Skip to content

Encrypted/Encoded File

Subtechnique · ATTACK:enterprise:T1027.013

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1027.013",
  "title": "Encrypted/Encoded File",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1027/013",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--0d91b3c0-5e50-47c3-949a-2a796f04d144",
  "external_id": "T1027.013",
  "domain": "enterprise",
  "created": "2024-03-29T12:38:17.135Z",
  "modified": "2026-09-11T19:42:10.060Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "File obfuscation",
      "url": "https://www.crowdstrike.com/blog/shlayer-malvertising-campaigns-still-using-flash-update-disguise/"
    },
    {
      "source_name": "SFX - Encrypted/Encoded File",
      "url": "https://www.crowdstrike.com/blog/self-extracting-archives-decoy-files-and-their-hidden-payloads/"
    }
  ]
}

Explicit source assertions (259)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1052 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0051db4d-9eb9-4b22-93a5-b6593176da75

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0059d5e7-7a7f-4a13-8730-00383bad2e98

HC3 Qilin Threat Profile JUN 2024

ATTACK:enterprise:S0678 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00f44cd5-9afc-472f-9743-251d243798a0

McAfee Lazarus Nov 2020

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0112eb25-7f6c-49cd-95c8-bf0d49f7c380

TrendMicro MacOS April 2018

ATTACK:enterprise:G0100 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01323439-5287-43cd-b7d9-750e606db602

Kaspersky Cloud Atlas December 2014

ATTACK:enterprise:S0136 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--016dc21c-ade9-43cc-9d88-a0c4c0891ccc

ESET Sednit USBStealer 2014

ATTACK:enterprise:S0082 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--021c3289-43bb-4787-9d7e-6ad17b3ce84f

Emissary Trojan Feb 2016 · Lotus Blossom Dec 2015

ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--023e615d-0988-4387-a182-ffc15f68581b

Kandji Cuckoo April 2024 · SentinelOne Cuckoo Stealer May 2024

ATTACK:enterprise:S0487 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02eba953-12a6-434a-bc67-2337864cf560

ESET ForSSHe December 2018

ATTACK:enterprise:S0565 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03cd94c9-73aa-4eed-b724-629d180e3002

Microsoft Deep Dive Solorigate January 2021 · Symantec RAINDROP January 2021

ATTACK:enterprise:S0433 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--081406d8-0486-4bfe-8d99-cd505f5cceb6

Carbon Black HotCroissant April 2020

ATTACK:enterprise:G0070 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c533013-a72e-4aef-bd19-8ea9ea415189

Lookout Dark Caracal Jan 2018

ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c81e49d-53be-4fba-9a07-ec2fe5501267

Symantec Elderwood Sept 2012

ATTACK:enterprise:T1027.013 → subtechnique-of → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0fee6145-185d-417f-a431-201a5b3e3259

ATTACK:enterprise:S1019 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10d22e64-01ff-4302-a615-ee23970d86ae

Accenture Lyceum Targets November 2021 · ClearSky Siamesekitten August 2021

ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--117ca63e-7fdb-41e6-9f4b-e19a0e889061

Bromium Ursnif Mar 2017 · ProofPoint Ursnif Aug 2016

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11d7c83e-7b34-447a-9775-fb9c373bdfcd

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:S9067 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12ac0bbc-25b8-4f37-a9b8-d9f41538ae84

Mandiant_UNC1549_Nov2025

ATTACK:enterprise:S1150 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12f96649-9314-4d5f-854b-6316737df1ed

CISA Iran Albanian Attacks September 2022 · Mandiant ROADSWEEP August 2022 · Microsoft Albanian Government Attacks September 2022

ATTACK:enterprise:S1233 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12fbb06a-3bf9-4f7c-8385-8240859c7932

Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025

ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1330d8a5-c8be-4579-8a91-4cfda860ea0a

Securelist Darkhotel Aug 2015 · Microsoft DUBNIUM July 2016

ATTACK:enterprise:C0045 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--153487c1-62aa-4465-8f8a-61674796df69

Oligo ShadowRay Campaign MAR 2024

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17087e76-4d84-443e-8fb1-0ec6498681db

Proofpoint Operation Transparent Tribe March 2016

ATTACK:enterprise:S1212 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17823071-2338-4707-9d96-c20b293c9896

Group-IB RansomHub FEB 2025

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18b6546b-90a1-4f70-8faf-505810bba9a6

Kaspersky ToddyCat June 2022 · Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b143de7-af2d-4991-9e2e-aa85a8d7d330

Accenture SNAKEMACKEREL Nov 2018 · Bitdefender APT28 Dec 2015 · Unit 42 Sofacy Feb 2018 · Palo Alto Sofacy 06-2018 · Talos Seduploader Oct 2017

ATTACK:enterprise:S0391 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--206ef2a2-192c-4739-a1bf-b5616dcacfed

FireEye HAWKBALL Jun 2019

ATTACK:enterprise:S0468 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2329d963-f01b-46bd-8868-99cf436a508a

Trend Micro Skidmap

ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23b77b77-e100-4ac2-93b9-b900a04844cd

Securelist Brazilian Banking Malware July 2020

ATTACK:enterprise:G0026 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23bd8e78-b20d-41bd-acfb-5ed356b327b2

PaloAlto DNS Requests May 2016

ATTACK:enterprise:S1051 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--249e7812-394b-44b0-adb7-d922139f7c38

ATTACK:enterprise:S0074 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--266a5edd-1425-4ab1-88bf-a0d7897699eb

ATTACK:enterprise:S0672 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2729dc4f-b327-4a13-a07c-39e8b1b39288

ATTACK:enterprise:S0170 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--284d622d-8b28-4569-97a7-936edced1b18

Palo Alto OilRig May 2016

ATTACK:enterprise:S0370 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28e637e9-480a-443b-82d7-13b7e2968733

Sophos SamSam Apr 2018 · Talos SamSam Jan 2018

ATTACK:enterprise:S0113 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--290a1ceb-68e1-42ae-be81-f474038aaa05

ESET Operation Groundbait

ATTACK:enterprise:S0228 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--297b069f-7d1b-4335-9363-c73bd823c322

fsecure NanHaiShu July 2016

ATTACK:enterprise:S1059 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a82c4cf-5c04-41b9-bfa4-c5e00d288eed

SentinelLabs Metador Technical Appendix Sept 2022

ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b3a7b95-f253-4b43-b3b4-a158357f3820

Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · Security Scorecard Medusa Ransomware January 2024

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c7d090e-09a1-4a45-baf4-b13790b483f6

Proofpoint Leviathan Oct 2017

ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e0eb5e4-37a3-435d-bdac-01f72b8cec4c

Cybereason Bazar July 2020 · NCC Group Team9 June 2020 · CrowdStrike Wizard Spider October 2020

ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f17ddd3-40e5-4784-9a5b-eecbfbdd1c15

Joint Cybersecurity Advisory LockBit 3.0 MAR 2023 · Sentinel Labs LockBit 3.0 JUL 2022

ATTACK:enterprise:S0451 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f96597c-70d9-41ba-b019-fb7510d3d732

ESET LoudMiner June 2019

ATTACK:enterprise:S9021 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30569541-2ced-428f-856b-06711471102c

Kaspersky LODEINFO OCT 2022

ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32e947a4-cbd3-45a8-ae74-7e51edf84d81

Cyble Sidewinder September 2020 · ATT Sidewinder January 2021 · Rewterz Sidewinder APT April 2020

ATTACK:enterprise:S1220 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35de5c62-00aa-4f6d-a0d8-399cda3bed36

Google Cloud Mandiant UNC3886 2024

ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--371958b3-0a01-48a4-b035-3a9d44b17388

Volexity InkySquid BLUELIGHT August 2021

ATTACK:enterprise:S0501 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37451dee-6837-46c5-a9e5-ff64f26f66d2

ESET PipeMon May 2020

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--374d1cee-7c9c-4b3b-8e75-8a5c4caf9d47

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1033 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--388b7632-476a-4194-be77-451ba13bcb10

Checkpoint MosesStaff Nov 2021

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38cf696a-f98d-4b32-a9f1-0183bd78b6d2

FBI FLASH APT39 September 2020

ATTACK:enterprise:S9023 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--393bc0b3-4c14-4e58-93d5-fc3daf68e90c

ESET HiddenFace 2024 · JPCERT MirrorFace JUL 2024

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--394d53b3-da1c-44b4-8abf-e1092f34c8be

Talos GravityRAT

ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a299dae-7ee2-4e5e-8be6-eb014f58205b

Medium Metamorfo Apr 2020 · ESET Casbaneiro Oct 2019

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3afd226c-934f-44fd-8194-9a6dee5cba59

TrendMicro macOS Dacls May 2020 · Novetta Blockbuster Loaders · Novetta Blockbuster RATs · Novetta Blockbuster · Qualys LolZarus · Lazarus APT January 2022 · McAfee Lazarus Resurfaces Feb 2018

ATTACK:enterprise:S1207 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b4e29f6-e040-431e-a6e9-a6a3f4e43ce5

ANY.RUN XLoader 2023 · Zscaler XLoader 2025

ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c91f0ec-8944-43d8-9b55-153a4c031c44

Palo Alto Unit 42 OutSteel SaintBot February 2022

ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f29b80a-0444-4664-8faa-58a39de9264e

FireEye APT33 Guardrail

ATTACK:enterprise:S1210 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40d3f067-ee42-4d2f-b43a-b3ac76a55b04

Symantec Bilbug 2022

ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41a691f8-4d5c-4678-9305-519dbb70ba46

DCSO StrelaStealer 2022

ATTACK:enterprise:C0002 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41c20ce1-3b9d-4293-a203-a4196d307c59

McAfee Night Dragon

ATTACK:enterprise:S0395 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4224d1f3-e634-4aa1-a6a5-bad5c1e81604

ESET LightNeuron May 2019

ATTACK:enterprise:S1014 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4272f467-c1b9-412e-9092-6340f4bdf847

SecureWorks August 2019

ATTACK:enterprise:S0267 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43908728-be5a-4bdf-a13e-8d373c1fc4fd

ESET GreyEnergy Oct 2018 · FireEye FELIXROOT July 2018

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43edea0b-efb8-41ab-bdda-f5aa62de439f

Kaspersky ProjectSauron Technical Analysis · Symantec Remsec IOCs

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44b10433-b9b4-46d1-825b-6fe4183dc9c0

ATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44e55496-b39d-45b7-96b9-1840d2492a14

SentinelOne SocGholish Infrastructure November 2022

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44f1b846-9e75-4f7b-8b6c-a0e68ccbb3ac

Gen Digital Kimsuky HTTPTroy October 2025 · Aryaka Kimsuky July 2025

ATTACK:enterprise:S9025 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45192057-c5ef-4f18-81c0-ca9b6546cc22

Trend Micro Earth Kasha NOV 2024

ATTACK:enterprise:S1159 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45258d6a-3717-4542-ac17-e7343fae0304

Google Cloud APT41 2024

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45803290-efab-46d3-873d-0c4f19f5e406

McAfee Honeybee

ATTACK:enterprise:S1221 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--462f46ec-2a7a-419a-8a62-06543e79d75f

Google Cloud Mandiant UNC3886 2024

ATTACK:enterprise:S0466 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4642135b-65d9-4b61-b25c-648c674c02dc

objective-see windtail2 jan 2019

ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4786019e-e2d4-4d31-94fa-b9ec19e65fa4

ESET Grandoreiro April 2020 · Securelist Brazilian Banking Malware July 2020

ATTACK:enterprise:S1015 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47fdcab0-5aca-4685-a2d8-8e743e3c4494

ClearSky Siamesekitten August 2021 · Kaspersky Lyceum October 2021

ATTACK:enterprise:S0520 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48e36609-a492-43a6-b0ab-c27ce106b0e6

US-CERT BLINDINGCAN Aug 2020

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49133c43-724f-41f8-a1de-2af251941311

ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49df789a-5d6c-4820-af9f-7c4484531680

Malwarebytes Konni Aug 2021

ATTACK:enterprise:S0131 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4afcb9c9-e490-446b-97b1-1c151974242f

Forcepoint Monsoon

ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4bb228b7-a456-426a-9be0-68a8a8a1b2d0

Forcepoint BITTER Pakistan Oct 2016

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.