Uroburos
Software · ATTACK:enterprise:S0022
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0022",
"title": "Uroburos",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0022",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--80a014ba-3fef-4768-990b-37d8bd10d7f4",
"external_id": "S0022",
"domain": "enterprise",
"created": "2017-05-31T21:32:19.029Z",
"modified": "2024-04-10T22:18:48.304Z",
"version": "2.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Snake"
},
{
"source_name": "Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023",
"url": "https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"
},
{
"source_name": "Kaspersky Turla",
"url": "https://securelist.com/the-epic-turla-operation/65545/"
}
]
}Explicit source assertions (37)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1573.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--049eebb5-0686-4891-9cf7-cbf906cacdd8
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1620
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1040d9b9-96a4-4bea-9e8a-543befd50ebd
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--141a93b8-bfb7-4881-918c-7c91b7e41b25
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17c3e2e7-f208-408c-b767-6c5be92646c4
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--229e8b6e-6c16-406a-8def-7588aaae4fcb
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023 · Symantec WaterbugATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3717f0c2-0963-4b6c-9603-bb01c06b9fe6
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1071.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3ce884c7-71c5-4f46-b09c-1abb45d8341b
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1001.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--40050718-2e2c-4711-91ed-1c2fb59cd9f3
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4153632f-9ac5-4f8b-af83-b4b089ce5429
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47552c49-4027-41f1-ad5f-44e4533dbf19
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1090.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--48aaad9e-bd08-4730-bf58-2c760a113ed4
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--53e9613e-a929-492a-885e-495ec3f4df9a
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1564.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--561afb90-e94a-410f-9e6f-6880d996799f
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--59336377-92b2-4a82-97a1-414710a0a3dc
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61360c2f-0a26-49ca-ac7c-2758fcd26ea2
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66db460f-5e90-4a79-a34c-f757f6c0b3ee
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1132.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66e16e88-626f-49c6-90f1-8c97286ef5dc
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0022
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a87ff58-10b1-4fbc-a633-d7d8a34d1b29
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023 · Kaspersky TurlaATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ae983c6-b332-42d9-b489-87f475b6b9d6
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1559
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--70efcdd6-80c3-4f95-981b-4da24639f32b
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a0e4dc2c-1977-4c4c-a5ee-4710fb3ef1a5
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2006705-7f1b-4081-a074-5313f1d8c7af
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1001.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4ceb321-f21d-4c62-9b49-cb0c64f0008e
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a7005b59-48e5-4852-90f7-ed8d2c3698fa
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab554dba-2116-4dae-bc4c-47f76be72254
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b107d35b-fa2b-4dcb-844e-cacaf15f9982
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b4645fc7-ed61-46d8-a793-ce0e8e43b64a
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d1b6a397-4f29-4274-8394-1d5ca4fe9fc7
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1055.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d5ede6b1-984f-4e43-8d55-92d1efc5e8b6
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d71ad22f-7e01-4140-9080-bce4ae880880
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db75183b-9ad3-41e4-9730-f0bba5ef55c1
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb74fa31-121d-4e43-9794-048a901f509a
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023 · Kaspersky TurlaATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ee7a5648-6263-4f1c-a975-e0d36740944a
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f02f49f5-35d9-4c9c-8943-9fdf34f02a38
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f2ae5e48-aded-40ba-8991-68b79638d6b0
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fc825f8c-ee7a-4b03-9d67-cd736d61b893
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1027.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fd0c41df-35a7-4593-996c-0f9bdd6f4749
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023