RCSession
Software · ATTACK:enterprise:S0662
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0662",
"title": "RCSession",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0662",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--03acae53-9b98-46f6-b204-16b930839055",
"external_id": "S0662",
"domain": "enterprise",
"created": "2021-11-19T19:47:26.552Z",
"modified": "2024-04-11T00:21:49.455Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Secureworks BRONZE PRESIDENT December 2019",
"url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
},
{
"source_name": "Trend Micro Iron Tiger April 2021",
"url": "https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"
},
{
"source_name": "Trend Micro DRBControl February 2020",
"url": "https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"
}
]
}Explicit source assertions (24)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0a47636e-8260-414d-aff7-7b1120778a51
Secureworks BRONZE PRESIDENT December 2019ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1055.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1bd9ad06-bb44-423c-b670-65b8a8510e1e
Secureworks BRONZE PRESIDENT December 2019 · Profero APT27 December 2020 · Trend Micro DRBControl February 2020ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2a47008b-49af-4ecc-b018-ef92786ead72
Profero APT27 December 2020ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1218.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e03c99d-473d-406e-b903-1fc9c9a6a5ec
Profero APT27 December 2020ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4ea07638-aca6-400b-9979-26b9002e990c
Profero APT27 December 2020ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64fc52d7-7e49-4fda-8193-8e38e8ac1811
Profero APT27 December 2020 · Trend Micro DRBControl February 2020ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6758c87e-d187-46df-b02a-1e093b3054cc
Profero APT27 December 2020ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7908bc8d-8a9b-48c0-897e-25266950b0da
Profero APT27 December 2020ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7eb1887a-2a3e-46f0-83c5-fe931c3a163b
Profero APT27 December 2020 · Trend Micro DRBControl February 2020ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--89baa1ed-a6f9-4da6-9448-c74d8f8a638b
Profero APT27 December 2020ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a31c95e7-5c2f-47ff-9b3a-30ddb0fa63b5
Profero APT27 December 2020ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab1d783b-d6b3-439c-a5f4-701a8cae4c6a
Profero APT27 December 2020 · Trend Micro DRBControl February 2020ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0662
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b143e00a-062e-424a-83c2-27559ff2cdf1
Profero APT27 December 2020 · Trend Micro Iron Tiger April 2021 · Trend Micro DRBControl February 2020ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1027.015
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b31e0e76-0239-41fc-a9a8-7c62b00510e1
Trend Micro DRBControl February 2020ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c5a8316e-f45c-432d-beb3-d8de4785dba3
Profero APT27 December 2020 · Trend Micro DRBControl February 2020ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cbe08a78-7997-4aef-9b29-b4b002accbc3
Profero APT27 December 2020 · Trend Micro DRBControl February 2020ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:S0662
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d395d0b1-0ce7-46bf-bf8a-5a031f7bbf78
Secureworks BRONZE PRESIDENT December 2019ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7e5009a-1eb3-4b74-ad0c-53ba0e151935
Profero APT27 December 2020ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d8f956ea-84ef-4232-b281-59c40f019753
Profero APT27 December 2020 · Trend Micro DRBControl February 2020ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea99ff52-af1e-49af-9cfe-b224c9a9eea4
Secureworks BRONZE PRESIDENT December 2019 · Trend Micro DRBControl February 2020ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec72af45-d362-41c1-99d1-7a225a823049
Profero APT27 December 2020 · Trend Micro DRBControl February 2020ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f0e2c414-9356-4eb6-89d5-fe1afb62780f
Secureworks BRONZE PRESIDENT December 2019 · Profero APT27 December 2020 · Trend Micro DRBControl February 2020ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fb63284b-33d6-4cf9-afdb-2aed117af00f
Trend Micro DRBControl February 2020ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fcc98412-8534-42d7-873a-6f8a26721e27
Trend Micro DRBControl February 2020