StrifeWater
Software · ATTACK:enterprise:S1034
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1034",
"title": "StrifeWater",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1034",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--fb78294a-7d7a-4d38-8ad0-92e67fddc9f0",
"external_id": "S1034",
"domain": "enterprise",
"created": "2022-08-15T16:31:56.856Z",
"modified": "2025-06-06T14:56:56.321Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Cybereason StrifeWater Feb 2022",
"url": "https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations"
}
]
}Explicit source assertions (16)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1034 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1218d239-d7ee-44ba-a88d-6b76cb16324e
Cybereason StrifeWater Feb 2022ATTACK:enterprise:S1034 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c13ff97-1581-4283-b9ec-f378f97f3440
Cybereason StrifeWater Feb 2022ATTACK:enterprise:S1034 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--222fdbe3-5833-4be9-aa45-b85087606dc1
Cybereason StrifeWater Feb 2022ATTACK:enterprise:S1034 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2315fa7f-2161-45c1-9f23-d47a96488465
Cybereason StrifeWater Feb 2022ATTACK:enterprise:S1034 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47a0dce9-2b56-4ebd-9dea-b76132c81753
Cybereason StrifeWater Feb 2022ATTACK:enterprise:G1009 → uses → ATTACK:enterprise:S1034
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--610421e6-aa2f-4756-817b-57458e4959ad
Cybereason StrifeWater Feb 2022ATTACK:enterprise:S1034 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e1ace47-17af-4291-b5f1-6b3c64c8ea6d
Cybereason StrifeWater Feb 2022ATTACK:enterprise:S1034 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--81ab128a-9c3f-4237-b6b1-7f2b681a8719
Cybereason StrifeWater Feb 2022ATTACK:enterprise:S1034 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8aeea825-de75-404b-bde3-806ba749f416
Cybereason StrifeWater Feb 2022ATTACK:enterprise:S1034 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b953ac7-23b8-4ddc-90a3-7c9d17fc4f54
Cybereason StrifeWater Feb 2022ATTACK:enterprise:S1034 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8dc0845d-c807-4e30-ac26-086f086b248f
Cybereason StrifeWater Feb 2022ATTACK:enterprise:S1034 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ba5068b-4e9e-445f-831b-c3d8ca444e2a
Cybereason StrifeWater Feb 2022ATTACK:enterprise:S1034 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bae19e73-3612-42a3-be35-5f5b2adfc5b7
Cybereason StrifeWater Feb 2022ATTACK:enterprise:S1034 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ef7d26b5-7d5f-463d-8279-82b45b6d01a4
Cybereason StrifeWater Feb 2022ATTACK:enterprise:S1034 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f12643cb-1ff8-49b9-a57e-38246a46c428
Cybereason StrifeWater Feb 2022ATTACK:enterprise:S1034 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f3ea1137-f71c-40af-befa-6141e61f0161
Cybereason StrifeWater Feb 2022