KOPILUWAK
Software · ATTACK:enterprise:S1075
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1075",
"title": "KOPILUWAK",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1075",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--09fcc02f-f9d4-43fa-8609-5e5e186b7103",
"external_id": "S1075",
"domain": "enterprise",
"created": "2023-05-17T18:49:25.528Z",
"modified": "2025-04-16T20:37:54.797Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Mandiant Suspected Turla Campaign February 2023",
"url": "https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"
}
]
}Explicit source assertions (15)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1075 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--46b38010-b34e-435e-8573-094d6186c7b2
Mandiant Suspected Turla Campaign February 2023ATTACK:enterprise:S1075 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f99a9ac-ccd8-4c9b-9893-0703ba60543c
Mandiant Suspected Turla Campaign February 2023ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S1075
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54b38c51-b6b3-4d8a-9e6f-f257a3543939
Mandiant Suspected Turla Campaign February 2023ATTACK:enterprise:S1075 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63cefb36-bc55-4536-b7f9-c80f9e3f69b3
Mandiant Suspected Turla Campaign February 2023ATTACK:enterprise:S1075 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e7479b9-57c6-4c40-898b-3c590e93d6f1
Mandiant Suspected Turla Campaign February 2023ATTACK:enterprise:S1075 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--92bea968-016f-4aa7-b58c-8fcc981d9601
Mandiant Suspected Turla Campaign February 2023ATTACK:enterprise:S1075 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a5931b14-3087-4fc5-8167-498fc1af23f1
Mandiant Suspected Turla Campaign February 2023ATTACK:enterprise:S1075 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b3bc70ea-4f9e-4933-81e7-eb8b19f89a3b
Mandiant Suspected Turla Campaign February 2023ATTACK:enterprise:S1075 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c73f6319-ad09-4fb5-bb2f-18fd73bfdc5d
Mandiant Suspected Turla Campaign February 2023ATTACK:enterprise:S1075 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--da37b8c0-7006-43f9-aebb-44ae51a54dd0
Mandiant Suspected Turla Campaign February 2023ATTACK:enterprise:C0026 → uses → ATTACK:enterprise:S1075
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc71c59d-1c71-480a-97de-972248489aa4
Mandiant Suspected Turla Campaign February 2023ATTACK:enterprise:S1075 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec4231fc-c081-4060-80fb-05f390e5f24c
Mandiant Suspected Turla Campaign February 2023ATTACK:enterprise:S1075 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ef651fd2-97e7-4471-a609-41f46003cf11
Mandiant Suspected Turla Campaign February 2023ATTACK:enterprise:S1075 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f3f85cfd-557c-45c1-82ae-a9e349c8714c
Mandiant Suspected Turla Campaign February 2023ATTACK:enterprise:S1075 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f778e7e2-6119-4417-9f30-dfce65f6afe9
Mandiant Suspected Turla Campaign February 2023