CASTLETAP
Software · ATTACK:enterprise:S1224
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1224",
"title": "CASTLETAP",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1224",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--15c7bcdb-23e1-4ce3-81a7-b109b4d2a4f1",
"external_id": "S1224",
"domain": "enterprise",
"created": "2025-06-16T20:20:54.148Z",
"modified": "2025-06-16T20:21:39.051Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Mandiant Fortinet Zero Day",
"url": "https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"
}
]
}Explicit source assertions (9)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1224 → uses → ATTACK:enterprise:T1059.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--072e7d6e-2f40-4a50-a201-00448f2708b0
Mandiant Fortinet Zero DayATTACK:enterprise:S1224 → uses → ATTACK:enterprise:T1205.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1631ddf9-4cce-458f-870d-94dd2e83dbf2
Mandiant Fortinet Zero DayATTACK:enterprise:G1048 → uses → ATTACK:enterprise:S1224
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25e146af-eca7-4801-9b8e-6af031dd7963
Mandiant Fortinet Zero DayATTACK:enterprise:S1224 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2798addb-2787-4573-9380-9b2449dd3c94
Mandiant Fortinet Zero DayATTACK:enterprise:S1224 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--340825b1-a2db-4be1-943a-9b529842ae18
Mandiant Fortinet Zero DayATTACK:enterprise:S1224 → uses → ATTACK:enterprise:T1573.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--461489b5-effd-4ed1-8cdd-e73268ea9969
Mandiant Fortinet Zero DayATTACK:enterprise:S1224 → uses → ATTACK:enterprise:T1040
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d4e832b-28f4-4ee6-a173-dfae05df0eaf
Mandiant Fortinet Zero DayATTACK:enterprise:S1224 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f7137e7-6d6b-4550-a8fd-bc5f09a81157
Mandiant Fortinet Zero DayATTACK:enterprise:S1224 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2966853-e5ce-4c28-a36f-61947a45c694
Mandiant Fortinet Zero Day