NOKKI
Software · ATTACK:enterprise:S0353
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0353",
"title": "NOKKI",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0353",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--071d5d65-83ec-4a55-acfa-be7d5f28ba9a",
"external_id": "S0353",
"domain": "enterprise",
"created": "2019-01-30T19:50:45.307Z",
"modified": "2025-10-22T03:14:37.092Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "NOKKI"
},
{
"source_name": "Unit 42 Nokki Oct 2018",
"url": "https://researchcenter.paloaltonetworks.com/2018/10/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/"
},
{
"source_name": "Unit 42 NOKKI Sept 2018",
"url": "https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/"
}
]
}Explicit source assertions (17)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0353 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d9b9464-1ade-45e9-9d7b-1c4c967abd81
Unit 42 NOKKI Sept 2018ATTACK:enterprise:S0353 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--534cf936-84e8-49ff-a616-90267467decd
Unit 42 NOKKI Sept 2018ATTACK:enterprise:S0353 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65384e27-6d16-4d25-a17b-3d74dde8f224
Unit 42 NOKKI Sept 2018ATTACK:enterprise:S0353 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67f1d68d-fe0f-4e65-8b2a-f614fda68e3c
Unit 42 NOKKI Sept 2018ATTACK:enterprise:S0353 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6f5973be-3c51-4bd1-b652-f12903caa3e2
Unit 42 NOKKI Sept 2018ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:S0353
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--926523b2-beb0-46e0-a610-c2948ea7bc66
Crowdstrike GTR2020 Mar 2020ATTACK:enterprise:S0353 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9669920d-eff9-4436-9357-409eb7db002c
Unit 42 NOKKI Sept 2018ATTACK:enterprise:S0353 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e1daa60-db2d-4671-b96f-3ebebe1977cc
Unit 42 NOKKI Sept 2018ATTACK:enterprise:S0353 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b1d2f617-f0ca-43b8-921c-687fad920f39
Unit 42 NOKKI Sept 2018ATTACK:enterprise:S0353 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be07fb4e-06db-4bb0-a1e0-23f34b24a97f
Unit 42 NOKKI Sept 2018ATTACK:enterprise:S0353 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bea2bee1-a80c-40a0-9552-e9f49d4fe33b
Unit 42 NOKKI Sept 2018ATTACK:enterprise:S0353 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c5658d84-ba44-44ce-8174-49676e1426d1
Unit 42 NOKKI Sept 2018ATTACK:enterprise:S0353 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c7c855ed-9550-4611-84bd-d4d7c86cef3c
Unit 42 NOKKI Sept 2018ATTACK:enterprise:S0353 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3347969-1cfd-43f3-b871-65874c4b2f95
Unit 42 NOKKI Sept 2018ATTACK:enterprise:S0353 → uses → ATTACK:enterprise:T1056.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e712d24e-0fdc-4ce3-96bf-939b7d4a9cd3
Unit 42 NOKKI Sept 2018ATTACK:enterprise:S0353 → uses → ATTACK:enterprise:T1071.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ebd87b4c-eca9-4680-9608-a49ec74b5c4b
Unit 42 NOKKI Sept 2018ATTACK:enterprise:S0353 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ef6d08c0-e9dd-45e1-b5ce-42cd5731f2ab
Unit 42 NOKKI Sept 2018