Ramsay
Software · ATTACK:enterprise:S0458
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0458",
"title": "Ramsay",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0458",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--ba09b86c-1c40-4ff1-bda0-0d8c4ca35997",
"external_id": "S0458",
"domain": "enterprise",
"created": "2020-05-27T16:58:08.242Z",
"modified": "2025-04-25T14:44:32.751Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Ramsay"
},
{
"source_name": "Antiy CERT Ramsay April 2020",
"url": "https://www.programmersought.com/article/62493896999/"
},
{
"source_name": "Eset Ramsay May 2020",
"url": "https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"
}
]
}Explicit source assertions (39)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0428220b-eb98-45c3-a637-7da54b4496b4
Eset Ramsay May 2020 · Antiy CERT Ramsay April 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0709589f-cc25-4925-89be-59e121c47951
Eset Ramsay May 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--145d2112-b679-4d72-b484-7524f944e128
Antiy CERT Ramsay April 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1884ba87-a1c8-496b-9517-abb379911166
Antiy CERT Ramsay April 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--239eb918-b9e0-499c-9934-96382fa782a0
Eset Ramsay May 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2962304a-f96e-4323-958f-f685eae97ac6
Eset Ramsay May 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1046
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c9fad15-9b3f-45fe-854a-c87113d4695c
Eset Ramsay May 2020 · Antiy CERT Ramsay April 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30e61544-d516-40ee-afac-8fd9deecd017
Antiy CERT Ramsay April 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1080
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--365f82e7-6fad-44a7-855d-955d4307920f
Eset Ramsay May 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3890dead-331f-498d-b99d-2191150ae2ac
Antiy CERT Ramsay April 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3feb6e83-0491-4e3d-a581-3f68ab839e92
Eset Ramsay May 2020 · Antiy CERT Ramsay April 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--417912a3-95a8-4dd4-a586-88cca62f3ebc
Eset Ramsay May 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b03f718-f89a-4652-b3be-5cbe4e0e044f
Eset Ramsay May 2020 · Antiy CERT Ramsay April 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1120
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--55d84559-7bb9-4e17-be60-7694e4219877
Eset Ramsay May 2020 · Antiy CERT Ramsay April 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--55e67f6b-600a-4196-b497-63019731e66e
Eset Ramsay May 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c692a16-22b8-42bb-9a6b-3c25a2714cf5
Eset Ramsay May 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1560.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71abba24-84a2-449d-811a-ba006382d723
Eset Ramsay May 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--756f3884-c21b-4d00-ac2c-6c2ab386072f
Eset Ramsay May 2020 · Antiy CERT Ramsay April 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76a3097b-808d-45a9-aa81-dce5ed6a45d3
Eset Ramsay May 2020 · Antiy CERT Ramsay April 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--81a857bb-4c36-4875-a62e-30e7b12eae12
Antiy CERT Ramsay April 2020 · Eset Ramsay May 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1027.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--879ee01b-0517-42bd-8ac8-3857e63e40c4
Antiy CERT Ramsay April 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--882002ca-25a6-4226-9cc4-3efe5f798449
Eset Ramsay May 2020 · Antiy CERT Ramsay April 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d5a8f57-0d67-462f-a4f5-7fc4268e4ab2
Antiy CERT Ramsay April 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96062ede-31e8-4777-8b81-39e8a9e8b88e
Antiy CERT Ramsay April 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a024097d-78f0-4439-a239-571d361335f5
Eset Ramsay May 2020 · Antiy CERT Ramsay April 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a38af2cc-ccc7-41aa-936c-fe15a13ddafa
Eset Ramsay May 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1119
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6046634-68c8-4a9e-a58f-58fd8876346a
Eset Ramsay May 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1091
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8f639f8-9717-485a-ad4c-7eb1fc771691
Eset Ramsay May 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cde9af4e-4bf9-4235-9d27-496eb78e3608
Eset Ramsay May 2020 · Antiy CERT Ramsay April 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1055.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d10e82b8-7f30-4845-af05-44ac3287bf70
Eset Ramsay May 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4f17f68-7a50-428f-b26d-94dcbf861ec5
Antiy CERT Ramsay April 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9898b1f-9056-400c-9b26-26c87500cfe3
Eset Ramsay May 2020 · Antiy CERT Ramsay April 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e273286f-8ca7-4d3e-bdc3-08929c7cbd12
Eset Ramsay May 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb9fb4e7-1b43-41ee-88e1-a3f93a278082
Antiy CERT Ramsay April 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ed6d663f-510b-4702-9c2a-ef40cc4d88c7
Eset Ramsay May 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f1bd5050-739b-4a22-a1a6-f80e70cb8192
Antiy CERT Ramsay April 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1559.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f1c2c698-e374-4ab1-b478-49e987d3a184
Eset Ramsay May 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1025
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f86c19e6-39a1-423c-8db2-a8258ac51bd6
Eset Ramsay May 2020ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1546.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f96794d1-0707-4897-9de1-08546b605bf0
Eset Ramsay May 2020