Tomiris
Software · ATTACK:enterprise:S0671
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0671",
"title": "Tomiris",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0671",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--327b3a25-9e60-4431-b3b6-93b9c64eacbc",
"external_id": "S0671",
"domain": "enterprise",
"created": "2021-12-29T14:47:19.862Z",
"modified": "2025-04-16T20:38:01.801Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Kaspersky Tomiris Sep 2021",
"url": "https://securelist.com/darkhalo-after-solarwinds-the-tomiris-connection/104311/"
}
]
}Explicit source assertions (8)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0671 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03f288cd-a189-4de9-abd4-6b10bda138a4
Kaspersky Tomiris Sep 2021ATTACK:enterprise:S0671 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30565d66-2743-4e39-81ce-bc861149ce1e
Kaspersky Tomiris Sep 2021ATTACK:enterprise:S0671 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--43ae357d-d0f8-4cdc-a9d6-0f10f603707c
Kaspersky Tomiris Sep 2021ATTACK:enterprise:S0671 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5970c81f-932b-47e9-a63b-b4e30c351e7f
Kaspersky Tomiris Sep 2021ATTACK:enterprise:S0671 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63e47b19-5fe4-485d-9544-ab90a66edf6d
Kaspersky Tomiris Sep 2021ATTACK:enterprise:S0671 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6eb962fa-ca3e-4af2-9243-132c666a5c25
Kaspersky Tomiris Sep 2021ATTACK:enterprise:S0671 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e0bef30-edc0-4a18-9033-a1f487e35b76
Kaspersky Tomiris Sep 2021ATTACK:enterprise:S0671 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c902576b-935e-4c1c-ae81-5d878e0ebaa0
Kaspersky Tomiris Sep 2021