Stealth Falcon
IntrusionSet · ATTACK:enterprise:G0038
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0038",
"title": "Stealth Falcon",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0038",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--894aab42-3371-47b1-8859-a4a074c804c8",
"external_id": "G0038",
"domain": "enterprise",
"created": "2017-05-31T21:32:06.390Z",
"modified": "2026-07-31T18:48:06.436Z",
"version": "1.2",
"aliases": [
"Stealth Falcon"
],
"tactics": [
],
"source_references": [
{
"source_name": "Stealth Falcon"
},
{
"source_name": "Citizen Lab Stealth Falcon May 2016",
"url": "https://citizenlab.org/2016/05/stealth-falcon/"
}
]
}Explicit source assertions (16)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0038 → uses → ATTACK:enterprise:T1555.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--04a6eba6-71d7-47d1-91f1-c728ada6b7b5
Citizen Lab Stealth Falcon May 2016ATTACK:enterprise:G0038 → uses → ATTACK:enterprise:T1059
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d63f3cf-bace-4210-9b76-199c5cdb8764
Citizen Lab Stealth Falcon May 2016ATTACK:enterprise:G0038 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--410e0c58-d96c-40ae-bf00-2d4b414daf50
Citizen Lab Stealth Falcon May 2016ATTACK:enterprise:G0038 → uses → ATTACK:enterprise:T1555
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d3e4232-1330-45a9-9e90-9914eed276a5
Citizen Lab Stealth Falcon May 2016ATTACK:enterprise:G0038 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4de2ac9b-4e51-4d73-8fe3-d7d1659778b8
Citizen Lab Stealth Falcon May 2016ATTACK:enterprise:G0038 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--510c2f8c-4570-4c19-8c36-7004f8bbf561
Citizen Lab Stealth Falcon May 2016ATTACK:enterprise:G0038 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73da57b5-e64f-44ee-85f7-d294c21fb534
Citizen Lab Stealth Falcon May 2016ATTACK:enterprise:G0038 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--746b0def-62c8-438d-b5ec-aa6b7dbfb860
Citizen Lab Stealth Falcon May 2016ATTACK:enterprise:G0038 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--782da600-bc3b-4dae-89d1-4a79522bed02
Citizen Lab Stealth Falcon May 2016ATTACK:enterprise:G0038 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8ebab956-4440-4fd7-96ff-8da29e0f0b46
Citizen Lab Stealth Falcon May 2016ATTACK:enterprise:G0038 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--94b4648a-4108-468c-be51-cca365fd97ac
Citizen Lab Stealth Falcon May 2016ATTACK:enterprise:G0038 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cdf73653-b2d7-422f-b433-b6a428ff12d4
Citizen Lab Stealth Falcon May 2016ATTACK:enterprise:G0038 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e1592867-e02f-4c1f-a9f2-1c60e25a1301
Citizen Lab Stealth Falcon May 2016ATTACK:enterprise:G0038 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2e33068-b08e-45fd-89e0-0cf79868f902
Citizen Lab Stealth Falcon May 2016ATTACK:enterprise:G0038 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e362d1ad-5d36-4f6d-b2b0-63af2f5f08ff
Citizen Lab Stealth Falcon May 2016ATTACK:enterprise:G0038 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--efbe5efa-6863-4334-90e5-d7caab9806a6
Citizen Lab Stealth Falcon May 2016