aol.pm

C0017

Campaign · ATTACK:enterprise:C0017

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:C0017",
  "title": "C0017",
  "type": "Campaign",
  "source_url": "https://attack.mitre.org/campaigns/C0017",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "campaign--ba6dfa37-f401-4140-88b0-8938f2895e61",
  "external_id": "C0017",
  "domain": "enterprise",
  "created": "2022-12-01T15:40:34.011Z",
  "modified": "2026-07-31T21:12:29.849Z",
  "version": "1.0",
  "aliases": [
    "C0017"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Mandiant APT41",
      "url": "https://www.mandiant.com/resources/apt41-us-state-governments"
    }
  ]
}

Explicit source assertions (36)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--118cdbd1-12e5-4ac2-85a3-c574e7cfad91

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--191364fd-6564-4adc-a717-cfec6b13f438

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--208b9e1d-3de9-4de8-b8d4-e3a7ff3c72ec

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20a9afe3-de36-428e-a054-cce863b2f4e9

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30ea6fe2-2947-4d12-b959-5a59c9e8d812

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c331c9b-bd73-422b-a62a-560d92946d5b

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1190

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f22638d-1003-44d6-a46e-eab83b966834

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a6869c9-4261-44ca-83e0-b87e047af6b9

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a8098a6-da49-4a36-805b-acce98efa827

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4fd8f00b-2524-4c93-b49d-2f43cbe4aa5b

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a7e12f1-a5e2-44bc-a244-c49688a816e7

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:S1051

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6499cbec-f304-4170-9e6d-d6f89f841219

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--662e03e7-a7bb-4c5b-ada4-e00275885fbb

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:S1052

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68da81e3-44b7-4d06-ab56-b0095e02eba0

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--699d04f6-bace-4bf8-af2a-c80c62fcdd23

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c10da0b-4dfd-4389-b3e3-3599a2fab859

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7014e092-7f05-4f0a-9c6d-f264bf76de7b

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:S0105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7230cc17-59e5-4d6a-9ce3-a17b358e2e94

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75565ab8-1381-4ead-999f-e1df54f61d79

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7cea5a77-cfb2-4e14-88da-ca936433ada0

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d76cecb-4eec-46ea-8ca7-9844b1b0b3e6

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1059.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80516f0f-53de-4058-9ae5-d426adb9e99e

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80d4d084-46c0-481f-8827-66bfa2a7bbdd

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--84f6c3c2-8758-4179-98ca-74e9f726fe7d

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8756af3a-a756-4e0d-a537-8cab1e983b9b

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8996ab0b-8bc5-4c17-9bd5-a29b6c771f62

Mandiant APT41

ATTACK:enterprise:C0017 → attributed-to → ATTACK:enterprise:G0096

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--990a03f8-5813-4fa8-b948-976730d4d285

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a686a939-b320-4326-bae1-8df65254ae46

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b315cea7-6ca6-4d59-83e5-c91f635bbeb4

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c372d356-6d5d-4454-b6b4-8297d0da1579

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c73c6a89-90d5-47e0-af58-b5197d4f3594

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1567

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb68b950-31f1-4ed7-b184-b9208588648a

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e9249ab2-eeee-4984-9ee2-78ff52335077

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1588.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eb6f9345-0600-4afb-99db-cdfbc0d6bc18

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc62b2fc-0a10-436e-b50a-49d708ac072f

Mandiant APT41

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff4440ce-f6b6-4e59-9333-4f4a3b96a2e4

Mandiant APT41

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.