Skip to content

Exfiltration Over C2 Channel

Technique · ATTACK:enterprise:T1041

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1041",
  "title": "Exfiltration Over C2 Channel",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1041",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--92d7da27-2d91-488e-a00c-059dc162766d",
  "external_id": "T1041",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:41.804Z",
  "modified": "2026-09-11T19:45:01.540Z",
  "version": "2.4",
  "aliases": [

  ],
  "tactics": [
    "exfiltration"
  ],
  "source_references": [
    {
      "source_name": "C2 FRAMEWORKS",
      "url": "https://www.redfoxsec.com/blog/introduction-to-c2-frameworks-how-attackers-control-compromised-systems"
    }
  ]
}

Explicit source assertions (213)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1172 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0116fbf2-4402-41af-bc5b-216e0e27c2db

ESET OilRig Downloaders DEC 2023

ATTACK:enterprise:S0459 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03341b9d-6848-4430-a868-b2bc61b357ba

Unit 42 MechaFlounder March 2019

ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--036d0469-5302-48c9-b957-ae52cee49861

Splunk LAMEHUG SEP 2025 · Nov AI Threat Tracker

ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03f69381-89e2-411a-8302-323c8a1bddfa

Talos PoetRAT October 2020

ATTACK:enterprise:S0445 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06317104-8397-453e-bef8-aa3269360ffc

FOX-IT May 2016 Mofang

ATTACK:enterprise:S1019 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08482fa2-6db3-4c82-8ca0-9d666454f2c6

ClearSky Siamesekitten August 2021

ATTACK:enterprise:S1210 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0977de2b-86f0-4c40-bd6f-9c54ad1a56c0

Cisco LotusBlossom 2025

ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c6329d8-4f00-4b3b-aa82-3bc2e9f14766

CISA MAR SLOTHFULMEDIA October 2020

ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e08fbc4-2fe5-4761-8f70-3dc74af48a57

PaloAlto StrelaStealer 2024 · DCSO StrelaStealer 2022 · Fortgale StrelaStealer 2023 · IBM StrelaStealer 2024

ATTACK:enterprise:S1017 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f483f1d-cd24-4446-8725-8af01fcd089c

Palo Alto Unit 42 OutSteel SaintBot February 2022

ATTACK:enterprise:S1246 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13953007-34e2-44e9-96af-53bed8f4413c

Socket BeaverTail XORIndex HexEval Contagious Interview July 2025 · PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023 · PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024

ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13ef6179-f624-4a3f-8095-a86609e31828

CheckPoint Bandook Nov 2020

ATTACK:enterprise:S9015 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--152e4b86-e51c-4470-84ff-5b6985b1c660

CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025 · CISA BRICKSTORM UNC5221 AR25-338A February 2026 · Picus Security BRICKSTORM UNC5221 October 2025 · Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024 · NVISO BRICKSTORM April 2025 · Resecurity UNC5221 BRICKSTORM F5 Big-IP October 2025 · Google BRICKSTORM September 2025

ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1678d731-c556-4968-aab1-ae745015308f

Carbon Black HotCroissant April 2020

ATTACK:enterprise:S1021 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--185bd112-5e1f-4059-9e42-b8b80874e8f2

Zscaler Lyceum DnsSystem June 2022

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18e170d7-ff3f-450b-9366-cea23216b60e

ESET Machete July 2019

ATTACK:enterprise:S9052 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19c9e7ee-69eb-4c1f-82de-727a5e37bcb8

CheckPoint_NimbusManticore_May2026

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d02066a-a26b-46fe-a9d6-731c8d8b0566

Mandiant VMware vSphere JUL 2025

ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d11c326-7640-4ddd-b5fe-c8eaf4097c20

Google EXOTIC LILY March 2022

ATTACK:enterprise:S0584 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d17e8d5-7a65-4d67-bfec-0ef7cad974d9

CISA AppleJeus Feb 2021

ATTACK:enterprise:S1090 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fec545d-436a-4b70-8ab8-87d217956b8f

MoustachedBouncer ESET August 2023

ATTACK:enterprise:S1188 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20411ea5-3d8e-4c97-a04d-418e2798eb5c

Cisco ArcaneDoor 2024

ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--213ea969-5e60-4128-9794-a09fb5f5eb5e

Check Point Warzone Feb 2020

ATTACK:enterprise:S0678 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21900cf5-72e2-4661-b137-0753710b4f9d

McAfee Lazarus Nov 2020

ATTACK:enterprise:S1042 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2211dd80-6ab2-4d3b-90fd-3ae19e75b64f

Mandiant UNC3890 Aug 2022

ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--246b5a38-8569-4145-af9a-0078f398e1d1

ZScaler Squirrelwaffle Sep 2021

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28d81681-8dcf-45ee-a5e6-378327ce93ce

Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29818fd0-e6df-4871-b025-938c77978544

ESET Telebots Dec 2016

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ad83456-5794-44d5-bfd1-3c51b2925c01

NCC Group Chimera January 2021

ATTACK:enterprise:C0038 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b07bb81-4843-423c-a29c-251169a845ce

CISA Iran Albanian Attacks September 2022

ATTACK:enterprise:S0661 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c93a27a-c6f0-46b9-857b-b746e2204670

MSTIC FoggyWeb September 2021

ATTACK:enterprise:S0484 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30c0f7aa-473d-42c3-81ff-f39c6f21ee52

Prevx Carberp March 2011 · Trusteer Carberp October 2010

ATTACK:enterprise:S0083 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--314aca1d-01a5-4549-b274-ba1112c3ca51

Cylance Dust Storm

ATTACK:enterprise:S1142 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3199779f-80be-44fa-8f21-9623e8473381

ESET Turla Lunar toolset May 2024

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--344bbf55-0316-49d0-a5ab-c5f79d218908

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34503727-d78b-4e67-b944-83546cc473e2

University of Birmingham C2

ATTACK:enterprise:S0491 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--354fe9c0-2b9b-43f9-98a0-ae0ee1515d4d

Talos Promethium June 2020 · Bitdefender StrongPity June 2020

ATTACK:enterprise:S0034 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3565539f-7ebf-4288-8422-5212c774821b

ATTACK:enterprise:C0046 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36975329-2167-4458-8470-e4a02330828a

CCCS ArcaneDoor 2024 · Cisco ArcaneDoor 2024

ATTACK:enterprise:S1185 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3757c1fd-7e60-4762-9f8b-823658d4e466

Huntress LightSpy macOS 2024

ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--380743e5-616c-4524-96e6-d545e5b653ea

Cybereason Soft Cell June 2019

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--382ab873-523f-4455-b3c5-74d81b4fc57b

Zscaler Higaisa 2020

ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--399b8688-1fe9-4fa6-a984-7c01f9319a38

trendmicro xcsset xcode project 2020 · Microsoft March 2025 XCSSET

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39d1a7ed-2388-4611-9886-915a3604c300

Talos Frankenstein June 2019 · Github PowerShell Empire

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3abe734c-7fd2-4da6-9b0a-420f9187165c

ATTACK:enterprise:S0395 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b6f4d0d-352f-4e0f-8a7d-5b843a21295a

ESET LightNeuron May 2019

ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c662aa7-0ee8-4e42-b0b9-de0dc2f02a57

ESET Grandoreiro April 2020

ATTACK:enterprise:S1201 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3cc0db99-8172-41e5-b386-3488bfb41f43

Zscaler Kimsuky TRANSLATEXT

ATTACK:enterprise:S1186 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d9c09bd-5b67-40dc-9144-1dc537933865

Cisco ArcaneDoor 2024

ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ed5a1c3-e7c8-4fb7-bfcf-401b29f5f47c

Cyberreason Anchor December 2019 · Bitdefender Trickbot VNC module Whitepaper 2021

ATTACK:enterprise:S1037 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--401c021f-60eb-49ae-8019-561c2785b12f

DHS CISA AA22-055A MuddyWater February 2022

ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4113ccd6-1134-4cef-bf5b-aca9a2364c82

Volexity InkySquid BLUELIGHT August 2021

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41c5b24c-6e33-43b4-ad7e-ebe7506d33b9

Kaspersky QakBot September 2021

ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42de94e7-86f3-41d9-9e01-45fff8be1451

TrendMicro Ursnif Mar 2015 · ProofPoint Ursnif Aug 2016 · FireEye Ursnif Nov 2017

ATTACK:enterprise:S1173 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43fbea18-9a70-4f7f-90c1-2103661185d7

Symantec Crambus OCT 2023

ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--463d9d77-abae-4848-aac4-bd4163318b8c

ESET MirrorFace DEC 2022

ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--46bc2bac-2b9f-4550-bd2f-9d62ef05b887

Palo Alto Ashen Lepus DEC 2025

ATTACK:enterprise:S0351 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48106cb0-a9c8-4c68-b90a-8d517078d189

Unit42 Cannon Nov 2018

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48118305-47d1-4803-9057-6be6b0d2187a

Ensilo Darkgate 2018

ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48d24989-916a-46ba-b5ea-b3db838a3ae0

Check Point APT35 CharmPower January 2022

ATTACK:enterprise:S0340 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49267afd-b71b-4dd0-a68a-128e61f7bdfd

Securelist Octopus Oct 2018

ATTACK:enterprise:S0085 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4971ab34-bfff-4384-b04f-6a7cd004ae2f

Cylance Dust Storm

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49f2c182-bd69-4874-9102-b5fd1acac59c

Mandiant Operation Ke3chang November 2014

ATTACK:enterprise:S1064 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b2de33f-c8cf-48dc-aa6d-524460bb3e24

HP SVCReady Jun 2022

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4c5f4c95-2eca-4f8d-8e7e-16f0bb323b07

FBI FLASH APT39 September 2020

ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e18e63e-acb5-48fc-8935-eb4416929745

ESET Casbaneiro Oct 2019

ATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f32ce54-46cf-4141-9700-9978056951db

Secureworks REvil September 2019

ATTACK:enterprise:S0079 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ffcf69a-c7ef-46dc-add7-9093e454a67e

Scarlet Mimic Jan 2016

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5201448e-f009-4c24-abb5-9382383dc42d

Binary Defense Emotes Wi-Fi Spreader · Trend Micro Emotet Jan 2019

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--520f5440-740f-4efe-850e-ea4db340aef1

Novetta Blockbuster Loaders · Novetta Blockbuster · McAfee Lazarus Resurfaces Feb 2018

ATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--52fb33e7-e53c-4d1f-b052-d3e373a64672

BlackBerry Amadey 2020

ATTACK:enterprise:S0493 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5409a62e-d298-4026-8829-550306e8e4a6

Trustwave GoldenSpy June 2020

ATTACK:enterprise:S0062 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5434447a-d954-4106-9657-ee62a4acf27b

Kaspersky MoleRATs April 2019

ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--546fc347-7844-4721-8ec4-dbf45e8ca1e7

Accenture SNAKEMACKEREL Nov 2018 · CISA Zebrocy Oct 2020

ATTACK:enterprise:S0375 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--551c4e98-3dfb-472b-8fa8-6a8961dfd418

Securelist Remexi Jan 2019

ATTACK:enterprise:S0600 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55af3bd0-d523-4394-99c6-182114c5cdc2

Intezer Doki July 20

ATTACK:enterprise:S1020 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--566913fd-3f30-4d33-b275-4a8c8f31a1c3

Kaspersky Lyceum October 2021

ATTACK:enterprise:S1156 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56b308f6-0ec9-42cd-8fc7-147c8ecd5c40

Talos Manjusaka 2022

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56db53fc-6279-48aa-9d70-f72df6d1664a

Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · EclecticIQ Mustang Panda PlugX · Sophos PlugX September 2022

ATTACK:enterprise:S9062 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64ac42ff-ac81-4617-a63a-5e70f6a709c6

CheckPoint_NimbusManticoreEurope_Sept2025

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.