Skip to content

Masquerade File Type

Subtechnique · ATTACK:enterprise:T1036.008

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1036.008",
  "title": "Masquerade File Type",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1036/008",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--208884f1-7b83-4473-ac22-4e1cf6c41471",
  "external_id": "T1036.008",
  "domain": "enterprise",
  "created": "2023-03-08T22:40:06.918Z",
  "modified": "2026-05-12T15:12:00.622Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "polygot_icedID",
      "url": "https://unit42.paloaltonetworks.com/polyglot-file-icedid-payload"
    }
  ]
}

Explicit source assertions (25)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:C0025 → uses → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03927cb1-f80c-4b86-ac8d-f0963141eaa8

Dragos Crashoverride 2018

ATTACK:enterprise:T1036.008 → subtechnique-of → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--064f8984-e6cc-4334-a5ad-903a7af9bf4c

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--096287e3-0985-4678-95d1-0f6e5a22b7e6

ATTACK:enterprise:S9018 → uses → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1192da4e-d8cf-4486-a026-2b9d6051620c

Palo Alto HeartCrypt DEC 2024

ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--154d0730-b087-46ce-9ae2-b1a551ff4ab8

ESET Lazarus Jun 2020 · McAfee Lazarus Jul 2020

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1596b872-504f-41f2-b9e4-918c795f0050

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21b87986-57d0-45a7-9a42-f3e7803cf337

Secureworks BRONZE SILHOUETTE May 2023

ATTACK:enterprise:S1190 → uses → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27531ac2-9f44-4613-89e0-0fbfa30661b3

Microsoft KnuckleTouch 2024 · WithSecure Kapeka 2024

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2cc5f406-1bfd-427d-b8a0-dae6c93c8757

FBI BlackByte 2022

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ef7ec01-8704-4c94-9949-c3239167f93b

Group IB Ransomware September 2020 · Trend Micro Black Basta October 2022

ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a6a649a-5c23-4c2c-852a-d7df27abcf6c

RedCanary RaspberryRobin 2022

ATTACK:enterprise:S1238 → uses → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f87d711-8a4c-4e5c-ba73-de482dfeeb47

Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025

ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--84185ab0-a7f3-4629-b553-dc6e24b0ed14

file_upload_attacks_pt2

ATTACK:enterprise:S1074 → uses → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--84b29e13-6577-4db2-846c-a42caf068cb8

Mandiant Suspected Turla Campaign February 2023

ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--93ae2467-4192-4e69-a63a-00ca8cb055c2

Palo Alto Brute Ratel July 2022

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a1bed260-50a5-4a38-920a-3afa3a68b1a9

Microsoft Axios Compromise APR 2026

ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8840f03-6877-48ac-992c-d8ef6779675f

Netskope LummaStealer 2025

ATTACK:enterprise:S1053 → uses → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b1a27372-01f1-4abf-b586-949e9e796c32

Trend Micro AvosLocker Apr 2022

ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c5f5995d-2792-4571-95c4-3085b843d917

ESET MirrorFace 2025 · Trend Micro Earth Kasha Anel NOV 2024

ATTACK:enterprise:S9019 → uses → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb11ef49-78df-43e9-b2f2-a2914aa00c3f

Zscaler PureCrypter JUN 2022

ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d5c2492e-d619-4225-9a73-40d226770d73

ITOCHU LODEINFO JAN 2024

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e8781dcd-4e35-4106-a400-d2f4871b286d

EclecticIQ Mustang Panda PlugX · Sophos PlugX September 2022

ATTACK:enterprise:S1182 → uses → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ea9361a6-8c60-4a77-8fdc-931b38363fe5

Cisco MagicRAT 2022

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f376ba97-3fe5-4c51-aa2c-0c1e35fcfcda

Trend Micro MacOS Backdoor November 2020

ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f6a93744-aca6-47ff-84f3-e03dd417c0d4

DCSO StrelaStealer 2022 · IBM StrelaStealer 2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.