Skip to content

ADVSTORESHELL

Software · ATTACK:enterprise:S0045

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0045",
  "title": "ADVSTORESHELL",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0045",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--fb575479-14ef-41e9-bfab-0b7cf10bec73",
  "external_id": "S0045",
  "domain": "enterprise",
  "created": "2017-05-31T21:32:34.648Z",
  "modified": "2025-04-25T14:45:09.488Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Kaspersky Sofacy",
      "url": "https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/"
    },
    {
      "source_name": "ESET Sednit Part 2",
      "url": "http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"
    }
  ]
}

Explicit source assertions (24)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1546.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--075e7d33-8d5c-4016-9a24-dc6e61f56fcd

ESET Sednit Part 2

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--090a553a-b863-4214-aa3b-cf8ea7ba2d68

ESET Sednit Part 2 · Bitdefender APT28 Dec 2015

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d328be7-85d2-4558-a4e3-cc5ce8bc7e2e

ESET Sednit Part 2 · Bitdefender APT28 Dec 2015

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--103f1ad4-feec-4be3-9da7-ee0b2503c318

Kaspersky Sofacy

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1218.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12904c83-67ad-430f-96ae-20e9081c2b5d

Bitdefender APT28 Dec 2015

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--284ffb1b-ad42-468e-9897-94c25024f0d4

Kaspersky Sofacy · ESET Sednit Part 2 · Bitdefender APT28 Dec 2015

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a8f0313-4059-42b9-b487-6c8f860588c0

ESET Sednit Part 2

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--53cc6b0b-66ec-4f7d-a725-f65b076b5428

ESET Sednit Part 2

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d397a8d-2195-440d-a0f5-bbf6c3e8f6e4

ESET Sednit Part 2

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:S0045

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e9bee3d-ea86-4715-9fdc-199e10ef2161

Kaspersky Sofacy · Securelist Sofacy Feb 2018

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5eb253cb-2e81-4f51-bd0e-d1734283491c

ESET Sednit Part 2

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66819f02-7a22-4f21-8e4f-df24969e5567

ESET Sednit Part 2

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f448f20-0349-4132-80ec-d46e94d52426

ESET Sednit Part 2 · Bitdefender APT28 Dec 2015

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7105ecea-8da8-4723-b717-ae9c3152cfdd

ESET Sednit Part 2 · Bitdefender APT28 Dec 2015

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85a92b0f-f8c3-41a9-a1b3-cfbf8b442b39

Bitdefender APT28 Dec 2015

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9a05a8cc-8d3c-46a5-947e-bebed2ab1c5a

Kaspersky Sofacy

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9f496c45-eac5-464f-858b-ef481f2f37ff

ESET Sednit Part 2 · Bitdefender APT28 Dec 2015

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a0f1273a-e422-4801-a911-e7cb223ebea2

ESET Sednit Part 2

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a71256aa-a2e3-447c-ba4e-004ba4f062b2

Bitdefender APT28 Dec 2015

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b6fc7740-4e5f-4f4c-8b1e-d0e3368eee03

Kaspersky Sofacy · Bitdefender APT28 Dec 2015

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c0e78590-0266-43e0-8fb5-efd95556c20c

ESET Sednit Part 2

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc2099fb-4785-4884-b274-4f3e8a3b8d99

Bitdefender APT28 Dec 2015

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d5bc22fc-16dd-4ab6-9599-828f4b33ec2b

Bitdefender APT28 Dec 2015

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8abe157-f6cd-4959-b9d5-e0c87d16bcfe

ESET Sednit Part 2

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.