aol.pm

CORESHELL

Software · ATTACK:enterprise:S0137

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:S0137",
  "title": "CORESHELL",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0137",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--60c18d06-7b91-4742-bae3-647845cd9d81",
  "external_id": "S0137",
  "domain": "enterprise",
  "created": "2017-05-31T21:33:18.506Z",
  "modified": "2025-10-22T02:47:28.036Z",
  "version": "2.2",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "CORESHELL"
    },
    {
      "source_name": "SOURFACE"
    },
    {
      "source_name": "FireEye APT28 January 2017",
      "url": "https://www.mandiant.com/sites/default/files/2021-09/APT28-Center-of-Storm-2017.pdf"
    },
    {
      "source_name": "FireEye APT28",
      "url": "https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"
    },
    {
      "source_name": "Securelist Sofacy Feb 2018",
      "url": "https://securelist.com/a-slice-of-2017-sofacy-activity/83930/"
    },
    {
      "source_name": "Sofacy"
    }
  ]
}

Explicit source assertions (12)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0137 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--167e1e15-1fe1-4073-aac1-062557fdd79f

Microsoft SIR Vol 19 · FireEye APT28

ATTACK:enterprise:S0137 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17049a4f-810d-4928-a0a0-84d4a732ca08

Microsoft SIR Vol 19 · FireEye APT28

ATTACK:enterprise:S0137 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35d35ecf-1326-4690-b105-23280e29c120

FireEye APT28

ATTACK:enterprise:S0137 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44150544-030d-430c-bec8-6fb4373d484e

FireEye APT28

ATTACK:enterprise:S0137 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5301c007-7c00-4b4d-b355-864db8de052f

FireEye APT28

ATTACK:enterprise:S0137 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b88372d-4f3f-4442-906d-9ab07e22e781

FireEye APT28

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:S0137

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba64e6d1-4deb-440a-a4eb-1c3476b6fb47

FireEye APT28 · Secureworks IRON TWILIGHT Active Measures March 2017

ATTACK:enterprise:S0137 → uses → ATTACK:enterprise:T1218.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ccc38b61-c517-4186-909a-760f12ef65e8

Microsoft SIR Vol 19

ATTACK:enterprise:S0137 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dcc2c503-25dc-47bb-b9cb-35ce27e73cd2

Microsoft SIR Vol 19

ATTACK:enterprise:S0137 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e41ab3e7-2b69-4461-a693-e53a24c9ab59

FireEye APT28

ATTACK:enterprise:S0137 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e6f5bde4-869f-4c9a-9414-11ea48386204

FireEye APT28

ATTACK:enterprise:S0137 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f4e53b40-abcf-4157-9e53-4ab9632619f1

FireEye APT28

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.