Skip to content

Okrum

Software · ATTACK:enterprise:S0439

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0439",
  "title": "Okrum",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0439",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--4b6ec280-7bbb-48ff-ae59-b189520ebe83",
  "external_id": "S0439",
  "domain": "enterprise",
  "created": "2020-05-06T21:12:31.535Z",
  "modified": "2025-04-25T14:43:14.113Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "ESET Okrum July 2019",
      "url": "https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf"
    }
  ]
}

Explicit source assertions (35)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1003.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--060d2cd5-a734-4c78-908c-a9ddabe3aa89

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09962c1d-38be-43f6-83bc-a63d1bebdb2d

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b582433-b5e6-49d7-886c-e1edd1a0a802

ESET Okrum July 2019

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:S0439

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ee0af6e-c913-406e-9439-f40f5102cae7

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--108e61c1-83fc-4ebf-aa5c-4ff19ccbe7cf

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1497.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--121152af-4bfe-4202-ade0-aad9fb85e0ad

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--140dda5e-b3d5-47ce-aac5-22060d5bddf2

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e5cae4c-240d-495b-9eca-34bba583d894

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2abdb5f5-6ff1-4f05-b925-429595011475

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ef7a9cd-aba5-4360-9a8f-f6b58ff4492d

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39897b0a-f48b-4d3b-8ba0-d6f8f26d00d4

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a040d38-be65-49b4-a41a-3fd010f3ea9a

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3bca1b9e-c598-494a-9471-0121734e7c79

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40fad687-982e-4cd3-955c-3c458e34e5df

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54ece776-8a64-4e0c-9d54-4350680c07b8

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65f315be-e62d-44a5-b21a-7211041a75bb

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d8147e4-fca3-4348-9376-dd96cc7b9e30

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--702ed555-03e2-4660-82d8-e85d46cbec02

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--743a0baf-8d6d-4e4a-a72b-0413a5d49594

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7898362c-a930-4cd4-9c94-019a253af141

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8483ad9a-84c9-4c83-a4d7-d403e44735dc

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--874148d5-d7cb-43c2-905f-1582f90005f6

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8908a544-e6b6-485a-8251-6c8dd1fbc040

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c77a88d-1390-4736-b7c9-f902b62d7f45

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95e5fd0e-b9c1-4efa-b462-a922456401e6

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abf2a4b0-d0d7-4f13-9b7c-647abc3694e2

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b3f66735-fafe-49be-b55c-4d087d1351a7

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bf603371-ff65-4b57-b80a-4f93daafbed6

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cab93d90-f8de-4bb3-8868-11b8d9a2ddf9

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ce48fd88-9fed-44d6-864f-07d8994c89d2

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cebe7625-3bb7-4353-9b48-cd4251410968

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d96d964f-fec6-475e-acc5-d25ff0d46af9

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1124

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e6f9ae1e-7002-4c62-be60-f45eca42061e

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f89f5b59-9a3d-4f3a-9740-2bc1e063b752

ESET Okrum July 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fcd3bc09-f88b-43d7-989d-10f7058e655e

ESET Okrum July 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.