Caminho
Software · ATTACK:enterprise:S9016
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S9016",
"title": "Caminho",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S9016",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--97da6467-c9c5-4eb0-84d4-1234e937e534",
"external_id": "S9016",
"domain": "enterprise",
"created": "2026-04-16T17:48:45.413Z",
"modified": "2026-05-12T15:12:00.739Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "VMDetectLoader"
},
{
"source_name": "Zscaler BlindEagle DEC 2025",
"url": "https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"
}
]
}Explicit source assertions (7)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S9016 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1f12b17d-366e-44b6-bc1b-cfbb2b305616
Zscaler BlindEagle DEC 2025ATTACK:enterprise:S9016 → uses → ATTACK:enterprise:T1055.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--517962ee-edee-4193-a67a-d0c372950d66
Zscaler BlindEagle DEC 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:S9016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61b8e32a-4c38-41d9-a78d-904fce4a97e4
Zscaler BlindEagle DEC 2025ATTACK:enterprise:S9016 → uses → ATTACK:enterprise:T1027.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7470787a-e8bf-4ed0-92e8-9e2b4c685c09
Zscaler BlindEagle DEC 2025ATTACK:enterprise:S9016 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8a19d65a-f438-4b12-8b8f-c696d7c44559
Zscaler BlindEagle DEC 2025ATTACK:enterprise:S9016 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ae3003a7-3d6d-4dbc-8da9-65c947243cd5
Zscaler BlindEagle DEC 2025ATTACK:enterprise:S9016 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--de362038-1c20-4e62-a515-d251a20ce5e5
Zscaler BlindEagle DEC 2025