Skip to content

Binary Padding

Subtechnique · ATTACK:enterprise:T1027.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1027.001",
  "title": "Binary Padding",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1027/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--5bfccc3f-2326-4112-86cc-c1ece9d8a2b5",
  "external_id": "T1027.001",
  "domain": "enterprise",
  "created": "2020-02-05T14:04:25.865Z",
  "modified": "2026-09-11T20:00:19.155Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "ESET OceanLotus",
      "url": "https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/"
    },
    {
      "source_name": "Securelist Malware Tricks April 2017",
      "url": "https://securelist.com/old-malware-tricks-to-bypass-detection-in-the-age-of-big-data/78010/"
    },
    {
      "source_name": "VirusTotal FAQ",
      "url": "https://www.virustotal.com/en/faq/"
    }
  ]
}

Explicit source assertions (32)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0586 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a4e5f93-6efa-4490-b7fb-21a47a15612b

CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--136b197b-4900-4e6e-a16f-0b2cf96fd77c

emotet_trendmicro_mar2023

ATTACK:enterprise:S0528 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21a03de2-8f56-4d49-acd5-531b0075df26

Securelist Brazilian Banking Malware July 2020

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--232c3c4a-8af5-404d-9b72-ac07b81c1b0e

Group IB Ransomware September 2020 · Trend Micro Qakbot May 2020

ATTACK:enterprise:S0433 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23b5fd51-bb47-4811-8a38-c768c8fa6b0e

Carbon Black HotCroissant April 2020

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41bbe151-0ebe-4610-85d2-ba565e299d23

Proofpoint Leviathan Oct 2017

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43b702d2-0a17-4394-8dff-40a22b2c753f

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--455b15b7-bd32-48dd-a15f-3b9e4f8af928

QuorumCyber_Vidar_March2023

ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ab65410-25e5-4eef-8a38-06630aa4386b

ESET Grandoreiro April 2020

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73af9ac3-d637-4b1f-9995-e45cd8cc067d

SentinelOne NobleBaron June 2021

ATTACK:enterprise:S9016 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7470787a-e8bf-4ed0-92e8-9e2b4c685c09

Zscaler BlindEagle DEC 2025

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77059c7e-2f9f-4b64-8e91-292f81e186ba

Securonix Kimsuky February 2025

ATTACK:enterprise:G0002 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83cfa11e-f221-4dc4-b184-943c2c7f4562

ATTACK:enterprise:S0614 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a8fa25a-8cc6-4bd1-a97a-a0d9df9c1507

BlackBerry CostaRicto November 2020

ATTACK:enterprise:S1185 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8dcfe9ca-19df-481f-bccb-b9c8fc5293af

Huntress LightSpy macOS 2024

ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--930e0ad7-c430-41d1-bea2-5d08cd2ffa3d

Talos Bisonal Mar 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--971d0828-7244-4278-adc5-dc480d57ba5b

Zscaler Higaisa 2020

ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97d77da2-9e26-4168-b14c-9d26093aa5be

Symantec Orangeworm April 2018

ATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a89ce82a-b4f6-4055-bed3-16c2eeb984a5

Elastic Latrodectus May 2024

ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abea6903-7e77-456d-acb6-22f6a7af8087

Eset PlugX Korplug Mustang Panda March 2022

ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--adee6cd0-9331-435d-8b2b-690b65729e40

Zscaler · Unit42 Chinese VSCode 06 September 2024

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be0b4e47-a6af-43f1-9f7c-b15cffedc290

Check Point Black Basta October 2022

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6a4b8e6-eaf7-4b56-af0a-ba0fd070e97b

TrendMicro Patchwork Dec 2017

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc13f316-0f88-4ed1-8790-b13bc35be119

Secureworks BRONZE BUTLER Oct 2017 · Trend Micro Tick November 2019

ATTACK:enterprise:S0082 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d200ba08-8179-495e-a854-9b13be5c0f93

Emissary Trojan Feb 2016

ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d50f6966-5085-48e3-bf48-e6e252a0b6be

Cisco Akira Ransomware OCT 2024

ATTACK:enterprise:S9018 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d9632642-f42d-4f0b-af43-262223236c21

Palo Alto HeartCrypt DEC 2024

ATTACK:enterprise:S0244 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e4e36dcb-9c07-4c22-a182-61ac194a434f

Palo Alto Comnie

ATTACK:enterprise:T1027.001 → subtechnique-of → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ecdbe751-ef08-41fe-8c13-27ffaae30312

ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2456bbf-ac8a-43c7-b51a-b52e3376726f

Group IB GrimAgent July 2021

ATTACK:enterprise:S1086 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f54d4ca7-940d-4cf2-b02d-df9b5bfb643e

Morphisec Snip3 May 2021

ATTACK:enterprise:S0477 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb5fc8e3-2dd8-49de-bd9a-ee19c2f7ef7f

Cybereason Cobalt Kitty 2017

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.