Skip to content

System Owner/User Discovery

Technique · ATTACK:enterprise:T1033

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1033",
  "title": "System Owner/User Discovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1033",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--03d7999c-1f4c-42cc-8373-e7690d318104",
  "external_id": "T1033",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:35.733Z",
  "modified": "2026-05-12T15:12:00.620Z",
  "version": "1.6",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "show_ssh_users_cmd_cisco",
      "url": "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/sec-s1-cr-book/sec-cr-s5.html"
    },
    {
      "source_name": "US-CERT TA18-106A Network Infrastructure Devices 2018",
      "url": "https://us-cert.cisa.gov/ncas/alerts/TA18-106A"
    }
  ]
}

Explicit source assertions (251)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00ce5c68-cb85-46d1-a6ba-7b2b767b0f09

Secureworks Karagany July 2019

ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00e25bca-7df1-464e-94a4-cc13124e1d0c

Talos PoetRAT April 2020

ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01c6d850-03c2-4ed0-ba1d-cf2cc9062106

Cylance Shaheen Nov 2018

ATTACK:enterprise:S0694 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--022ba33a-16f4-40de-b0b2-4961870aa0c9

ClearSky Lazarus Aug 2020

ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03251067-ee3a-49e4-addc-86daaa8a3203

Cyberreason Anchor December 2019

ATTACK:enterprise:S0596 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--042001af-58f0-43c9-8747-5a0d0f7906f5

Kaspersky ShadowPad Aug 2017

ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--044576aa-2ec0-4f88-9cb9-ec6817dda514

ZScaler Squirrelwaffle Sep 2021

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05e02170-dc4f-4112-a54c-fde4d05632d7

ATTACK:enterprise:S9053 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0624c9a4-4c9f-448c-99f0-c22a99480158

CheckPoint_NimbusManticoreEurope_Sept2025

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--064cfeb5-9ddb-4dd2-ada4-cf9e65601dc5

CISA AA20-239A BeagleBoyz August 2020 · Microsoft Sapphire Sleet APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:S0590 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06711c3f-230b-4d44-9c88-4861c48d2716

Debian nbtscan Nov 2019 · SecTools nbtscan June 2003

ATTACK:enterprise:S0272 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06ef19c1-8490-42cc-b345-45f3aa29fc5f

TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09b8bc73-f318-4ff8-a7f1-2c1649df1186

Unit42 Bookworm Nov2015

ATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09fbfb74-459a-441b-9e07-96c146a26be3

Unit42 BabyShark Feb 2019

ATTACK:enterprise:S0514 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b126adc-3173-4751-978f-96b72913a346

CISA WellMess July 2020

ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b5338ac-c1ca-4296-b06c-44d3730c8557

Microsoft Moonstone Sleet 2024

ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0bf4ebc1-e4e4-4d56-8380-cb9601de353f

ESET DazzleSpy Jan 2022

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0daaaf08-6db8-4b57-8ba7-ff1cc32127b3

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:S0058 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0df8e968-716a-4de9-9669-862af62d6eb6

Baumgartner Naikon 2015

ATTACK:enterprise:S9063 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e6418d5-a827-4a88-adb2-af4f26b4502b

Mandiant_UNC1549_Nov2025

ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0efb0490-9935-4d51-8b2f-974e090bbc10

Volexity InkySquid BLUELIGHT August 2021

ATTACK:enterprise:S1146 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--118542b5-248a-475d-9eae-78efa872b399

Symantec Daggerfly 2023

ATTACK:enterprise:S1034 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1218d239-d7ee-44ba-a88d-6b76cb16324e

Cybereason StrifeWater Feb 2022

ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--128eeb8d-c492-4dbf-a423-0b68a4b53443

Google EXOTIC LILY March 2022

ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12e8b4b1-e6b4-4ced-b171-e9e2fb881e7b

SentinelOne ToolShell JUL 2025 · Microsoft SharePoint Exploit JUL 2025

ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1336d5a0-f7b3-4d5c-a89b-afdbf1b5e3a8

Kandji Cuckoo April 2024

ATTACK:enterprise:S0024 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--143dbc8a-0b00-4510-aacf-96437d87ea2b

Malwarebytes Dyreza November 2015

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--147cd553-fd25-46ea-83ed-594cdb82c440

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14e02371-ba11-459d-9662-188e85d3cf7c

Fortinet Diavol July 2021

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1547f28f-d6b7-43cc-8b89-0eaa524648b8

Kaspersky Turla Aug 2014

ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1567eaca-2b2e-44df-b447-87769738e00a

TrendMicro POWERSTATS V3 June 2019

ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17bace22-3930-4b7e-9fd1-1473da5496ff

Symantec FIN8 Jul 2023

ATTACK:enterprise:S0085 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17bc166c-7598-4297-9cc1-1ee9ef4182a2

Cylance Dust Storm

ATTACK:enterprise:S0652 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17c50546-6ffb-462e-b4ec-2d7cd0b00f55

Kaspersky Ferocious Kitten Jun 2021

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--199c92d9-dd54-4cb1-beef-3b6a97d12e82

Microsoft NICKEL December 2021

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19ff1c1a-cd11-454f-b905-16657eb866d6

Zscaler Havoc FEB 2023 · Fortinet Havoc MAR 2025

ATTACK:enterprise:S0256 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c360b2c-8004-4978-ba70-b0bb2257a791

ESET Turla Mosquito Jan 2018

ATTACK:enterprise:S0130 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d3296a5-9a15-4bd9-a294-ee014348136c

Forcepoint Monsoon

ATTACK:enterprise:S0344 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d82c2f3-0bca-49a0-b731-296a436eb003

Unit42 Azorult Nov 2018

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1deaad9b-3a33-421b-b13b-6dcad02707cf

Sekoia Raccoon2 2022 · Sekoia Raccoon1 2022 · S2W Racoon 2022

ATTACK:enterprise:S1059 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1dfbbbe3-c04d-4ad6-98bf-15a9cd84ab06

SentinelLabs Metador Technical Appendix Sept 2022

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f548074-df9e-4029-842b-7d774e2f1093

Mandiant FIN7 Apr 2022

ATTACK:enterprise:S1029 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f5efc33-a643-4f9b-aae9-6c59208ff790

MalwareBytes SideCopy Dec 2021

ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ffb7c73-5c51-48a3-85a0-b64111cccdd1

Rapid7 HAFNIUM Mar 2021

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--208b9e1d-3de9-4de8-b8d4-e3a7ff3c72ec

ATTACK:enterprise:S9062 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20b43c4b-c97d-4f5f-a004-07f38a9851e1

CheckPoint_NimbusManticoreEurope_Sept2025

ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22e70d45-8ca7-4a05-a22a-ffd5ffdd5f61

Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024 · 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

ATTACK:enterprise:S0401 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23f656c7-600f-46a7-8185-0edf45299bac

ANSSI Sandworm January 2021

ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--242af6ac-a8f9-44fd-ae3f-edd975b37b4c

Proofpoint RedLine Stealer March 2020 · Splunk RedLine Stealer June 2023 · Veriti RedLine Stealer MAAS April 2023

ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24e3810a-7d05-4ccc-9326-80a5ac72cd55

Splunk LAMEHUG SEP 2025

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25b8811b-3e73-40c7-b1fc-132eeb5a6f5e

Lunghi Iron Tiger Linux

ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--284843c3-18d0-4ddb-aab5-4588a6ec400e

SentinelOne WinterVivern 2023

ATTACK:enterprise:S0241 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28ffc627-936b-4572-93f6-0c46cb361dda

ATTACK:enterprise:S0381 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b8418de-6474-49e2-84f0-01ffe6c07a42

Korean FSI TA505 2020 · Proofpoint TA505 Mar 2018

ATTACK:enterprise:S0448 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d5c711d-dcd6-4d50-b91f-1fda5311eef5

McAfee Sharpshooter December 2018

ATTACK:enterprise:S0275 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ed969c0-be8f-43d1-8226-1009faefaa20

FireEye APT10 Sept 2018

ATTACK:enterprise:S0219 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f8d5603-0876-41dd-9fdb-ca9dc0ad6253

FireEye APT37 Feb 2018

ATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2fd0ebb0-6086-441d-b83c-e73e3f8ed69a

Elastic Latrodectus May 2024

ATTACK:enterprise:S0242 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2fededb7-e713-495c-a317-919c037434a8

SecureList SynAck Doppelgänging May 2018

ATTACK:enterprise:S0161 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31cd4eb1-f7b3-4030-b087-388d55faba03

ATTACK:enterprise:S0155 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32218bd0-d598-4560-9a70-ab7d5c92f986

FireEye APT32 May 2017

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3298bf92-55a2-49eb-aa5e-0530e8a51eeb

MalwareBytes LazyScripter Feb 2021 · Github Koadic

ATTACK:enterprise:S0680 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32a62862-3dc9-4082-8570-d01abe25e00b

Kaspersky WIRTE November 2021

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--331ebf73-af72-4121-815a-d10392ac75ab

Unit 42 C0d0so0 Jan 2016

ATTACK:enterprise:S0340 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--348f9f2e-c959-4485-9a0b-e95f6d4ceb72

Securelist Octopus Oct 2018

ATTACK:enterprise:S0610 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36c4252b-fc24-467e-b56b-56ba29bb4026

Check Point APT34 April 2021

ATTACK:enterprise:S0374 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--375f92a4-13b2-4640-b192-c34eb2b91c9c

CheckPoint SpeakUp Feb 2019

ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38f5765d-0e42-4e63-9411-185983c6ca21

Group IB GrimAgent July 2021

ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--395fbd2c-7827-49b3-8121-72d54181f0b1

PaloAlto CardinalRat Apr 2017

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39e6a7c0-5eb8-49fe-aec7-9ae9fe70723a

ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ccef052-7ac9-47b1-9be6-8c140f279941

FSecure Lokibot November 2019

ATTACK:enterprise:S9029 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3cef14da-0d49-4ee4-920b-ce3a0ddeccc7

Check Point Wirte NOV 2024

ATTACK:enterprise:G0051 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d602fec-cf94-4aa4-a4d9-cad286e6881f

FireEye FIN10 June 2017

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e370a6e-2a3c-4e56-aa57-fecab8d09709

DigiTrust Agent Tesla Jan 2017 · Fortinet Agent Tesla April 2018 · Malwarebytes Agent Tesla April 2020

ATTACK:enterprise:S0459 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ef224b5-2edf-41c1-916f-1d80a7dc4ada

Unit 42 MechaFlounder March 2019

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40032198-f003-4171-92a0-faf038f62a0b

FireEye APT32 April 2020 · ESET OceanLotus · Cybereason Cobalt Kitty 2017

ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--412c7c8b-4821-4f08-a3d2-2da034f8343f

Talos Konni May 2017

ATTACK:enterprise:S9046 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--415d2462-fe5c-44b1-9ffb-62b51c51b8e0

Claroty-IOCONTROL · Armis-IOCONTROL

ATTACK:enterprise:S0249 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41634cea-6236-4013-bda3-345bcba4f40f

McAfee Gold Dragon

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41c81917-ca17-4d7f-abdd-dcd408ad230d

FoxIT Wocao December 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.