aol.pm

Derusbi

Software · ATTACK:enterprise:S0021

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:S0021",
  "title": "Derusbi",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0021",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--94379dec-5c87-49db-b36e-66abc0b81344",
  "external_id": "S0021",
  "domain": "enterprise",
  "created": "2017-05-31T21:32:18.668Z",
  "modified": "2025-04-16T20:38:23.924Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "PHOTO"
    },
    {
      "source_name": "Derusbi"
    },
    {
      "source_name": "Fidelis Turbo",
      "url": "https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2016/2016.02.29.Turbo_Campaign_Derusbi/TA_Fidelis_Turbo_1602_0.pdf"
    },
    {
      "source_name": "FireEye Periscope March 2018",
      "url": "https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"
    },
    {
      "source_name": "Novetta-Axiom",
      "url": "https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"
    },
    {
      "source_name": "ThreatConnect Anthem",
      "url": "https://www.threatconnect.com/the-anthem-hack-all-roads-lead-to-china/"
    }
  ]
}

Explicit source assertions (22)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--062874d1-8ca9-400f-8367-670b9c7c3280

FireEye Periscope March 2018

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3268cdc0-7cee-4fe5-92cc-2c3cdc06712b

Fidelis Turbo · FireEye Periscope March 2018

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1218.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f3473a4-f5f5-43d8-a4ec-589763695942

ThreatGeek Derusbi Converge

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:S0021

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4fe3f0a3-1330-4b51-be17-b38a54b6e605

FireEye Periscope March 2018 · CISA AA21-200A APT40 July 2021

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d2ca571-9e66-4949-b3a1-978c47398b18

Fidelis Turbo

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1070.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60137eb6-ed8c-41ce-bf75-6b45cdafe751

Fidelis Turbo · Novetta-Axiom

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7fd4fe68-0f2a-485c-9b10-6847428ef5da

Airbus Derusbi 2015

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2faf818-d21d-40a5-ad02-a3b1b2ee5d58

Fidelis Turbo · FireEye Periscope March 2018

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5bb3ddf-446a-42c4-b522-112ad643c678

Fidelis Turbo

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7cb0193-e854-4361-b1a1-fc4e68354c59

Fidelis Turbo

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--af66e48f-3232-4f78-ad3e-5a404f7ae3a1

Fidelis Turbo

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b93d69f2-32a2-43a8-9b45-693d82a51c6b

FireEye Periscope March 2018

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b9fe8dd4-a3c9-4e58-9a74-937e4de677a8

Fidelis Turbo · FireEye Periscope March 2018

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:S0021

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba4e03d1-f9b6-442d-974b-2fb7feddb551

ThreatConnect Anthem

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd74b90d-ff9f-4ce3-96af-9b809fffc3da

Fidelis Turbo

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c52eb151-c8c5-45f1-984b-d99a12ca05cf

Fidelis Turbo

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c784f835-5d15-4fc6-a7ad-88d1a9050159

FireEye Periscope March 2018

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d953a664-5a8f-45a9-a3e6-819cb2cef2c7

FireEye Periscope March 2018

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:S0021

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e4c7c4b7-fe19-4433-acd9-ec94f436f381

Cisco Group 72 · Novetta-Axiom

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f017f6c0-96f4-46f1-905f-44e9950effbc

Fidelis Turbo · FireEye Periscope March 2018

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f023577a-e87f-4d0e-beef-575293a86153

FireEye Periscope March 2018

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:S0021

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb1079fa-f399-48b3-aa34-ca096bed13c6

FireEye APT41 Aug 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.