SLOTHFULMEDIA
Software · ATTACK:enterprise:S0533
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0533",
"title": "SLOTHFULMEDIA",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0533",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--feb2d7bb-aacb-48df-ad04-ccf41a30cd90",
"external_id": "S0533",
"domain": "enterprise",
"created": "2020-11-16T23:23:00.729Z",
"modified": "2025-10-21T22:55:49.669Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Costin Raiu IAmTheKing October 2020",
"url": "https://x.com/craiu/status/1311920398259367942"
},
{
"source_name": "CISA MAR SLOTHFULMEDIA October 2020",
"url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"
},
{
"source_name": "ESET PowerPool Code October 2020",
"url": "https://x.com/ESETresearch/status/1311762215490461696"
},
{
"source_name": "Kaspersky IAmTheKing October 2020",
"url": "https://securelist.com/iamtheking-and-the-slothfulmedia-malware-family/99000/"
},
{
"source_name": "QueenOfClubs"
},
{
"source_name": "JackOfHearts"
},
{
"source_name": "USCYBERCOM SLOTHFULMEDIA October 2020",
"url": "https://x.com/CNMF_CyberAlert/status/1311743710997159953"
}
]
}Explicit source assertions (24)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0160f1e4-76bd-4490-af74-bb80072cecae
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c6329d8-4f00-4b3b-aa82-3bc2e9f14766
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f174d38-f30b-4037-a1bc-ecc099809966
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--10fb2420-a482-4909-90c6-fd9f7e5c24a6
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11f33a6b-f2f5-4c35-a72a-e2197340b425
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--23d2aa8e-0b95-4714-8b76-b1a0735ffdeb
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--348ac89f-1a85-4ab2-887f-4e58dfc14853
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39b38f3b-e878-4bce-967b-59035a528595
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--46c4ce23-1285-49e5-92a0-863251af60cd
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4a7a38c4-fb6d-420e-ac37-0c774c7b3a9f
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5724994d-7213-4a70-8065-1a12280f8f4c
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c039dbf-c443-4f9b-b036-fcabaed74a3b
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1569.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--606d0114-e9a5-49a6-a6b9-0f67da987969
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--644d8961-2e4e-4aa1-b7d8-6759a64b25e8
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d182b64-121f-43bf-b268-fe1e5874087d
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--70fa48cc-4acf-4df3-b8a0-d862b2b67f33
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1489
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--922cc16d-2242-477b-89db-1ba3d5176e12
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--99e04ca5-f096-4069-888d-12e8945a69ce
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--99f5f421-c462-472c-9aa8-29a4316c3f5e
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d201245-16f4-4142-94ff-25136107d0f6
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cd68ff0c-88c9-4a71-82ff-f16da53ed8ed
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e7477fbb-361f-4502-99d4-75576d6d3ac7
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1564.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f71229d4-5499-4eb1-ad83-b18a1063b5b7
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f8a9e39a-0038-437c-96ad-4408d028dd86
CISA MAR SLOTHFULMEDIA October 2020