Cuckoo Stealer
Software · ATTACK:enterprise:S1153
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1153",
"title": "Cuckoo Stealer",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1153",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--457a5e8d-d964-4130-bde3-c07bb41a093e",
"external_id": "S1153",
"domain": "enterprise",
"created": "2024-08-20T19:39:35.337Z",
"modified": "2024-10-28T16:22:59.359Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Kandji Cuckoo April 2024",
"url": "https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware"
},
{
"source_name": "SentinelOne Cuckoo Stealer May 2024",
"url": "https://www.sentinelone.com/blog/macos-cuckoo-stealer-ensuring-detection-and-defense-as-new-samples-rapidly-emerge/"
}
]
}Explicit source assertions (26)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--023e615d-0988-4387-a182-ffc15f68581b
Kandji Cuckoo April 2024 · SentinelOne Cuckoo Stealer May 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1564.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f54df67-bfb2-40d1-a427-50558f1b1171
Kandji Cuckoo April 2024 · SentinelOne Cuckoo Stealer May 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1614.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1285411e-83a3-456a-a211-56896dba2942
Kandji Cuckoo April 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1336d5a0-f7b3-4d5c-a89b-afdbf1b5e3a8
Kandji Cuckoo April 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e272852-4033-4e88-8f0a-b957c1a6b74c
Kandji Cuckoo April 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1569.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2a99d32c-3f9c-4817-8103-87c7b0b60bcb
Kandji Cuckoo April 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2cfb6d2b-5a32-4ff9-9eb8-83a051eaff0d
Kandji Cuckoo April 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1647
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3901752d-473d-49da-9139-3c1e0b8091d2
Kandji Cuckoo April 2024 · SentinelOne Cuckoo Stealer May 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57733df2-7d2d-470a-afbb-8f48b7c53821
Kandji Cuckoo April 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--58643a55-d526-4536-935c-5c1b5c1d9b20
Kandji Cuckoo April 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--59984ff6-8907-4f70-b3a7-47d44541e88c
Kandji Cuckoo April 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d3f0b01-04e0-43d0-9fa5-7d2dd2d3910f
Kandji Cuckoo April 2024 · SentinelOne Cuckoo Stealer May 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1027.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--60c3e09e-f620-433f-899f-a5103a39c28c
Kandji Cuckoo April 2024 · SentinelOne Cuckoo Stealer May 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64eeba9b-c972-4671-bb08-fca6d2445b8a
Kandji Cuckoo April 2024 · SentinelOne Cuckoo Stealer May 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d148641-2f9b-42af-ab5b-eee715ff14f6
Kandji Cuckoo April 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7351ee6a-b054-41ab-8485-6875924ac129
Kandji Cuckoo April 2024 · SentinelOne Cuckoo Stealer May 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83e254ac-4b23-4df7-a8b0-2df2291efcb6
Kandji Cuckoo April 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1059.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--841194b6-a8cd-48e6-ba73-b73e54ab44e5
Kandji Cuckoo April 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b720dc1e-50b1-44f6-8c3e-2c6f78ef3497
Kandji Cuckoo April 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1553.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8420a85-8724-450c-858e-217cdab58df8
Kandji Cuckoo April 2024 · SentinelOne Cuckoo Stealer May 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d264dcda-de7e-4196-9f7b-1408f2dda366
Kandji Cuckoo April 2024 · SentinelOne Cuckoo Stealer May 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1059.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d6021195-ac74-472e-99ef-ba75d42ce7bf
Kandji Cuckoo April 2024 · SentinelOne Cuckoo Stealer May 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1555.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e14893ce-24b2-41b0-9597-7775e2f71dc5
Kandji Cuckoo April 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eeb8635c-0297-470c-a66c-56f8e30c771e
Kandji Cuckoo April 2024 · SentinelOne Cuckoo Stealer May 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1056.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fb527052-60a5-42d9-98ba-9388b29e2ac1
Kandji Cuckoo April 2024ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1217
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fcb54b68-a92c-49c8-a021-c9e0ef1a402c
Kandji Cuckoo April 2024