SoreFang
Software · ATTACK:enterprise:S0516
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0516",
"title": "SoreFang",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0516",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--e33e4603-afab-402d-b2a1-248d435b5fe0",
"external_id": "S0516",
"domain": "enterprise",
"created": "2020-09-29T19:33:35.122Z",
"modified": "2025-10-22T02:39:07.705Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "CISA SoreFang July 2016",
"url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a"
},
{
"source_name": "NCSC APT29 July 2020",
"url": "https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf"
}
]
}Explicit source assertions (15)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0516 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0aebf9e4-9730-45ce-877d-f78432c13fad
CISA SoreFang July 2016 · NCSC APT29 July 2020ATTACK:enterprise:S0516 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0cf8d5da-a127-4b48-bbf9-e5a0376033b4
CISA SoreFang July 2016ATTACK:enterprise:S0516 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ed17f60-d6ca-4ef7-ae52-7a573c2a7ff3
CISA SoreFang July 2016ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:S0516
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--364d9326-12af-4449-924c-8063f4b3aa41
NCSC APT29 July 2020 · CISA SoreFang July 2016ATTACK:enterprise:S0516 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3dd2f874-57e3-4670-9c0a-7d8c35741bb6
CISA SoreFang July 2016ATTACK:enterprise:S0516 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b9cbe06-8c1f-4596-ad87-fa19e60e8ec3
CISA SoreFang July 2016 · NCSC APT29 July 2020ATTACK:enterprise:S0516 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61ee8aa7-89fc-4414-97f3-95fa9f1f26ad
CISA SoreFang July 2016ATTACK:enterprise:S0516 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6beb1553-aece-41eb-a1e7-dbe2738f23d6
CISA SoreFang July 2016ATTACK:enterprise:S0516 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--75e01f6a-9f45-4db2-a79d-a21453b6d83f
CISA SoreFang July 2016ATTACK:enterprise:S0516 → uses → ATTACK:enterprise:T1087.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--962d745e-7771-4c8b-a887-04d3a521943c
CISA SoreFang July 2016ATTACK:enterprise:S0516 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--98737ffe-6b7b-4c2d-a775-7a93e304a9c7
CISA SoreFang July 2016ATTACK:enterprise:S0516 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c24c5c3-0aa3-4caa-b983-9739eb8c57eb
CISA SoreFang July 2016ATTACK:enterprise:S0516 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a220cf94-7165-44ed-85da-014bc684e680
CISA SoreFang July 2016ATTACK:enterprise:S0516 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c76875e8-006d-493b-880a-332faf28f3ca
CISA SoreFang July 2016ATTACK:enterprise:S0516 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec218695-e481-4895-97a2-5383949cb04d
CISA SoreFang July 2016