Skip to content

Software Packing

Subtechnique · ATTACK:enterprise:T1027.002

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1027.002",
  "title": "Software Packing",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1027/002",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--deb98323-e13f-4b0c-8d94-175379069062",
  "external_id": "T1027.002",
  "domain": "enterprise",
  "created": "2020-02-05T14:17:46.686Z",
  "modified": "2026-09-11T19:21:13.428Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "Awesome Executable Packing",
      "url": "https://github.com/dhondta/awesome-executable-packing"
    },
    {
      "source_name": "ESET FinFisher Jan 2018",
      "url": "https://www.welivesecurity.com/wp-content/uploads/2018/01/WP-FinFisher.pdf"
    }
  ]
}

Explicit source assertions (107)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03913b3d-2078-4ef1-b155-918cc9baf49c

SoučekESET_Gentlemen_Jun2026

ATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0bb1573c-f30f-449c-931e-c5de024e96f8

FireEye SUNSHUTTLE Mar 2021

ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c5577aa-30c5-47f5-83f3-34260860e2b6

Infoblox Lokibot January 2019

ATTACK:enterprise:S0625 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1161865b-7120-4ca3-a4dd-6d1ee0e02609

McAfee Cuba April 2021

ATTACK:enterprise:S0257 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--141d1c0d-2f56-4b56-8834-ca3dab22faf9

Unit 42 VERMIN Jan 2018

ATTACK:enterprise:S0020 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1820202b-0994-452a-93e7-ce21496d2ab4

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--191364fd-6564-4adc-a717-cfec6b13f438

ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b2eddbb-5a76-4488-9b65-b6ead43c2ddc

TrendMicro RaspberryRobin 2022

ATTACK:enterprise:S0565 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c8951ff-5de9-4842-b889-0c439aa76e8f

Symantec RAINDROP January 2021 · Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:S1196 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f9e644f-1ec9-4d2d-a475-3fca1bceaf20

ASEC Troll Stealer 2024 · S2W Troll Stealer 2024

ATTACK:enterprise:G0089 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2155f707-de4f-4ef1-9982-1af90392af5f

Cylance Shaheen Nov 2018

ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--229e8b6e-6c16-406a-8def-7588aaae4fcb

Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023 · Symantec Waterbug

ATTACK:enterprise:S0543 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25df53ed-4a07-4e71-8a1b-a84a2571e043

Unit42 Molerat Mar 2020

ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2909d2e7-ec59-4100-ad7a-f1197d419ae6

Cisco Operation Layover September 2021

ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--295f4cf0-1fb7-4d60-8e15-af8f301d0e1b

Red Canary NETWIRE January 2020

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29dcecc6-83ea-4e82-b368-b54812157b41

ESET Machete July 2019

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a04cfdd-a27a-498c-bbe2-8677a13811e0

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f507d82-1df4-4c9c-804a-2e6060944142

Trend Micro Daserf Nov 2017

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ff57c5f-523f-41f0-a6d4-676b939b561a

Rostovcev APT41 2021

ATTACK:enterprise:S0281 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30db098c-7e7b-42bc-b4dc-f2b54e7dde65

hexed osx.dok analysis 2019

ATTACK:enterprise:G0070 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31fb3ebe-3fc9-4257-b7d5-a1b12b54bbe3

Lookout Dark Caracal Jan 2018

ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33b2a8e7-658a-4c00-bd88-bcc36c980012

Palo Alto SharePoint Vulnerabilities JUL 2025

ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--347b7512-1e76-456f-9f04-0179d056ca9a

Malwarebytes KONNI Evolves Jan 2022

ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3570d377-9139-4221-9c4b-15147b78e8ad

INCIBE-CERT LockBit MAR 2024 · Sentinel Labs LockBit 3.0 JUL 2022

ATTACK:enterprise:S9046 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ae882d8-8c06-40e2-b953-8747bb720a8c

Claroty-IOCONTROL · Dragos-2026-Year-In-Review

ATTACK:enterprise:C0002 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3be6aadd-ea5f-4910-a8a0-d1019977dc43

McAfee Night Dragon

ATTACK:enterprise:C0005 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3da56da6-08fe-406b-bd0d-cd4f72dd67f4

ESET Operation Spalax Jan 2021

ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e36bc27-d1c1-4ccd-bf6d-2868843664c8

Cybereason Astaroth Feb 2019

ATTACK:enterprise:G1007 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f42c6bd-332d-40b0-9e5f-ead557d021c9

SentinelOne Aoqin Dragon June 2022

ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40c202ae-fd92-4506-b72a-5fb0e7bcf99a

Symantec Dragonfly · Secureworks Karagany July 2019

ATTACK:enterprise:G1019 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41d56dfa-e797-4bd1-826c-3e78d346f5ed

MoustachedBouncer ESET August 2023

ATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4636d747-9b81-4139-b86d-6e4edbc4111e

FinFisher Citation · Securelist BlackOasis Oct 2017

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4bc2e50e-0753-497f-9ec0-af270abe2af1

FireEye APT39 Jan 2019 · BitDefender Chafer May 2020

ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4cb25ac9-9eb9-47ee-b3f9-53c5a6365c46

Sogeti CERT ESEC Babuk March 2021 · McAfee Babuk February 2021 · Medium Babuk February 2021

ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--531ba99f-18d6-4ecd-a8ec-6d40550bf4af

PaloAlto StrelaStealer 2024

ATTACK:enterprise:S0601 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5344358d-8558-44b1-910d-cbb6d1aae714

Unit 42 Hildegard Malware

ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--552c3e40-dbb9-4675-bc31-5436a15253d8

NHS Digital Egregor Nov 2020 · Cyble Egregor Oct 2020

ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--573f3932-8435-4b4a-b138-d9c955495197

IBM TA505 April 2020

ATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--583335b0-7d65-4fbb-aa41-3bbbd08598cd

Cylance Dust Storm

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59b6b4e2-f2fe-4d81-b85c-1fe6c8102eba

CISA AA24-038A PRC Critical Infrastructure February 2024

ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ae4207c-95db-4a16-bfac-1d8daf29ba4a

S2 Grupo TrickBot June 2017

ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d256f6f-9501-4fec-9255-941b8c2fe35a

ESET RedLine Stealer November 2024

ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d4f48e5-48a1-4ade-ae59-b34824b8181f

Unit 42 Lucifer June 2020

ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d8315ce-3c76-4b78-8d6a-f0b7b101bcc0

Cybereason Soft Cell June 2019

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60d3d7d8-408e-4663-b081-69fe66303983

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60db2ece-4f5e-4c47-a7eb-fd8bcf7ddc49

Trend Micro TeamTNT

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61986499-5358-4edc-aab1-6a13ae0f7c06

FireEye APT38 Oct 2018

ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63ae56fe-04c2-41f5-a2be-c1880e67b490

IBM TA505 April 2020

ATTACK:enterprise:S0671 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63e47b19-5fe4-485d-9544-ab90a66edf6d

Kaspersky Tomiris Sep 2021

ATTACK:enterprise:S1210 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65a21b2c-a631-4a3e-982e-5086a0b8b944

Cisco LotusBlossom 2025

ATTACK:enterprise:S0614 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66c79e9f-7528-4a14-9525-866325b6abce

BlackBerry CostaRicto November 2020

ATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6801470e-9db4-4900-9bf0-aaef2774cdd3

Elastic Latrodectus May 2024

ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68067ea4-1d06-4c3d-bee2-2c59f43d41f4

Mcafee Clop Aug 2019 · Cybereason Clop Dec 2020

ATTACK:enterprise:S9018 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6901f3e3-6a46-4596-880d-341afff59aa1

Check Point Blind Eagle MAR 2025 · Palo Alto HeartCrypt DEC 2024

ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6af4810f-3abe-43eb-92b0-ee8fefc2a4b9

ESET Dukes October 2019

ATTACK:enterprise:S1018 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ebb24bf-8e82-4824-8959-b6f4348d2efd

Malwarebytes Saint Bot April 2021

ATTACK:enterprise:S0678 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7226ed2f-506e-4608-913f-953aca532413

McAfee Lazarus Nov 2020

ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74f14668-7111-4f96-a307-4aac00d91cf4

Carbon Black HotCroissant April 2020

ATTACK:enterprise:S0520 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75d297b3-bd2e-4815-9c28-649f7f1d4a62

US-CERT BLINDINGCAN Aug 2020

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78fc38f6-88ee-4f26-84e1-7532d95a4fbe

Talos Rocke August 2018 · Unit 42 Rocke January 2019 · Anomali Rocke March 2019

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79127e56-edbc-422b-9c32-72ce55f5ec04

ESET OceanLotus macOS April 2019

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--891a97f1-d3e2-45ff-a079-43dcad21a175

Securelist Dropping Elephant

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89210061-1ce3-4fdf-af84-2afee2062296

Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--895a3c63-26d1-4846-8b8d-8f6b2c266910

Unit42 Sofacy Dec 2018 · Accenture SNAKEMACKEREL Nov 2018

ATTACK:enterprise:S0053 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a48e56d-f837-4a5a-99b6-db0f60b541a0

Unit 42 SeaDuke 2015

ATTACK:enterprise:S1105 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--94883652-f338-47e5-95d9-b38060137fde

NCSC-NL COATHANGER Feb 2024

ATTACK:enterprise:S0398 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97784aa6-4d45-4698-9acd-918bb0502e32

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0085 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9873626b-74e8-456d-9e34-95a313daa27b

Cylance Dust Storm

ATTACK:enterprise:S0513 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9877098c-6643-49fb-8b7c-72ea44718cae

ESET Dukes October 2019

ATTACK:enterprise:S0132 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98aeed7c-e88b-4c5b-8e8e-21ee3534abe9

Cisco H1N1 Part 1

ATTACK:enterprise:C0025 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--998add45-ac31-4020-9179-5730f06ae9cd

Dragos Crashoverride 2018

ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ab85095-bac1-4b21-8e9d-e24c084af0d2

SentinelOne Valak June 2020

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a44728b1-9cb4-4307-8c4c-37b5acba536e

ATTACK:enterprise:S0694 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5347b54-6020-4e8e-acef-6428731cbd7d

ClearSky Lazarus Aug 2020

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a78cd480-758b-4fb5-a60a-ecb86d837012

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac88262c-e14d-4f52-a5df-bbddc6d5c1bc

FOX-IT May 2016 Mofang

ATTACK:enterprise:G0128 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ae5e7681-f93e-4b5f-80f9-8235a9015e7f

Check Point APT31 February 2021

ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--afe14ecc-81be-4724-aea6-cc1266425d1a

Talos Bisonal Mar 2020

ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b01660bb-1725-42f4-9419-495b8710e930

McAfee Lazarus Nov 2020 · McAfee Lazarus Jul 2020 · ClearSky Lazarus Aug 2020

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b50a1ecc-5c2e-472e-8320-6d708a4bd043

Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.