Skip to content

Cobalt Strike

Software · ATTACK:enterprise:S0154

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0154",
  "title": "Cobalt Strike",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0154",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--a7881f21-e978-4fe4-af56-92c9416a2616",
  "external_id": "S0154",
  "domain": "enterprise",
  "created": "2017-12-14T16:46:06.044Z",
  "modified": "2026-04-23T21:14:18.712Z",
  "version": "1.14",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "cobaltstrike manual",
      "url": "https://web.archive.org/web/20210825130434/https://cobaltstrike.com/downloads/csmanual38.pdf"
    }
  ]
}

Explicit source assertions (109)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1090.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0023f0a7-26ae-40ec-ac6e-9dacf5217fb9

Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1548.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00991be5-e2c2-4645-b743-e9e4af3d38b9

Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00e99176-c74e-4f49-a498-c66a71612a5b

Talos Cobalt Strike September 2020 · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1059.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--072552be-9c74-4ee8-972c-46454a2c78c0

Talos Cobalt Strike September 2020

ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08fa7188-a43c-4b13-bbe7-af8f04f5b6e9

Trend Micro Earth Kasha NOV 2024

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--094a2284-eeab-47fd-b6fb-6351d98330aa

Cybereason Bumblebee August 2022 · cobaltstrike manual

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--095bfdd3-2379-4cad-bef4-53e8bdd08a75

Talos Cobalt Strike September 2020 · cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020 · Cisco Talos Qilin Ransomware OCT 2025

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f5b5d67-44f6-4725-951e-ce614385c361

Cobalt Strike TTPs Dec 2017

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1078.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0fee0f43-7352-4503-867b-ae17eb7c278b

CobaltStrike Daddy May 2017 · cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10b3228c-b96b-4a34-8da8-4d1fd3fa37d0

cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--126ecc74-4376-4909-9f75-a0630e47cb68

cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12798001-5af6-4b47-b17e-e98888c1482c

Cyberreason Anchor December 2019 · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--155a8883-7b22-4fa8-8d2f-bd76c8efd5b3

Cobalt Strike TTPs Dec 2017 · cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2077bc66-a671-4cc3-87cf-9efff8e969dc

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22e84b06-fbac-4811-b9b7-3c6587aab7d7

Cobalt Strike TTPs Dec 2017 · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--249897d9-131f-4cf8-93d7-cb20006a511d

Talos Cobalt Strike September 2020 · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2aa0dea4-ca6d-4095-8c20-9250308c3315

cobaltstrike manual · Amnesty Intl. Ocean Lotus February 2021 · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b25526e-abb9-4c6b-aa68-cc645734cdfb

Microsoft Storm-501 Sabbath Ransomware Embargo September 2024

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b5ece1f-a678-40af-b4e3-1787ae3de343

Microsoft Storm-1811 2024 · rapid7-email-bombing

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1197

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d0748e3-7427-4847-9861-75680f6aacb3

Talos Cobalt Strike September 2020 · Cobalt Strike Manual 4.3 November 2020 · CobaltStrike Scripted Web Delivery

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--315cd644-875d-4761-b440-f2cf48badbe0

Cobalt Strike TTPs Dec 2017 · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3407bbe8-bceb-42f1-824b-d92d9972d917

Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a2883ee-60fb-4123-9d82-9ade53f4b43b

CobaltStrike Daddy May 2017 · cobaltstrike manual

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--406ca789-682f-4e08-bb7e-60421923ee09

cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--412a57f3-ce06-4790-8e3a-cb8c34b9e0f1

Cobalt Strike TTPs Dec 2017 · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4183341a-f5ed-4914-9dc5-0eb7c1d6c4e6

cobaltstrike manual · Amnesty Intl. Ocean Lotus February 2021 · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1564.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41b8a7b7-0134-412d-85d7-3a0141beb8e2

Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43924791-6149-4869-a30c-0cad37d1e6f6

Eset PlugX Korplug Mustang Panda March 2022 · Anomali MUSTANG PANDA October 2019 · Secureworks BRONZE PRESIDENT December 2019 · Recorded Future REDDELTA July 2020 · Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023 · Crowdstrike MUSTANG PANDA June 2018 · McAfee Dianxun March 2021

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45376fe9-2a43-4e09-942e-82be661ed572

Talos Cobalt Strike September 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1069.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4af77ee9-ee38-4594-81e3-177a2f2d4bfb

Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b32f8e0-ba08-45b5-bc9a-b394d99a5aba

Trend Micro DRBControl February 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4bf260f4-0a10-49d9-b930-e1293f40e693

Talos Cobalt Strike September 2020

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ef9490e-e347-4f4e-aa6f-c082e02349fc

FireEye APT32 May 2017 · Volexity OceanLotus Nov 2017 · Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017 · Volexity Ocean Lotus November 2020 · Amnesty Intl. Ocean Lotus February 2021 · Unit 42 KerrDown February 2019

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5179f874-72fb-4743-bd51-3f3fdb660038

Cobalt Strike Manual 4.3 November 2020 · Cisco Talos Qilin Ransomware OCT 2025

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1134.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--538e4202-41cf-4d4e-9c1c-30df5bc30a22

CobaltStrike Daddy May 2017 · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:C0040 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55617b29-c1da-4519-87ea-97902bf30c02

Google Cloud APT41 2024

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56f08580-ffab-4c02-8702-adbe4de12a6a

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56ff911a-d7bb-4176-8e1f-bf0f46cc7f89

cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59cb4ff6-e1fd-4088-905f-2ade864dabb0

Cobalt Strike TTPs Dec 2017

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a166a20-4191-429c-9fd0-f566a86f0753

Cobalt Strike TTPs Dec 2017 · Talos Cobalt Strike September 2020 · CobaltStrike Daddy May 2017

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a7e12f1-a5e2-44bc-a244-c49688a816e7

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ebc97a3-54ee-4582-92ce-981f67c26f45

DFIR Conti Bazar Nov 2021 · cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5f830006-234e-44d1-9441-1aca7990006c

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6017ff5f-e522-45fe-857a-e4fef38a6349

Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1070.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61e9d783-571b-49d4-a30b-8fde8a13d4c0

cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6747d237-8156-453c-9751-3afd1b36bdca

Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1071.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a4ee5a3-9bc2-4352-856a-ae078ddc6cf2

Talos Cobalt Strike September 2020 · cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d520715-126a-4678-ba03-cbdd70fae8d0

FireEye FIN6 Apr 2019

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d5dfa51-1e2b-4da5-9db8-ae8e8f00ea9d

cobaltstrike manual

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72e0dd03-d994-4a38-97a8-dab5ae456cbc

Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7396dd25-432c-4285-8149-1237b1273a53

Cobalt Strike TTPs Dec 2017 · Cyberreason Anchor December 2019 · Talos Cobalt Strike September 2020 · CobaltStrike Daddy May 2017 · cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74dcdf15-ebdf-4faa-8316-cbf1429a8cea

NCC Group TA505

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1021.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75c238d1-f2dc-413a-89c3-66797a65da90

Cobalt Strike TTPs Dec 2017 · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79c5870a-c93f-47c5-a382-e26a23666209

Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80299c96-9450-48bc-8161-e72a41389f6a

Talos Cobalt Strike September 2020 · cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82a7e330-e4b1-4db8-8c73-03cabd9b8991

Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:G0052 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82c12a79-e80d-4eba-91ab-d14fd98cb539

ClearSky Wilted Tulip July 2017

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c4af801-00dc-4aa2-acd4-6608fb258088

Talos Cobalt Strike September 2020 · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:G0079 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d1da663-a3eb-4464-9be1-b43b8671e599

Unit 42 DarkHydrus July 2018 · Unit 42 Playbook Dec 2017

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e12d3f8-6c2b-4622-889e-63c9abcff04b

Talos Cobalt Strike September 2020 · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--909db543-0968-4f02-b1d9-de64c0730c0a

Cyberreason Anchor December 2019

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--96673f49-a12b-4d0a-954f-17117b02bfa1

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1497.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9889694f-03c8-4e18-9e9b-9c96ced8eb9d

Cisco Talos Qilin Ransomware OCT 2025

ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9889f167-2a60-4e32-8d2a-410f485551b7

TrendMicro EarthLusca 2022

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1030

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98cc96c2-b876-4e1b-bec9-cb7ea8a8e532

cobaltstrike manual

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98e08749-5e7b-40ed-8a66-cd33f9c8c6ba

Talos Cobalt Strike September 2020 · cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c61749d-ad78-476d-8cd6-ba4eafc8f74e

Mandiant FIN7 Apr 2022 · CrowdStrike Carbon Spider August 2021 · FBI Flash FIN7 USB

ATTACK:enterprise:G1020 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d2fbb81-fd66-4d1b-b919-58d251a06dbe

Microsoft Ransomware as a Service

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a106b02a-0a6a-493f-911c-a00576013004

Cobalt Strike TTPs Dec 2017

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3567e77-aa1c-45dd-8217-e24df76e5def

Kaspersky ToddyCat Check Logs October 2023 · Securelist APT10 March 2021 · Talos Cobalt Strike September 2020 · cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3aa78fe-28c9-44e8-a0a3-0f84c087b5e0

Talos Cobalt Strike September 2020

ATTACK:enterprise:C0021 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab563a30-370d-4e84-a9e2-187ba7b886b5

FireEye APT29 Nov 2018 · Microsoft Unidentified Dec 2018

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1185

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad7f635b-7775-4706-8577-eee00612c996

cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aea03b1a-38b1-423c-8dc0-442bb4d6c316

Cisco Talos Avos Jun 2022

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b1065110-5387-4dee-b27e-f671d75f403f

Talos Cobalt Strike September 2020 · Cobalt Strike Manual 4.3 November 2020 · Cisco Talos Qilin Ransomware OCT 2025

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b4fad2c0-1407-4409-af5d-2cd098a1e536

FireEye SUNBURST Backdoor December 2020 · Cybersecurity Advisory SVR TTP May 2021

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b6f1f9f1-05d9-4ac6-b191-404443430b2b

FireEye APT41 March 2020 · Group IB APT 41 June 2021

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1572

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b6f52beb-1be0-4607-86a6-977d34fabe54

cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b8e169f0-2d84-4785-ba46-0cd79082fcf5

Securelist APT10 March 2021

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba215171-4b5b-407f-931e-0d97ddb64909

CrowdStrike AQUATIC PANDA December 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.