BabyShark
Software · ATTACK:enterprise:S0414
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0414",
"title": "BabyShark",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0414",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--d1b7830a-fced-4be3-a99c-f495af9d9e1b",
"external_id": "S0414",
"domain": "enterprise",
"created": "2019-10-07T19:05:48.886Z",
"modified": "2026-05-12T15:12:00.739Z",
"version": "2.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "LATEOP"
},
{
"source_name": "BabyShark"
},
{
"source_name": "Unit42 BabyShark Apr 2019",
"url": "https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/"
},
{
"source_name": "Mandiant APT43 March 2024",
"url": "https://services.google.com/fh/files/misc/apt43-report-en.pdf"
},
{
"source_name": "Unit42 BabyShark Feb 2019",
"url": "https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"
}
]
}Explicit source assertions (17)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--053d1126-0d8d-4048-be96-d1a395a1fe8c
Crowdstrike GTR2020 Mar 2020ATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--09fbfb74-459a-441b-9e07-96c146a26be3
Unit42 BabyShark Feb 2019ATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--18d97b33-8ad5-426e-a390-72bea109bee0
Unit42 BabyShark Apr 2019 · CISA AA20-301A KimsukyATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f28f6e0-795f-4e0d-8459-514a42a96ce9
Unit42 BabyShark Feb 2019ATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3759c775-300f-4981-9264-722ecf97aa64
CISA AA20-301A KimsukyATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a0c8e81-6110-4cf3-a965-b700e00fd66c
Unit42 BabyShark Apr 2019ATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54a384e5-17c8-422d-b199-18e7945cb7d6
Unit42 BabyShark Feb 2019ATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--55c1d32b-f6f7-46ee-9749-f9a91033b267
Mandiant APT43 March 2024ATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c738353-868a-4e4d-8628-e1d14e502980
Unit42 BabyShark Feb 2019ATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--843aedaa-bbf0-4f29-bcfd-bd226ca7ef31
CISA AA20-301A KimsukyATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--906699ff-a10f-4527-9173-326965cc51a2
Unit42 BabyShark Feb 2019ATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--94e051ad-2f6d-4322-a854-6ee1944a8904
Unit42 BabyShark Feb 2019ATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95dbd3ec-820c-47af-9734-78c39b092bc4
Unit42 BabyShark Apr 2019ATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab322e5c-dfd2-45dd-bee1-59aec9d1d840
CISA AA20-301A Kimsuky · Unit42 BabyShark Feb 2019ATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cef53316-353b-48f8-bce4-1d95f3ff843e
Unit42 BabyShark Feb 2019ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:S0414
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fba9610f-dbaa-4ded-b233-9229b80809ab
CISA AA20-301A Kimsuky · Crowdstrike GTR2020 Mar 2020 · Cybereason Kimsuky November 2020 · Mandiant APT43 March 2024ATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fc9a56ec-ef5f-4e45-b004-fe395d6b6d3f
Unit42 BabyShark Feb 2019