BendyBear
Software · ATTACK:enterprise:S0574
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0574",
"title": "BendyBear",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0574",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--805480f1-6caa-4a67-8ca9-b2b39650d986",
"external_id": "S0574",
"domain": "enterprise",
"created": "2021-02-16T16:50:29.990Z",
"modified": "2024-04-11T02:54:10.246Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "BendyBear"
},
{
"source_name": "Unit42 BendyBear Feb 2021",
"url": "https://unit42.paloaltonetworks.com/bendybear-shellcode-blacktech/"
}
]
}Explicit source assertions (11)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0574 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--045da2d4-f599-447b-931b-c11e8692fa1c
Unit42 BendyBear Feb 2021ATTACK:enterprise:S0574 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f55c28a-835f-4a85-a733-8fac5b819dcf
Unit42 BendyBear Feb 2021ATTACK:enterprise:S0574 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--141036b9-327f-4b13-a561-856697dd138b
Unit42 BendyBear Feb 2021ATTACK:enterprise:S0574 → uses → ATTACK:enterprise:T1001.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--36855997-d730-48c6-bd43-7896c741cd6e
Unit42 BendyBear Feb 2021ATTACK:enterprise:S0574 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--730a735c-1008-490e-b0c8-6938b858b28a
Unit42 BendyBear Feb 2021ATTACK:enterprise:S0574 → uses → ATTACK:enterprise:T1027.014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a6460fa-dd4b-43ba-a59f-8c0db794151d
Unit42 BendyBear Feb 2021ATTACK:enterprise:S0574 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96fad0c2-f880-4fab-8aee-5573e1737dd8
Unit42 BendyBear Feb 2021ATTACK:enterprise:S0574 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9753bc87-1ed3-4a28-a9d3-80e004d83e62
Unit42 BendyBear Feb 2021ATTACK:enterprise:S0574 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d0eda8b-7696-4b22-a31e-6761e42bc2ae
Unit42 BendyBear Feb 2021ATTACK:enterprise:S0574 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a33dbef1-994b-4dec-accb-6e63e9858f3e
Unit42 BendyBear Feb 2021ATTACK:enterprise:S0574 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8a023b1-b472-40fc-98be-5709180e2628
Unit42 BendyBear Feb 2021