Lucifer
Software · ATTACK:enterprise:S0532
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0532",
"title": "Lucifer",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0532",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--54a73038-1937-4d71-a253-316e76d5413c",
"external_id": "S0532",
"domain": "enterprise",
"created": "2020-11-16T18:40:34.473Z",
"modified": "2025-04-25T14:43:22.226Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Unit 42 Lucifer June 2020",
"url": "https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/"
}
]
}Explicit source assertions (24)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1496.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0493bf17-29a1-4825-b1a2-6e037288637f
Unit 42 Lucifer June 2020ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06b7b9b4-7cc8-4d7f-af8c-20fe8b8610b0
Unit 42 Lucifer June 2020ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d1fe44d-a476-4553-b163-1e03890ae7b4
Unit 42 Lucifer June 2020ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c9d4988-d9ea-4dd5-aef1-adb0232e87a3
Unit 42 Lucifer June 2020ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--23c028d1-6963-4033-b91f-5953413df43c
Unit 42 Lucifer June 2020ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25022051-be2f-4cc2-b61a-3de03fc3e8d6
Unit 42 Lucifer June 2020ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--322a78a2-1765-414f-9b07-29a1360e1134
Unit 42 Lucifer June 2020ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--339746da-8c6e-4273-8e17-895d3b50fe4d
Unit 42 Lucifer June 2020ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--42205acc-2d23-4ea9-ac29-980b6517d908
Unit 42 Lucifer June 2020ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1570
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--427a272e-4500-4216-8816-a6c7d4492f3e
Unit 42 Lucifer June 2020ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5473acfd-2cb3-45a8-97cb-c3962c606f1e
Unit 42 Lucifer June 2020ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d4f48e5-48a1-4ade-ae59-b34824b8181f
Unit 42 Lucifer June 2020ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d972f64-4c81-43ce-ba08-2c791bd78287
Unit 42 Lucifer June 2020ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aecb4057-07a2-4b44-805a-5566a4047e23
Unit 42 Lucifer June 2020ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1110.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b7e456b1-ed5e-48f0-be6e-df3e7d6b4044
Unit 42 Lucifer June 2020ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1498
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bb19637b-a68f-48fd-8b14-41607f32888d
Unit 42 Lucifer June 2020ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be9fb7de-682e-4c5e-96f3-872405674e51
Unit 42 Lucifer June 2020ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1071
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bfc5ca31-5d92-4c51-be33-e610df85055a
Unit 42 Lucifer June 2020ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1210
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c1a8eea8-f273-4dad-8ae0-d5c93bf5467f
Unit 42 Lucifer June 2020ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1685.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cb5b8564-d019-4134-8214-87d766128e1b
Unit 42 Lucifer June 2020ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1046
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eacb7614-6cc9-4eb9-92fc-bba53ac4f59a
Unit 42 Lucifer June 2020ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1021.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ef5479d8-f8f3-4754-989e-9930a245899c
Unit 42 Lucifer June 2020ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f8c754dd-a4a8-4507-bce2-c738e5354a3c
Unit 42 Lucifer June 2020ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fb9a793b-0ed7-4152-8802-e1861ad32ad2
Unit 42 Lucifer June 2020