Penquin
Software · ATTACK:enterprise:S0587
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0587",
"title": "Penquin",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0587",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--d18cb958-f4ad-4fb3-bb4f-e8994d206550",
"external_id": "S0587",
"domain": "enterprise",
"created": "2021-03-11T15:06:57.934Z",
"modified": "2025-10-22T03:16:19.980Z",
"version": "1.3",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Penquin 2.0"
},
{
"source_name": "Penquin_x64"
},
{
"source_name": "Kaspersky Turla Penquin December 2014",
"url": "https://securelist.com/the-penquin-turla-2/67962/"
},
{
"source_name": "Leonardo Turla Penquin May 2020",
"url": "https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf"
}
]
}Explicit source assertions (19)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1059.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--228c84a6-e6fa-45f3-9f89-36a0c95fb1e7
Leonardo Turla Penquin May 2020ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--48318986-6d46-436a-b9ff-dd2ac1ab32a2
Leonardo Turla Penquin May 2020ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5488dd31-2a28-4250-89ff-963214f46b92
Kaspersky Turla Penquin December 2014 · Leonardo Turla Penquin May 2020ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ef55051-c152-4491-a881-31ff98fb773e
Leonardo Turla Penquin May 2020ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--729f4b9b-2d25-4e69-9a9b-adaa62c2ee31
Leonardo Turla Penquin May 2020ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--77534dcc-4183-41b5-adbd-cc7e8ccaa3ec
Leonardo Turla Penquin May 2020ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1053.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7bd145ae-5ad2-48cc-8438-5b9ec8ed5414
Leonardo Turla Penquin May 2020ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1040
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9148cfab-450f-4aa7-a427-3ddf8e8d686a
Kaspersky Turla Penquin December 2014 · Leonardo Turla Penquin May 2020ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1573.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ce465d9-921b-4d6d-8863-b1ffc63f0e8e
Leonardo Turla Penquin May 2020ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1027.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab009520-dffe-4494-9468-0189060cca01
Leonardo Turla Penquin May 2020ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c270ebd7-56e2-4ede-bd45-57da4a0065f2
Leonardo Turla Penquin May 2020ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c92d9edc-e2a9-44e4-95ef-81632eaf14f9
Leonardo Turla Penquin May 2020ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1205.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cdf000de-7faa-4251-b1f0-d08e043ef16a
Leonardo Turla Penquin May 2020ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ce59452d-d258-435f-aa91-329de56eba8e
Kaspersky Turla Penquin December 2014 · Leonardo Turla Penquin May 2020ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d0a2aa1e-a824-47b8-99a5-c2d026c9432d
Leonardo Turla Penquin May 2020ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2b67455-4986-46f4-a4ff-f5ee215ef998
Leonardo Turla Penquin May 2020ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0587
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f2a29786-05d5-4566-bece-14d5c1a212c1
Leonardo Turla Penquin May 2020ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f476b228-f729-4809-b40e-6c402da30c5d
Leonardo Turla Penquin May 2020ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fa211b49-7df8-4283-8a70-78b4b81bbba9
Leonardo Turla Penquin May 2020