Skip to content

Gelsemium

Software · ATTACK:enterprise:S0666

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0666",
  "title": "Gelsemium",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0666",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--efa7c4d6-8e30-41d9-a8fd-26dc337f4a1b",
  "external_id": "S0666",
  "domain": "enterprise",
  "created": "2021-11-30T19:02:16.138Z",
  "modified": "2024-04-11T02:28:01.735Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Gelsevirine"
    },
    {
      "source_name": "Gelsenicine"
    },
    {
      "source_name": "Gelsemine"
    },
    {
      "source_name": "ESET Gelsemium June 2021",
      "url": "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
    }
  ]
}

Explicit source assertions (33)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1568

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0869b511-3211-4f90-86fa-d145fa42cc3a

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09e94c75-2a53-4f13-a290-a4acf5dd4e71

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1762eb59-4fc3-46c8-87d2-c16128bf20cb

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1aee2c50-660a-42ee-816d-5823ade525f3

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e345391-ccd8-49c9-9520-496070670e6c

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27857b33-3c5d-4f27-9d61-d70da097fd84

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28e6612e-5f92-42b0-b722-a49a43a75908

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1547.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b364611-0df2-4f12-9122-089ec49ec2e6

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2dde8a3e-773e-4a7f-82e4-dbcaa8cb94c8

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1497

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f7680e9-3dd7-4365-a1cc-75342808e2c2

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1027.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4fba775c-148d-4fc5-b56a-d5600b23654d

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--516712db-0e82-43a5-bd9f-f1a4cb4939c1

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d81254d-9a66-49ea-9635-187da26d4a97

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1071.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70c0fd33-8091-4e58-896b-0be55429ee91

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75f2e135-5c45-4b27-a7dc-f62e68f6a5ce

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86b8a22d-66c3-4b54-82fd-662455d0e2c5

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e140ad6-3e95-41fb-893d-644316fdccbf

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9548ed41-931a-4d95-8256-b3fcad5914ad

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9718f2c1-99f3-4fa2-8293-44f2b30bba70

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a01e5280-ae4f-4edd-bb57-e29e8426cc3b

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2c1921d-3d5d-4ec7-ab4d-4fe2e7d19e64

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a737a968-1fec-4e9b-b0dd-d4318f07a691

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba218c07-3cde-4555-a150-0c8daff51cee

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1070.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bf3726ed-c160-4f94-9b48-65a7da2a4ed3

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6a7e9fe-cdf3-451a-b97f-788b5839606c

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cca0dc19-ea37-4502-b2d4-7ce09f07be72

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf13b1fe-9653-4256-8ca9-d736470d53ec

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d35ccc13-9b62-4879-b625-7d15c9a8c981

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1036.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dc9643aa-7b61-4cb1-b181-3d88c0e9742a

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e1d0aa1d-c1ce-4cbc-bed2-097d6ea256c4

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e46d31bf-23d8-4464-96e8-aee04f745921

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f49cdf8b-a093-4f24-8b22-d0489756cc0d

ESET Gelsemium June 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1559.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fa939612-0aa1-40b6-aab6-7a1b1872c93b

ESET Gelsemium June 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.