SDBbot
Software · ATTACK:enterprise:S0461
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0461",
"title": "SDBbot",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0461",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--92b03a94-7147-4952-9d5a-b4d24da7487c",
"external_id": "S0461",
"domain": "enterprise",
"created": "2020-06-01T12:29:05.241Z",
"modified": "2026-01-20T15:50:34.668Z",
"version": "2.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "IBM TA505 April 2020",
"url": "https://web.archive.org/web/20200420201624/https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/"
},
{
"source_name": "Proofpoint TA505 October 2019",
"url": "https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"
}
]
}Explicit source assertions (25)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03b12a66-789a-4480-8903-deab828d08b6
Proofpoint TA505 October 2019ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1070
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--08f4dfcb-c394-470d-851f-045bbc38cdb5
Proofpoint TA505 October 2019ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--102849c0-0ed7-4e85-9d0b-791bcb7ef7ab
IBM TA505 April 2020 · Proofpoint TA505 October 2019ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1090
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a9510e3-0bb0-4469-bbf8-2d02a3a00d66
Proofpoint TA505 October 2019ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1546.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e29cbcc-3e45-4e62-a66f-4479b310ccdb
Proofpoint TA505 October 2019ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1055.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27ccf817-33de-4d85-85e5-851f82e835e4
Proofpoint TA505 October 2019ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5e617da4-3359-4e40-b29d-679e05ef2e31
Korean FSI TA505 2020ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63ae56fe-04c2-41f5-a2be-c1880e67b490
IBM TA505 April 2020ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--70dc4dfe-c859-4665-88d7-ff724d88380b
Korean FSI TA505 2020ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7333e2da-7aa5-4559-a03d-5818883d62d5
IBM TA505 April 2020 · Proofpoint TA505 October 2019ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76d47356-a255-48ba-9cd8-1ff2e52bb165
Proofpoint TA505 October 2019ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7aef9a3f-82ff-4e2e-bee7-962b49421067
Proofpoint TA505 October 2019ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ef04aca-4890-4035-8c0b-69d9a78e8029
Proofpoint TA505 October 2019ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--855bcd64-ef37-4197-8d3e-2c147d42d774
Korean FSI TA505 2020 · Proofpoint TA505 October 2019ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1125
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--88d48848-1f23-4d91-8934-045d04b219ea
IBM TA505 April 2020 · Proofpoint TA505 October 2019ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1546.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91e86813-270d-4ee6-8dff-9b87e3d9fae4
Proofpoint TA505 October 2019ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c15fad4-3614-4bf0-90db-84749f34f91c
Proofpoint TA505 October 2019ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ee385ef-7e78-47bf-be25-8ba112f9280e
Proofpoint TA505 October 2019ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a7cdf456-9ad0-402b-a914-5f1ebcd873a3
Proofpoint TA505 October 2019ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--afc6e4e4-2bcc-47b7-bc0d-2866d4e1dcda
Korean FSI TA505 2020ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0461
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c07d6bad-8249-46c2-971f-66e779229be0
IBM TA505 April 2020 · Proofpoint TA505 October 2019ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d0c15113-67a0-4f02-8a92-d22165642d40
Korean FSI TA505 2020ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--efe5521e-a774-4a0f-a360-3cee8303833d
Proofpoint TA505 October 2019ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f252d0e6-019a-4711-9069-c16930236aa4
Proofpoint TA505 October 2019ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f96a2b4a-4d74-4251-b714-40b224d3ad09
Proofpoint TA505 October 2019