PingPull
Software · ATTACK:enterprise:S1031
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1031",
"title": "PingPull",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1031",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--3a0f6128-0a01-421d-8eca-e57d8671b1f1",
"external_id": "S1031",
"domain": "enterprise",
"created": "2022-08-09T18:21:24.739Z",
"modified": "2025-04-16T20:38:02.753Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Unit 42 PingPull Jun 2022",
"url": "https://unit42.paloaltonetworks.com/pingpull-gallium/"
}
]
}Explicit source assertions (16)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1031 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b2b567c-718c-485f-b187-2bf6c6bb0c76
Unit 42 PingPull Jun 2022ATTACK:enterprise:S1031 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--262fe71a-a2d5-4624-ac50-5a76c0dd862e
Unit 42 PingPull Jun 2022ATTACK:enterprise:S1031 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2ea75990-7349-4d67-8ec1-f4168792af23
Unit 42 PingPull Jun 2022ATTACK:enterprise:S1031 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39c0a771-5e52-4d08-910f-a1c9b3989f68
Unit 42 PingPull Jun 2022ATTACK:enterprise:S1031 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4e109125-e22b-4aaf-ac3c-9a0f5351b440
Unit 42 PingPull Jun 2022ATTACK:enterprise:S1031 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5647a587-99fc-497b-80b7-ed63ee6126a6
Unit 42 PingPull Jun 2022ATTACK:enterprise:S1031 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5cca2310-8771-48d9-9db8-b7a7a2375960
Unit 42 PingPull Jun 2022ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S1031
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ee76354-a60b-4c20-b3d8-1adda813f792
Unit 42 PingPull Jun 2022ATTACK:enterprise:S1031 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ef73661-0bc8-47f5-bae6-2beb5342a68e
Unit 42 PingPull Jun 2022ATTACK:enterprise:S1031 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8e6e2f98-695a-462b-b9b1-c3d0c453e471
Unit 42 PingPull Jun 2022ATTACK:enterprise:S1031 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d8296bb-40a0-4a08-a01a-f6dd4409c6f1
Unit 42 PingPull Jun 2022ATTACK:enterprise:S1031 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a877e5c0-3fe6-40bb-bd02-ef4a9465aba3
Unit 42 PingPull Jun 2022ATTACK:enterprise:S1031 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc35f625-8da3-4d4d-a9bf-a600183d7230
Unit 42 PingPull Jun 2022ATTACK:enterprise:S1031 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d0a02e9b-9247-4bce-9070-649d7c908640
Unit 42 PingPull Jun 2022ATTACK:enterprise:S1031 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f72dda85-719d-4e6f-bac8-2589934ae6dd
Unit 42 PingPull Jun 2022ATTACK:enterprise:S1031 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ffe85478-e3ed-4856-b4ae-03a7b693e381
Unit 42 PingPull Jun 2022