BackConfig
Software · ATTACK:enterprise:S0475
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0475",
"title": "BackConfig",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0475",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--c13d9621-aca7-436b-ab3d-3a95badb3d00",
"external_id": "S0475",
"domain": "enterprise",
"created": "2020-06-17T20:17:37.168Z",
"modified": "2025-04-16T20:38:33.939Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Unit 42 BackConfig May 2020",
"url": "https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"
}
]
}Explicit source assertions (17)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01b97c8a-f08c-4f54-a401-14d888ca79b9
Unit 42 BackConfig May 2020ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0614fc3b-614c-4d50-9ae2-ab526160faf5
Unit 42 BackConfig May 2020ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06aa7096-4813-4f50-a69a-7bcd6503ffe4
Unit 42 BackConfig May 2020ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--197ade21-6787-4ed3-a3ce-ff4b59b2f15c
Unit 42 BackConfig May 2020ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c0296de-dc33-4fd7-b774-1bbe8c1b56b7
Unit 42 BackConfig May 2020ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2597e12c-c342-4ca0-a235-b05752b2bfa5
Unit 42 BackConfig May 2020ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1137.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66ce5052-08d8-4160-a8c9-f3e6b9e5cd1f
Unit 42 BackConfig May 2020ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73d8feea-0b53-419a-be1b-5750aa47f2df
Unit 42 BackConfig May 2020ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8763c8dd-cd68-4402-be43-4dbd96c83c2d
Unit 42 BackConfig May 2020ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:S0475
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b2625de-8de9-4216-8805-d1e75093b098
Unit 42 BackConfig May 2020ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b82ea861-86df-4574-9727-f0d5828e9fe8
Unit 42 BackConfig May 2020ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1564.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf0fd2a9-0852-4a4e-a806-281c0a7d63e3
Unit 42 BackConfig May 2020ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c0417cdc-0451-41e3-8937-88e9ebd68d1a
Unit 42 BackConfig May 2020ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c3086516-a419-4e7f-87c4-e37f08d0f27a
Unit 42 BackConfig May 2020ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e823be4b-50b9-4430-9010-e960b46bdfcc
Unit 42 BackConfig May 2020ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ebf39235-749f-400e-aeb9-185df9e43fe1
Unit 42 BackConfig May 2020ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--efcd3e1b-d17b-4c7f-97fd-b438ebef6760
Unit 42 BackConfig May 2020