Skip to content

admin@338

IntrusionSet · ATTACK:enterprise:G0018

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:G0018",
  "title": "admin@338",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0018",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--16ade1aa-0ea1-4bb7-88cc-9079df2ae756",
  "external_id": "G0018",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:53.579Z",
  "modified": "2026-07-31T18:47:38.827Z",
  "version": "1.2",
  "aliases": [
    "admin@338"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "admin@338"
    },
    {
      "source_name": "FireEye admin@338",
      "url": "https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"
    }
  ]
}

Explicit source assertions (19)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:S0043

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--013ab34f-54bf-4813-bd37-42a4eebb8d52

FireEye admin@338

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:S0042

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a6ec458-f9f7-4e51-b0eb-4fd915a48a6b

FireEye admin@338

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a7f1f1e-511a-44bf-8d9e-fd3260febfc8

FireEye admin@338

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b141c9e-a679-40c7-ad7b-ac40ac586471

FireEye admin@338

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:S0096

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--318afc9f-92f3-4262-af70-b2e045b87737

FireEye admin@338

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4da943df-a7dc-499f-a8b7-ca8d298d8ff6

FireEye admin@338

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c816fc0-c4e3-47ef-8193-ef88eabdfc7e

FireEye admin@338

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:S0012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b355dcf-9a9f-43b3-9989-128f5171b5c3

FireEye admin@338

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d047513-5fbf-4d9e-8a5d-54317123e34c

FireEye admin@338

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9fef204f-163a-4c9d-b9b1-8a168074063a

FireEye admin@338

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:S0039

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a36263d1-d109-4c94-930a-6be1e9615527

FireEye admin@338

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4962ae6-91e2-407d-9f42-aa0381574476

FireEye admin@338

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:S0104

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d75ee2bd-801c-4521-8d70-f5e2d64c87f9

FireEye admin@338

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:S0100

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e38e741c-a7ef-420a-911a-1d2cf6abf49d

FireEye admin@338

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e4b036ec-b7d4-40a7-9a85-25423a1027c9

FireEye admin@338

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e6e324d1-b775-48bb-ac9f-02fcc2428752

FireEye admin@338

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e752cfb4-7865-4590-b355-eb1f1b851c5e

FireEye admin@338

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eb85fa2e-3c50-4130-9717-8688237fecbc

FireEye admin@338

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb6f077c-06a2-46bb-9aef-959ef818d4aa

FireEye admin@338

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.