aol.pm

RedLeaves

Software · ATTACK:enterprise:S0153

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:S0153",
  "title": "RedLeaves",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0153",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--17b40f60-729f-4fe8-8aea-cc9ee44a95d5",
  "external_id": "S0153",
  "domain": "enterprise",
  "created": "2017-12-14T16:46:06.044Z",
  "modified": "2024-09-12T19:32:28.614Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "RedLeaves"
    },
    {
      "source_name": "BUGJUICE"
    },
    {
      "source_name": "Twitter Nick Carr APT10",
      "url": "https://x.com/ItsReallyNick/status/850105140589633536"
    },
    {
      "source_name": "FireEye APT10 April 2017",
      "url": "https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"
    },
    {
      "source_name": "PWC Cloud Hopper Technical Annex April 2017",
      "url": "https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"
    }
  ]
}

Explicit source assertions (18)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0153 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07921720-429b-432c-8147-187162326ff2

Accenture Hogfish April 2018 · PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:S0153

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3dd745f5-1c0c-4376-8850-89679fcd4e31

PWC Cloud Hopper Technical Annex April 2017 · DOJ APT10 Dec 2018

ATTACK:enterprise:S0153 → uses → ATTACK:enterprise:T1574.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f8a74a9-55fe-4f9c-bddb-00b715ca3668

FireEye APT10 April 2017

ATTACK:enterprise:S0153 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4086a9d6-5574-48fb-be8d-e8406145e740

Accenture Hogfish April 2018

ATTACK:enterprise:S0153 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48fb8267-5d68-467b-a2c0-8302cc15ebed

Accenture Hogfish April 2018 · FireEye APT10 April 2017

ATTACK:enterprise:S0153 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6610332d-86a5-46dc-a0a1-31c2fe31f164

PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:S0153 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d51e34d-d2ee-41aa-9ec7-dc74c84ebe9f

PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:S0153 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9194756f-c455-427b-9fb0-4887c7bf3bf3

FireEye APT10 April 2017 · PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:S0153 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b8ff36d-ff96-460a-b5cf-d369e7f598d9

PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:S0153 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8f11c39-df96-451e-a93a-417512f82819

Accenture Hogfish April 2018 · PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:S0153 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b94e707d-b2f8-4b68-acac-44d3777dd93f

PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:S0153 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd8aaa70-710d-45a7-bb43-6b2e37f7c797

PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:S0153 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c33c2a0f-eb88-43ef-be7b-6311bef2da3d

Accenture Hogfish April 2018 · FireEye APT10 April 2017

ATTACK:enterprise:S0153 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d4ca926c-6976-4ee8-a5b0-89aa11931bea

FireEye APT10 April 2017 · PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:S0153 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ec55cdc1-8ca2-42c9-a1d9-9755d24bc294

PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:S0153 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed2f811d-3258-4489-abe1-57dac4bdbbf8

Accenture Hogfish April 2018 · PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:S0153 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed45fb1c-048a-4378-8c15-6f6ea0c72d7a

PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:S0153 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f4902ad9-b1bb-41ce-a448-55e2d9437503

PWC Cloud Hopper Technical Annex April 2017

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.