Skip to content

Raccoon Stealer

Software · ATTACK:enterprise:S1148

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S1148",
  "title": "Raccoon Stealer",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S1148",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175",
  "external_id": "S1148",
  "domain": "enterprise",
  "created": "2024-08-01T21:53:48.812Z",
  "modified": "2025-10-14T21:40:02.258Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Sekoia Raccoon1 2022",
      "url": "https://blog.sekoia.io/raccoon-stealer-v2-part-1-the-return-of-the-dead/"
    },
    {
      "source_name": "S2W Racoon 2022",
      "url": "https://medium.com/s2wblog/raccoon-stealer-is-back-with-a-new-version-5f436e04b20d"
    }
  ]
}

Explicit source assertions (25)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1deaad9b-3a33-421b-b13b-6dcad02707cf

Sekoia Raccoon2 2022 · Sekoia Raccoon1 2022 · S2W Racoon 2022

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--402acc79-8d1f-41ab-80ef-559d77b145d7

Sekoia Raccoon2 2022 · Sekoia Raccoon1 2022 · S2W Racoon 2022

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4071eb53-bd07-499d-88cc-f03425ea2e46

Sekoia Raccoon2 2022 · S2W Racoon 2022

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1124

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5779f61c-d06b-424d-92b9-3690e5d42a42

Sekoia Raccoon2 2022 · S2W Racoon 2022

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64b07cac-1aa5-4c86-ac63-7026ed1c855e

Sekoia Raccoon2 2022 · Sekoia Raccoon1 2022 · S2W Racoon 2022

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--688a4ea0-c9ff-4bb1-a6ab-fc565cea1461

Sekoia Raccoon2 2022 · S2W Racoon 2022

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72513bb1-7e36-415f-a6bd-4b1a908509ef

Sekoia Raccoon2 2022 · Sekoia Raccoon1 2022 · S2W Racoon 2022

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1213

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77cf946d-eb39-4f49-abd0-a64733ea9538

Sekoia Raccoon2 2022

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81abc87e-ce9f-4b03-af21-b1f35d0b64ec

Sekoia Raccoon2 2022

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88d26308-c00d-4394-8074-7d80d3deeea5

Sekoia Raccoon2 2022

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1027.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90397eb4-f5d6-406b-9419-3ab2aec578d4

Sekoia Raccoon2 2022 · Sekoia Raccoon1 2022

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1195

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--93d23383-024f-45c8-9de7-f571f18f7499

S2W Racoon 2022

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1614

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c74284d-dfb7-49c5-85a1-fa8e63de53ad

S2W Racoon 2022

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:S1148

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ddb8e61-9c8e-4fbe-a485-e440c14f42cd

Check Point Scattered Spider JUL 2025

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a69fa027-82b4-4c29-90b0-37fffe680d8a

Sekoia Raccoon2 2022 · Sekoia Raccoon1 2022 · S2W Racoon 2022

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6f8439f-bf5a-4e57-8ae5-758e5097a0ff

Sekoia Raccoon2 2022 · S2W Racoon 2022

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a9325bef-18be-4646-9e7b-5e7af4795f18

Sekoia Raccoon2 2022 · Sekoia Raccoon1 2022 · S2W Racoon 2022

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b7b96965-2ae8-412d-bd39-00c87dc0314b

Sekoia Raccoon1 2022

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bbdcf7d5-4a03-4654-b719-8c3456db9a12

Sekoia Raccoon2 2022 · Sekoia Raccoon1 2022

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9767024-ff9a-4c20-b29c-5270874f8cd1

Sekoia Raccoon2 2022 · Sekoia Raccoon1 2022

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d0460046-cd33-46b4-948e-1f46139eec6e

Sekoia Raccoon2 2022

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8c19b7a-71a0-4941-9244-f9784e5e99fc

Sekoia Raccoon2 2022

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de6e7fde-7407-4caf-acd0-cfa3aa458d04

Sekoia Raccoon1 2022 · S2W Racoon 2022

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e5b20ee8-7af4-41a4-ac76-622a55a37e13

Sekoia Raccoon2 2022 · S2W Racoon 2022

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee683bba-698d-4fde-be42-1aa7e3ed3211

Sekoia Raccoon2 2022 · S2W Racoon 2022

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.