MacMa
Software · ATTACK:enterprise:S1016
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1016",
"title": "MacMa",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1016",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--bdee9574-7479-4073-a7dc-e86d8acd073a",
"external_id": "S1016",
"domain": "enterprise",
"created": "2022-05-06T01:29:34.860Z",
"modified": "2025-10-21T03:17:00.503Z",
"version": "2.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "DazzleSpy"
},
{
"source_name": "OSX.CDDS"
},
{
"source_name": "ESET DazzleSpy Jan 2022",
"url": "https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"
},
{
"source_name": "Symantec Daggerfly 2024",
"url": "https://symantec-enterprise-blogs.security.com/threat-intelligence/daggerfly-espionage-updated-toolset"
},
{
"source_name": "Objective-See MacMa Nov 2021",
"url": "https://objective-see.org/blog/blog_0x69.html"
}
]
}Explicit source assertions (28)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0bf4ebc1-e4e4-4d56-8380-cb9601de353f
ESET DazzleSpy Jan 2022ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1501c966-8f40-4093-b0d1-b3d572b3a1ee
ESET DazzleSpy Jan 2022ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--151da49e-c3ee-4615-b62e-c8a3c93a32a6
ESET DazzleSpy Jan 2022ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2a4a9318-ee83-49aa-a278-bde789dd4d2c
SentinelOne Macma 2021ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2fb2a011-a35a-403a-a86b-d5489b1fa5c6
ESET DazzleSpy Jan 2022 · Objective-See MacMa Nov 2021ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:S1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--38481000-2a88-4768-98a3-aab3c747a6d6
Symantec Daggerfly 2024ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3bd6c03b-3ae4-4061-a3ce-7a90a62a0e1e
ESET DazzleSpy Jan 2022ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44a77efc-9215-4e5a-a246-ac9669dc52a4
Objective-See MacMa Nov 2021ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f8c284a-faa2-4f58-be3b-e27f6ed84423
ESET DazzleSpy Jan 2022 · Objective-See MacMa Nov 2021ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64af40e2-5138-429c-9b24-2f5ba846d668
ESET DazzleSpy Jan 2022ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a076d46-bd2f-4572-b993-36b4c1fb25d3
ESET DazzleSpy Jan 2022ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78019dcb-e8d3-4c71-bad0-20f3e85968b2
ESET DazzleSpy Jan 2022 · Objective-See MacMa Nov 2021ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1123
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7aa65075-fd72-460e-bded-8f0f5620d515
Objective-See MacMa Nov 2021ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1555.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86fd8738-ab8f-4b80-8c8d-fc80df9e2c07
ESET DazzleSpy Jan 2022ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8a0f5351-66d4-410d-9427-ff58420fc173
ESET DazzleSpy Jan 2022ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8fbbe6cb-5b2b-433a-9193-7a3890fa3e95
ESET DazzleSpy Jan 2022ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95ac6b41-2594-48a0-8437-c7d93111ed66
ESET DazzleSpy Jan 2022ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a06533f5-02f9-4246-9315-0fa8df3465e0
ESET DazzleSpy Jan 2022ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a412040d-d8ed-48b4-979c-7cbc6f9ced1c
ESET DazzleSpy Jan 2022ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5a39593-27ad-44dc-99f9-fcadc6d464ed
SentinelOne MacMa Nov 2021 · Objective-See MacMa Nov 2021ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1685.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b63c1cf0-387d-404b-9250-d4a78e7b18d8
ESET DazzleSpy Jan 2022ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1059.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c08ebacd-b5e4-48c3-8ee6-389c635801da
ESET DazzleSpy Jan 2022 · Objective-See MacMa Nov 2021ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cac0eda3-7d8c-42e2-b397-8923cd05f0b8
ESET DazzleSpy Jan 2022ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1553.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc8fa1fa-6aff-45f7-a425-2f62bf729324
ESET DazzleSpy Jan 2022ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e132f8f8-c15d-4423-8794-8571d37a3998
ESET DazzleSpy Jan 2022 · Objective-See MacMa Nov 2021ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f04dbb1e-bf75-4eee-9222-374c704bc07b
ESET DazzleSpy Jan 2022ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f16f6118-810f-4e08-9178-001156c95b53
ESET DazzleSpy Jan 2022ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f83d3cd6-f54d-4016-874f-eb638c193402
ESET DazzleSpy Jan 2022