Skip to content

System Network Configuration Discovery

Technique · ATTACK:enterprise:T1016

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1016",
  "title": "System Network Configuration Discovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1016",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--707399d6-ab3e-4963-9315-d9d3818cd6a0",
  "external_id": "T1016",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:27.342Z",
  "modified": "2026-05-12T15:12:00.641Z",
  "version": "1.7",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "Mandiant APT41 Global Intrusion ",
      "url": "https://www.mandiant.com/resources/apt41-initiates-global-intrusion-campaign-using-multiple-exploits"
    },
    {
      "source_name": "Trellix Rnasomhouse 2024",
      "url": "https://www.trellix.com/en-au/blogs/research/ransomhouse-am-see/"
    },
    {
      "source_name": "US-CERT-TA18-106A",
      "url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
    }
  ]
}

Explicit source assertions (294)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0569 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00038d0e-7fc7-41c3-9055-edb4d87ea912

CheckPoint Volatile Cedar March 2015

ATTACK:enterprise:S0667 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--012617bd-bdb5-434f-996c-bea7afe1b8a5

ESET Gelsemium June 2021

ATTACK:enterprise:S0101 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01e01c24-ba4c-41d7-8f30-8fca364dc2c6

ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01f4b583-4bd0-47eb-a108-c0bd7fd4d571

Kaspersky Lyceum October 2021

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02a353b7-7b15-4068-82eb-7385c1684021

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--036e996f-5767-4306-9dfa-7c22e797aecc

Avira Mustang Panda January 2020 · Unit42 Chinese VSCode 06 September 2024

ATTACK:enterprise:S0024 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03732f50-c46c-49f1-bd47-cc56bb96cf23

Malwarebytes Dyreza November 2015

ATTACK:enterprise:S0365 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--039364a9-2afd-4ae5-9df0-08d4e583674f

Talos Olympic Destroyer 2018

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03be081b-574e-4ffd-807a-99163b6a6fa2

MalwareBytes LazyScripter Feb 2021 · Github Koadic

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--04d06aaa-505c-473e-ae33-7ef5e560a7a7

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05381a55-01d2-4c75-9a2b-504eff1b606a

Zscaler Pikabot 2023

ATTACK:enterprise:S0098 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0649f7fd-3aa1-4646-a7a4-2334088c6c74

Palo Alto T9000 Feb 2016

ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06b7b9b4-7cc8-4d7f-af8c-20fe8b8610b0

Unit 42 Lucifer June 2020

ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--071f5618-aac7-45ca-9fb5-c863b5d6a179

CrowdStrike IceApple May 2022

ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07720e8d-fd8a-449c-ac32-484ccf989694

Volexity InkySquid BLUELIGHT August 2021

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07db5f41-fc53-47e6-ae7b-755a4acc9e62

Talos Frankenstein June 2019 · Github PowerShell Empire

ATTACK:enterprise:S0257 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0829e860-9ea0-43c9-8bfd-55b4236d67af

Unit 42 VERMIN Jan 2018

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--092b3643-670d-447c-b05d-f7a54a945412

ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0aafbc63-2021-4c99-b273-1241943fd959

PWC KeyBoys Feb 2017

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0bd2ee1a-6202-4ff5-9a42-4869a276a92c

FireEye APT34 Dec 2017

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0bea4f92-da4b-483c-81ba-c39b0c58368b

CISA Play Ransomware Advisory December 2023

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c6913d6-f4a4-49cc-8458-cd876c429865

Microsoft BlackByte 2023 · FBI BlackByte 2022

ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0db8a021-2f3a-41cc-abc6-d8723c7e802b

Volexity PowerDuke November 2016

ATTACK:enterprise:S1210 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f63bd24-081c-43be-ada2-8cc7a4307a1b

Cisco LotusBlossom 2025

ATTACK:enterprise:S0271 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--107713b7-97e8-4cd6-8671-b38f86e02ed0

US-CERT KEYMARBLE Aug 2018

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12798001-5af6-4b47-b17e-e98888c1482c

Cyberreason Anchor December 2019 · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0336 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14fe92e6-9a5e-4116-8316-e52f6270b02c

DigiTrust NanoCore Jan 2017

ATTACK:enterprise:S0583 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15e5a285-2177-462f-bd40-bc68347efcaf

CERT-FR PYSA April 2020

ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1884ba87-a1c8-496b-9517-abb379911166

Antiy CERT Ramsay April 2020

ATTACK:enterprise:S1085 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18da48c9-a1aa-4d13-b1b1-bd1a78e07c61

Bitdefender Sardonic Aug 2021

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18f3619c-c1e1-4b2c-b582-2cb5691f02e9

Talos GravityRAT

ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1993ee53-26a0-4cd1-8a93-5fd578c941fc

Unit 42 Playbook Dec 2017

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1aa94645-05e8-40ce-b8b7-c83a4e03d4e2

US-CERT TA18-074A

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b141c9e-a679-40c7-ad7b-ac40ac586471

FireEye admin@338

ATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1cc9d9cb-1671-44a3-916c-bf191490946c

Bitsight Latrodectus June 2024 · Elastic Latrodectus May 2024

ATTACK:enterprise:S0278 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e59381b-fcf5-43e1-b8d5-499db015b208

objsee mac malware 2017

ATTACK:enterprise:S0082 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ec53623-4050-498b-ba9e-f149d203036c

Emissary Trojan Feb 2016

ATTACK:enterprise:S0590 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f5655b0-7b7f-453c-9c2c-47a23fcc6222

Debian nbtscan Nov 2019 · SecTools nbtscan June 2003

ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fac9041-e22d-417b-8951-8ad63f62b6fa

Eset PlugX Korplug Mustang Panda March 2022 · DOJ Affidavit Search and Seizure PlugX December 2024

ATTACK:enterprise:S1020 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--205b4267-e86d-46a1-8aa6-61475cd90b80

Kaspersky Lyceum October 2021

ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--207dbd97-1a2d-4bf2-aa90-62748a83979e

Cisco LotusBlossom 2025

ATTACK:enterprise:G1009 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--209d5669-2e7e-4621-905a-f22ba07f06d6

Checkpoint MosesStaff Nov 2021

ATTACK:enterprise:S1018 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20b9b6a1-e00a-4e79-99eb-dae27d85344a

Malwarebytes Saint Bot April 2021

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22067fc3-6919-41b5-b506-4a00830af5c4

TrendMicro MacOS April 2018 · Trend Micro MacOS Backdoor November 2020

ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2251e15a-5b62-408d-b6a0-01aa8e2677b3

Talos Konni May 2017

ATTACK:enterprise:S0433 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24dd7ee4-83ed-4f54-808b-8b0e46797df4

Carbon Black HotCroissant April 2020

ATTACK:enterprise:S0201 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--264e85a3-1ddc-4b68-87fc-c2b96d6ec0e9

Microsoft PLATINUM April 2016

ATTACK:enterprise:S1050 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--269bab05-022c-4fb8-bdf3-1ec721ff994e

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:S1196 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27adb9c4-9121-4276-8862-881b023821e9

S2W Troll Stealer 2024

ATTACK:enterprise:S0346 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ab707bc-9e11-4b6e-858f-c1576f9fc3a0

McAfee Oceansalt Oct 2018

ATTACK:enterprise:S1143 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b31cfdc-efab-421a-bc37-ea9eaa156fc8

ESET Turla Lunar toolset May 2024

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2eae8ade-1ddb-41d4-82cc-572b1158c06c

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f61aca0-55a8-46cb-aa37-a1789fc07c40

Cybereason OperationCuckooBees May 2022

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2fc8879c-1763-4ed0-b1d8-67b4c3d49ed9

DigiTrust Agent Tesla Jan 2017 · SentinelLabs Agent Tesla Aug 2020

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30ea6fe2-2947-4d12-b959-5a59c9e8d812

ATTACK:enterprise:S1015 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--319ddafd-7ae5-4fd5-ae80-3c7456c3878f

ClearSky Siamesekitten August 2021

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--322703cc-c8f9-4046-8a61-e165a2d11bc7

Unit 42 C0d0so0 Jan 2016

ATTACK:enterprise:S0513 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32af5f8f-e219-4635-b8f1-d98f0913f4c0

ESET Dukes October 2019

ATTACK:enterprise:S0081 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--340d4ef7-816b-4758-994f-b913df78afd7

Accenture Dragonfish Jan 2018 · Lotus Blossom Jun 2015

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3438e84b-4e73-434a-a699-15289a09d64c

Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022

ATTACK:enterprise:S0274 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34cb97d2-b8ae-46e8-a8f7-caca4214820e

Securelist Calisto July 2018

ATTACK:enterprise:S0491 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35178b99-6830-4150-a094-691888655525

Talos Promethium June 2020

ATTACK:enterprise:S0572 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37fd810c-c64d-482b-98d5-5a19ce77f9f6

ClearSky Lebanese Cedar Jan 2021

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39897b0a-f48b-4d3b-8ba0-d6f8f26d00d4

ESET Okrum July 2019

ATTACK:enterprise:S0084 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39e856a1-4bab-474e-a6b2-3ce69249bc29

Cylance Dust Storm

ATTACK:enterprise:S0456 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a24f6ef-80e2-48b9-8f00-36ca4f59f191

CheckPoint Naikon May 2020

ATTACK:enterprise:S1156 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a89a2dc-d53f-47ee-98fd-8c52980d5113

Talos Manjusaka 2022

ATTACK:enterprise:S0270 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ab61135-89b5-4074-9251-40f41c7f739a

Unit 42 DarkHydrus July 2018

ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b81ee4f-c583-477f-b2e4-d1801da7bac8

ESET Dukes October 2019

ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3bd6c03b-3ae4-4061-a3ce-7a90a62a0e1e

ESET DazzleSpy Jan 2022

ATTACK:enterprise:S0228 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3bfef472-e4b0-41be-be6b-314400c079cb

Proofpoint Leviathan Oct 2017

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c52b081-7521-4b73-8603-e6d05496db0c

Symantec Trojan.Hydraq Jan 2010 · Symantec Hydraq Jan 2010

ATTACK:enterprise:S0113 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3caec960-fa9c-4b2f-80e4-6dd4471e26ba

ESET Operation Groundbait

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ee66a23-0783-4292-b4be-cc227932800c

Joint Cybersecurity Advisory Volt Typhoon June 2023

ATTACK:enterprise:S0244 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4053d6f5-e594-4b52-96a2-2b7c0fa7d332

Palo Alto Comnie

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41863df8-b6c3-40df-84bc-3db0ec4f0bc5

Kaspersky ToddyCat June 2022

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4189f5b4-4c57-452a-a3fb-da5988804feb

Novetta Blockbuster Loaders · Novetta Blockbuster

ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--429bf982-fdf7-4404-9544-2cc7942b5939

Lumen KVBotnet 2023

ATTACK:enterprise:S0205 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43c0d71b-d82e-45f0-89ce-acb94810c1c3

Symantec Naid June 2012

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--453679cf-e04c-4419-9b94-9a150092a04d

MSTIC NOBELIUM Mar 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.