Valak
Software · ATTACK:enterprise:S0476
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0476",
"title": "Valak",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0476",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--ade37ada-14af-4b44-b36c-210eec255d53",
"external_id": "S0476",
"domain": "enterprise",
"created": "2020-06-19T17:11:54.854Z",
"modified": "2025-04-16T20:38:30.200Z",
"version": "1.3",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Unit 42 Valak July 2020",
"url": "https://unit42.paloaltonetworks.com/valak-evolution/"
},
{
"source_name": "Cybereason Valak May 2020",
"url": "https://www.cybereason.com/blog/valak-more-than-meets-the-eye"
}
]
}Explicit source assertions (35)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0841cd91-1151-411f-befc-0204e3a3eb30
Unit 42 Valak July 2020 · SentinelOne Valak June 2020 · Cybereason Valak May 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1555.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13c82683-dea9-418b-9112-a801c4cebc64
SentinelOne Valak June 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ca28941-562d-45e4-946c-518a2015c0dd
Cybereason Valak May 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1564.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1fdd4a0b-fe6d-4fb1-a6ab-7f5063b6ecc3
Unit 42 Valak July 2020 · SentinelOne Valak June 2020 · Cybereason Valak May 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25b8b66a-a9d0-4400-8b41-dd12208a25de
Unit 42 Valak July 2020 · SentinelOne Valak June 2020 · Cybereason Valak May 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1218.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2bdaa624-15bb-4a69-8192-adc9fa44af3f
Cybereason Valak May 2020 · Unit 42 Valak July 2020ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:S0476
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39a3fca6-cdf6-4053-b4fe-eb5d46fc729f
Cybereason Valak May 2020 · Unit 42 Valak July 2020 · Unit 42 TA551 Jan 2021 · Secureworks GOLD CABINATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4143e83e-40a1-4d10-babf-9affba3cb101
Cybereason Valak May 2020 · Unit 42 Valak July 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--48e3f4e2-0506-4b5c-b40c-2c6edc92b0a5
Unit 42 Valak July 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--495982e4-9856-4e7f-8e05-4654d67a4d62
Unit 42 Valak July 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49c5bbcf-7ac3-406f-8b58-2b4c00b2c41e
Cybereason Valak May 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--51656ee5-4d21-42c9-9719-826645b3508f
Unit 42 Valak July 2020 · SentinelOne Valak June 2020 · Cybereason Valak May 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5797b454-e7cc-45a3-9bf1-7708d7286531
Cybereason Valak May 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c46f9a0-fb83-473d-af9a-c1c98cfdd85b
Cybereason Valak May 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6bc33571-c702-4fcc-9f1c-b87d5a842586
SentinelOne Valak June 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6be48603-8603-45dd-8423-294169ca45a6
Cybereason Valak May 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b4e1a93-99ca-444d-bfc4-bc589a9a25a9
SentinelOne Valak June 2020 · Cybereason Valak May 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e9f9565-d9c5-47e5-a962-8dfa3dc77fc6
Unit 42 Valak July 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1119
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7fb8ef27-0c19-4e31-9122-f89cd4283427
SentinelOne Valak June 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86ce6e35-bf83-4d55-a3c8-3ac2e2d2f872
Unit 42 Valak July 2020 · Cybereason Valak May 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8ae91ec7-32ed-46a2-9bc2-1c7b856c3cc7
Unit 42 Valak July 2020 · SentinelOne Valak June 2020 · Cybereason Valak May 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1552.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--92c6a85d-d8b4-44d2-acf4-53ae07f69f77
SentinelOne Valak June 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93169fdc-7afd-41b9-90bc-54d99c1c86e6
Cybereason Valak May 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1114.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--99dfbbaa-5e58-4a03-9b94-fb6962681ce3
Cybereason Valak May 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ab85095-bac1-4b21-8e9d-e24c084af0d2
SentinelOne Valak June 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a40a85bf-69d3-4164-a735-fb9ecc7b656e
Unit 42 Valak July 2020 · SentinelOne Valak June 2020 · Cybereason Valak May 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0d3ef27-8854-486f-942b-f0cd42c8a85c
Unit 42 Valak July 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b91de2c3-897a-4e04-94f8-9e905564b47a
Unit 42 Valak July 2020 · SentinelOne Valak June 2020 · Cybereason Valak May 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b99e218f-942b-4643-b4de-35649d2a4cbd
Cybereason Valak May 2020 · Unit 42 Valak July 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be99408a-dc65-41a0-83db-235d8495e55c
Unit 42 Valak July 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4faeb90-07ee-4ae2-b77d-e002418d1b22
Cybereason Valak May 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1087.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d670ddce-d32a-4165-a56e-5bb183f4c904
Cybereason Valak May 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2c05732-0721-4836-aa07-52f4c379b361
Cybereason Valak May 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e91ec241-b329-4488-ac65-442992f84fb5
SentinelOne Valak June 2020ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--edb83e19-bc71-455e-bf38-4ab5c823ebc8
SentinelOne Valak June 2020