Skip to content

Sibot

Software · ATTACK:enterprise:S0589

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0589",
  "title": "Sibot",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0589",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--979adb5a-dc30-48f0-9e3d-9a26d866928c",
  "external_id": "S0589",
  "domain": "enterprise",
  "created": "2021-03-12T18:08:23.552Z",
  "modified": "2025-04-16T20:38:25.040Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "MSTIC NOBELIUM Mar 2021",
      "url": "https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"
    }
  ]
}

Explicit source assertions (20)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03070395-3b76-4351-a3bd-0d9eaaa6652c

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2496d1c4-cb04-40ab-9f9a-0102da3e6d77

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e79db26-a2ce-4233-a86c-5a97b10dd937

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:S0589

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--427b9f61-9f58-4167-b4f5-c7f3bdbd7862

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--453679cf-e04c-4419-9b94-9a150092a04d

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45bff763-b4f8-45e5-bb40-c98b415131f9

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6988baa7-1b48-4203-8020-7bb3fb38098d

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8fe424be-6873-4b25-a87e-88b2de005d7f

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9fce9cf9-2795-4384-abb5-cb049b3d4329

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ffd4ba1-1114-4df9-875c-14cacda87b21

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:S0589

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a34de077-b25d-479b-8001-897efde4b0c5

MSTIC Nobelium Toolset May 2021 · MSTIC NOBELIUM Mar 2021 · Cybersecurity Advisory SVR TTP May 2021 · Secureworks IRON RITUAL Profile

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa26d89c-7c7d-449a-a26a-caa37573698e

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aafa7447-cb73-4309-ac75-5326ab0d1079

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1218.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--acd4b81e-6bef-4ac0-bf4b-2428b5c9c6b9

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1218.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bdb9f6a6-7fe0-47e5-b708-3cb92360f6f9

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca5d71c9-2184-4cb2-9a63-2146fba66175

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8b95918-bf5b-455a-928c-1b69fe9c9703

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1027.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--df891390-43d8-4201-aebc-51c20cae5897

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e41eea8b-20d6-4050-96e6-6b59670f6e65

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fbc77ca5-46b1-4c5b-8e48-d053d1eb238d

MSTIC NOBELIUM Mar 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.