Operation Dust Storm
Campaign · ATTACK:enterprise:C0016
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:C0016",
"title": "Operation Dust Storm",
"type": "Campaign",
"source_url": "https://attack.mitre.org/campaigns/C0016",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "campaign--4603cf2f-06d0-4970-9c5d-5071b08c817f",
"external_id": "C0016",
"domain": "enterprise",
"created": "2022-09-29T20:00:38.136Z",
"modified": "2026-07-31T20:48:14.337Z",
"version": "1.1",
"aliases": [
"Operation Dust Storm"
],
"tactics": [
],
"source_references": [
{
"source_name": "Cylance Dust Storm",
"url": "https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"
}
]
}Explicit source assertions (23)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0016 → uses → ATTACK:enterprise:S0083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0465632c-6db3-41ed-acc8-b0f60cc99330
Cylance Dust StormATTACK:enterprise:C0016 → uses → ATTACK:enterprise:S0032
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c9d5795-fa0d-4d01-815f-eef0e4d8b2b7
Cylance Dust StormATTACK:enterprise:C0016 → uses → ATTACK:enterprise:S0012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1f07783f-cc60-4464-a0b2-154308d799c2
Cylance Dust StormATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--33666771-34e3-41a9-8e98-57a99e92c40a
Cylance Dust StormATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--387640be-2b25-40c3-9048-f6cb86beab78
Cylance Dust StormATTACK:enterprise:C0016 → uses → ATTACK:enterprise:S0084
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--40ed9be1-9c97-46fc-a967-9468888576a8
Cylance Dust StormATTACK:enterprise:C0016 → uses → ATTACK:enterprise:S0086
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4cc0ca4c-3d7b-4fd8-b8ad-0a987da94d33
Cylance Dust StormATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1583.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f1793cb-51f9-47d0-a2a7-374a57f56b82
Cylance Dust StormATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--583335b0-7d65-4fbb-aa41-3bbbd08598cd
Cylance Dust StormATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--713c3a5e-931b-4c43-a945-c26f031b0183
Cylance Dust StormATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1189
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--820a35e0-11fe-42c4-84d2-a29cc5026426
Cylance Dust StormATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a3b40306-fafa-47e6-9164-fbd75e04b645
Cylance Dust StormATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aba65eb4-6bd9-40bc-9b06-48b86e9a85e2
Cylance Dust StormATTACK:enterprise:C0016 → uses → ATTACK:enterprise:S0085
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--af60497d-7356-444c-b842-6ad9fb0d7dea
Cylance Dust StormATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b00d5e69-736f-47b9-befd-f5593550ad11
Cylance Dust StormATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b965ddc5-3017-4857-9a3d-44aaf24b6bfd
Cylance Dust StormATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc0704ff-406d-4be2-90ef-6a667041365f
Cylance Dust StormATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c1214ef3-9bff-4702-8f54-4e6ddf955d93
Cylance Dust StormATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c837d369-bb16-464b-9cae-8eca38124c4e
Cylance Dust StormATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cea08e8e-2209-4d29-bc76-722091344259
Cylance Dust StormATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc64a0c1-9302-4816-8b1d-b6b348f12efb
Cylance Dust StormATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e359da34-bc39-4e72-9db1-49aa5da6c8b4
Cylance Dust StormATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e8009877-1d59-4742-8d9a-61e0cda1f0b1
Cylance Dust Storm