BLUELIGHT
Software · ATTACK:enterprise:S0657
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0657",
"title": "BLUELIGHT",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0657",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--8bd47506-29ae-44ea-a5c1-c57e8a1ab6b0",
"external_id": "S0657",
"domain": "enterprise",
"created": "2021-10-01T20:26:49.502Z",
"modified": "2024-04-11T02:49:24.851Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "BLUELIGHT"
},
{
"source_name": "Volexity InkySquid BLUELIGHT August 2021",
"url": "https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"
}
]
}Explicit source assertions (20)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--07720e8d-fd8a-449c-ac32-484ccf989694
Volexity InkySquid BLUELIGHT August 2021ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1560.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c3e8b5e-1908-4a17-ba56-f8df99991cd9
Volexity InkySquid BLUELIGHT August 2021ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0efb0490-9935-4d51-8b2f-974e090bbc10
Volexity InkySquid BLUELIGHT August 2021ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:S0657
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--18c39a72-26d4-4e43-ad59-d3dcdacc592f
Volexity InkySquid BLUELIGHT August 2021ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1da27474-f902-419e-97a9-1fba8743cce8
Volexity InkySquid BLUELIGHT August 2021ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2161578b-44ef-4c44-90ad-2ee8920a3db8
Volexity InkySquid BLUELIGHT August 2021ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--371958b3-0a01-48a4-b035-3a9d44b17388
Volexity InkySquid BLUELIGHT August 2021ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4113ccd6-1134-4cef-bf5b-aca9a2364c82
Volexity InkySquid BLUELIGHT August 2021ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5adfebe4-4bfd-4848-9727-379d7284dcc8
Volexity InkySquid BLUELIGHT August 2021ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63e149cc-a5a3-496b-b8c3-4e428f0d5fb9
Volexity InkySquid BLUELIGHT August 2021ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1102.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d4a82db-fce4-4dcc-a0d3-8aa14cbf2ee3
Volexity InkySquid BLUELIGHT August 2021ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1539
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--953091ba-9d00-41ba-8727-014f6d11b5d3
Volexity InkySquid BLUELIGHT August 2021ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--965ea950-3680-4317-8f73-996157632a0e
Volexity InkySquid BLUELIGHT August 2021ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d1a9a04-6174-4aaa-8fac-43c965f0bd38
Volexity InkySquid BLUELIGHT August 2021ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1560
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4361a93-3ce2-4c35-a5d8-9a4fae2dc822
Volexity InkySquid BLUELIGHT August 2021ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a5d8527f-71eb-48e4-b5af-f95d29fdb265
Volexity InkySquid BLUELIGHT August 2021ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc74cabe-b8bc-4873-a6ff-e16d8f91299f
Volexity InkySquid BLUELIGHT August 2021ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf0c323f-545c-4bd1-959a-5b1a28d4d06d
Volexity InkySquid BLUELIGHT August 2021ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d1d27a0f-ae6d-4058-b0ad-581aaf939e4a
Volexity InkySquid BLUELIGHT August 2021ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e43ab91c-ad83-4469-8a8f-ce3337cdcb12
Volexity InkySquid BLUELIGHT August 2021