Skip to content

Higaisa

IntrusionSet · ATTACK:enterprise:G0126

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:G0126",
  "title": "Higaisa",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0126",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--54dfec3e-6464-4f74-9d69-b7c817b7e5a3",
  "external_id": "G0126",
  "domain": "enterprise",
  "created": "2021-03-05T18:54:56.267Z",
  "modified": "2026-07-31T18:47:55.735Z",
  "version": "1.2",
  "aliases": [
    "Higaisa"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Malwarebytes Higaisa 2020",
      "url": "https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"
    },
    {
      "source_name": "PTSecurity Higaisa 2020",
      "url": "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-and-new-year-greetings-the-higaisa-group/"
    },
    {
      "source_name": "Zscaler Higaisa 2020",
      "url": "https://www.zscaler.com/blogs/security-research/return-higaisa-apt"
    }
  ]
}

Explicit source assertions (31)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0884b8fd-64b4-4736-b52d-0182d312b9bf

PTSecurity Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1489621a-59eb-42a9-b529-adc37c65520c

Zscaler Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--382ab873-523f-4455-b3c5-74d81b4fc57b

Zscaler Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:S0013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4032bd86-db32-4270-98a4-670be6992802

Malwarebytes Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1574.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40b904c6-d77d-4ba8-98a5-c03d5c2a3186

PTSecurity Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1124

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4113afe0-e84a-44ba-9180-3033de06d72e

Zscaler Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49a11d2f-7945-4603-b409-d66420b94533

Zscaler Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ff8a2ad-2e69-4933-a5f4-201c891eef87

Malwarebytes Higaisa 2020 · Zscaler Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54784a8e-d827-4761-87ce-68ed55cc25f9

Malwarebytes Higaisa 2020 · Zscaler Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5fa551a6-dc9f-4ca5-a5ec-a393515cb618

Malwarebytes Higaisa 2020 · Zscaler Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63dec489-68ad-46c2-9972-55394ad7601a

Malwarebytes Higaisa 2020 · PTSecurity Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--645949a0-21a3-4c31-846d-33c2055d8bfd

Malwarebytes Higaisa 2020 · Zscaler Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:S0160

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6eac5e98-29dd-4dae-8375-b459b87f28c8

Malwarebytes Higaisa 2020 · PTSecurity Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71db51a2-9968-408c-91b3-8f42a61d0b09

Malwarebytes Higaisa 2020 · Zscaler Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74fe4149-c5df-43a3-809a-5ece230b1cd7

Zscaler Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b053a36-de7d-476b-bc06-6d712432d615

PTSecurity Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--853f320a-e611-4a23-9784-e0054f74b9e3

PTSecurity Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1059.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8ef60c8b-f178-4b78-b5c4-76747e075d84

Malwarebytes Higaisa 2020 · Zscaler Higaisa 2020 · PTSecurity Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--971d0828-7244-4278-adc5-dc480d57ba5b

Zscaler Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9881b1e3-93fa-4af0-8848-69f7fe478b2f

Malwarebytes Higaisa 2020 · Zscaler Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1220

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9dc630a6-a6fd-4173-8236-9bbb1041f7ea

PTSecurity Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1564.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a195cd11-43dc-4ad8-a48d-a1c705bb8b90

PTSecurity Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--af052dd3-641e-4954-a08f-74d56ad29b53

Zscaler Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b64b605f-2677-47c3-ae4b-0b3db3573eae

Malwarebytes Higaisa 2020 · PTSecurity Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c0792868-a5da-4486-9b3b-cefbc2667e54

Malwarebytes Higaisa 2020 · Zscaler Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6c5a455-14da-4d6f-8149-c0dc3bbd6f56

Zscaler Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf60408f-5101-4cdf-935f-c5436071d6d0

Malwarebytes Higaisa 2020 · Zscaler Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d374ab1b-4ff8-4ee8-92d2-466581cf58c8

Malwarebytes Higaisa 2020 · Zscaler Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:S0032

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--da2585bf-f31d-42c9-b488-e6cbab7bcd42

Malwarebytes Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db2e5a57-1854-4925-9b78-422c9b79c130

Malwarebytes Higaisa 2020 · Zscaler Higaisa 2020 · PTSecurity Higaisa 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fa22812f-01a4-420a-be11-7cb5822026e5

Malwarebytes Higaisa 2020 · Zscaler Higaisa 2020

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.