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--6bdde391-76eb-4bd7-9e19-e805ab98b7ac",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-22 18:52:19.941000+00:00",
"modified": "2026-07-31 20:48:55.220000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0907",
"external_id": "DET0907"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Port Scan",
"x_mitre_analytic_refs": [
"x-mitre-analytic--51a094bf-b7eb-452a-9b7a-ffac16fce1ac"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:55.220000+00:00\", \"old_value\": \"2026-05-12 16:30:18.390000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--e90f1c0c-f2c5-4fe1-942f-411574df043f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-23 00:32:34.211000+00:00",
"modified": "2026-07-31 20:48:57.455000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0914",
"external_id": "DET0914"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Program Append",
"x_mitre_analytic_refs": [
"x-mitre-analytic--3c6aa6f7-29e9-41d9-8500-30b6d0533d64"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:57.455000+00:00\", \"old_value\": \"2026-05-12 16:30:18.391000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--2e99cd65-aad4-4796-9013-79837d498eb6",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-23 00:09:43.016000+00:00",
"modified": "2026-07-31 20:48:54.007000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0913",
"external_id": "DET0913"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Program Download All",
"x_mitre_analytic_refs": [
"x-mitre-analytic--e379be82-39d7-4ae4-8557-f846ba19cd4b"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:54.007000+00:00\", \"old_value\": \"2026-05-12 16:30:18.390000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--31773402-e407-4ed3-b86c-7a8587dc5ec9",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-22 17:55:10.734000+00:00",
"modified": "2026-07-31 20:48:54.264000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0906",
"external_id": "DET0906"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Siemens Project File Format Infection",
"x_mitre_analytic_refs": [
"x-mitre-analytic--6a510bf0-0289-4eb0-8645-89f0f4d32cf3"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:54.264000+00:00\", \"old_value\": \"2026-05-12 16:30:18.390000+00:00\"}}}",
"previous_version": "1.0"
},
{
"type": "x-mitre-detection-strategy",
"id": "x-mitre-detection-strategy--f487a605-0acb-4b12-b157-33b75ebd9a40",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-22 14:32:49.664000+00:00",
"modified": "2026-07-31 20:48:57.712000+00:00",
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/detectionstrategies/DET0902",
"external_id": "DET0902"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"name": "Detection of Unauthorized Message",
"x_mitre_analytic_refs": [
"x-mitre-analytic--613b28ef-88dd-4008-8d7e-206ce55a7cde"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-07-31 20:48:57.712000+00:00\", \"old_value\": \"2026-05-12 16:30:18.391000+00:00\"}}}",
"previous_version": "1.0"
}
],
"revocations": [],
"deprecations": [],
"deletions": []
},
"analytics": {
"additions": [],
"major_version_changes": [],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [],
"revocations": [],
"deprecations": [],
"deletions": []
}
},
"new-contributors": [
"Dhanvarshini Gopalsamy, NEC Corporation India",
"Jose Moya Villalba",
"Kamei Risa, NEC Corporation",
"Rajkumar Barot",
"Sareena Karapoola, NEC Corporation India"
]
}