Trojan.Karagany
Software · ATTACK:enterprise:S0094
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0094",
"title": "Trojan.Karagany",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0094",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--82cb34ba-02b5-432b-b2d2-07f55cbf674d",
"external_id": "S0094",
"domain": "enterprise",
"created": "2017-05-31T21:33:00.176Z",
"modified": "2025-04-16T20:38:20.519Z",
"version": "3.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "xFrost"
},
{
"source_name": "Karagany"
},
{
"source_name": "Dragos DYMALLOY ",
"url": "https://www.dragos.com/threat/dymalloy/"
},
{
"source_name": "Secureworks Karagany July 2019",
"url": "https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector"
},
{
"source_name": "Symantec Dragonfly",
"url": "https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"
}
]
}Explicit source assertions (23)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00ce5c68-cb85-46d1-a6ba-7b2b767b0f09
Secureworks Karagany July 2019ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0bd9fd2b-e2f7-48f1-8988-31c041691585
Symantec Dragonfly · Secureworks Karagany July 2019ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f6041e9-c2cb-4a22-951d-13587fe4a547
Secureworks Karagany July 2019ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25bfb4d8-c401-4064-9ee4-24091cb86ba6
Secureworks Karagany July 2019ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b00f3f4-ddde-4874-8315-5a5c5d671a33
Secureworks Karagany July 2019ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--40c202ae-fd92-4506-b72a-5fb0e7bcf99a
Symantec Dragonfly · Secureworks Karagany July 2019ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--519b3d7a-2de3-470b-a1cd-f40d0c351ea3
Secureworks Karagany July 2019ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--51a03c8a-1983-4bdd-b326-78ec67f86f06
Symantec Dragonfly · Secureworks Karagany July 2019ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57e1f6b0-7fbd-49b4-8f5d-876b759437ac
Symantec Dragonfly · Secureworks Karagany July 2019ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a415555-1367-47dd-9757-88a86430cf49
Secureworks Karagany July 2019ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6645bf91-574b-46c3-b816-8ed45a465417
Secureworks Karagany July 2019ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7282eabe-73e0-4a10-824b-f18df7f892e2
Symantec Dragonfly · Secureworks Karagany July 2019ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7808fe28-aa6f-4e81-9029-8b95bec15ad3
Secureworks Karagany July 2019ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7adebe2e-97f7-4a1a-8ac7-01b795dadc36
Secureworks Karagany July 2019ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7cf7d162-a34f-4951-a643-5bf959283f6b
Symantec Dragonfly · Secureworks Karagany July 2019ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1055.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8e34d10d-0c24-41c6-8bde-727768256479
Secureworks Karagany July 2019ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1573.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96bf1608-d1fc-477f-be54-0dba2efd0038
Secureworks Karagany July 2019ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9893220d-5db9-4978-a886-ff33cf417584
Secureworks Karagany July 2019ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b149adfe-547f-4cd4-af4a-ea7018a203c1
Symantec DragonflyATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c1ea9582-0477-4226-a0ba-af03255d01dd
Secureworks Karagany July 2019ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--deab6c7f-8d5e-4c77-ab58-3d8cf9c2adf4
Secureworks Karagany July 2019ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e93e4ac1-090d-4081-8cb5-9af71e807fd3
Secureworks Karagany July 2019ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:S0094
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fa9a8640-75e5-458c-99c0-e5e85aa32a77
Symantec Dragonfly · Secureworks Karagany July 2019 · Gigamon Berserk Bear October 2021