Bisonal
Software · ATTACK:enterprise:S0268
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0268",
"title": "Bisonal",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0268",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--65ffc206-d7c1-45b3-b543-f6b726e7840d",
"external_id": "S0268",
"domain": "enterprise",
"created": "2018-10-17T00:14:20.652Z",
"modified": "2024-04-11T02:53:35.918Z",
"version": "2.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Bisonal"
},
{
"source_name": "Unit 42 Bisonal July 2018",
"url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-bisonal-malware-used-attacks-russia-south-korea/"
},
{
"source_name": "Talos Bisonal Mar 2020",
"url": "https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"
}
]
}Explicit source assertions (35)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06808653-60ba-430a-8c37-b3b49d740578
Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--152f2412-dbba-48b7-bbe9-612798f3ac23
Unit 42 Bisonal July 2018 · Kaspersky CactusPete Aug 2020 · Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--180f0c7c-c7bb-4131-b831-f406ee0516e2
Unit 42 Bisonal July 2018 · Talos Bisonal Mar 2020 · Kaspersky CactusPete Aug 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b03ba23-cbf3-4a77-8c8b-233a19e42a0c
Unit 42 Bisonal July 2018 · Kaspersky CactusPete Aug 2020 · Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b95cd32-155b-488d-bbf8-e16f22e2a1d5
Unit 42 Bisonal July 2018 · Kaspersky CactusPete Aug 2020 · Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20dfecf8-b324-4584-9526-9de6a14dfa27
Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--408183ae-ffff-4341-8c90-f007226656aa
Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1137.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--40dc38ff-1daf-4c3b-823d-377ae4d3a505
Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4806e7c3-c8df-477f-ac3b-819248878a79
Unit 42 Bisonal July 2018 · Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49f9b769-57d1-4d73-8194-59b584a72c1b
Unit 42 Bisonal July 2018 · Talos Bisonal Mar 2020ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:S0268
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d2c0b15-fb83-4ec1-9e3c-3b0707519278
Kaspersky CactusPete Aug 2020 · Secureworks BRONZE HUNTLEY · Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--62e35388-0f7d-4434-af87-6f6c09a1a12b
Unit 42 Bisonal July 2018 · Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ec66973-8ba0-4ec4-a4ca-c49a304f56b7
Kaspersky CactusPete Aug 2020 · Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b909310-43e8-4870-ab62-d6078f27a785
Unit 42 Bisonal July 2018 · Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--84ad3033-c9b4-4679-94b2-0c2a2d9d15df
Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--88a798b0-0820-4a6e-a9b2-416c84f3b357
Kaspersky CactusPete Aug 2020 · Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--895fbe96-6990-4ebd-a192-1653eb31a1ba
Unit 42 Bisonal July 2018 · Kaspersky CactusPete Aug 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8edfde6c-1ede-41eb-bc84-0d98fe24bebd
Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9088b52e-8e07-4fd4-ac80-66df7f877adf
Unit 42 Bisonal July 2018ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91bd508e-7f5a-4514-b886-95d97f8eefff
Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1027.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--930e0ad7-c430-41d1-bea2-5d08cd2ffa3d
Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9acd37b4-5729-4c70-b943-d95dc0882cb8
Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e472909-7f89-430f-8782-8bf20ef265d4
Talos Bisonal Mar 2020 · Kaspersky CactusPete Aug 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a455cf4b-2402-4b72-a5e8-e5f5ed6d2bfc
Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--afe14ecc-81be-4724-aea6-cc1266425d1a
Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b16afb1a-b6ee-4cfb-9fb1-966478828480
Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b499e6f7-77bc-422b-b7ef-058d223a69e6
Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1090
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8df91dd-3060-4829-93a2-121b85b6c49b
Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca3f0924-306a-409e-a1b6-135b781f3dbf
Unit 42 Bisonal July 2018 · Kaspersky CactusPete Aug 2020 · Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ced766d2-ca63-43d2-8551-76f37696cc88
Unit 42 Bisonal July 2018 · Talos Bisonal Mar 2020 · Kaspersky CactusPete Aug 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e101388f-ea73-4d02-b07f-c89a17dfa4a5
Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e4e9f93d-ae64-4f75-b12b-acbb45c31c41
Unit 42 Bisonal July 2018 · Kaspersky CactusPete Aug 2020 · Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e7622538-5858-4804-960e-e9ef427a1a43
Kaspersky CactusPete Aug 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9ddb0b6-298e-4061-b194-c9ea5d49c6d0
Talos Bisonal Mar 2020ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ffff35dc-3741-4fba-9680-f0fbe321c0b0
Talos Bisonal Mar 2020