Skip to content

Keylogging

Subtechnique · ATTACK:enterprise:T1056.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1056.001",
  "title": "Keylogging",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1056/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--09a60ea3-a8d1-4ae5-976e-5783248b72a4",
  "external_id": "T1056.001",
  "domain": "enterprise",
  "created": "2020-02-11T18:58:11.791Z",
  "modified": "2026-05-12T15:12:00.620Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "collection",
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "Talos Kimsuky Nov 2021",
      "url": "https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"
    },
    {
      "source_name": "Cisco Blog Legacy Device Attacks",
      "url": "https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954"
    },
    {
      "source_name": "Adventures of a Keystroke",
      "url": "http://opensecuritytraining.info/Keylogging_files/The%20Adventures%20of%20a%20Keystroke.pdf"
    }
  ]
}

Explicit source assertions (156)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--023ff141-8ed7-4132-85a0-494fe075236b

Unit 42 Magic Hound Feb 2017

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--034a2bc9-62a9-413f-b167-0b348928eba0

FoxIT Wocao December 2019

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--062874d1-8ca9-400f-8367-670b9c7c3280

FireEye Periscope March 2018

ATTACK:enterprise:S1012 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06e5b331-d382-4864-ab8c-083e006ede8a

Cybereason PowerLess February 2022

ATTACK:enterprise:S0643 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a37825f-2f48-4810-8d5e-a4421d1fe122

Proofpoint Operation Transparent Tribe March 2016

ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b3b2d98-213c-487f-b526-9336c2ed4555

Check Point Warzone Feb 2020 · Uptycs Warzone UAC Bypass November 2020

ATTACK:enterprise:S0038 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b823cda-4775-4690-9ea6-02bbaa3522a1

Symantec W32.Duqu

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b9a4cdc-8305-49ec-879f-6cfa35763af2

jRAT Symantec Aug 2018 · Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c2259d0-2d56-4bbc-bd98-e35ac991b6e8

Fortinet Metamorfo Feb 2020 · ESET Casbaneiro Oct 2019

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d328be7-85d2-4558-a4e3-cc5ce8bc7e2e

ESET Sednit Part 2 · Bitdefender APT28 Dec 2015

ATTACK:enterprise:S1146 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0dc3db64-17d3-4a1e-9f11-5e974d28db4f

ESET EvasivePanda 2023 · Symantec Daggerfly 2023

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ddcf163-015f-46a2-8de7-375712d92bae

Symantec Chafer February 2018 · FBI FLASH APT39 September 2020

ATTACK:enterprise:S0149 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e58b447-7b3e-404c-b8e5-003734c34574

Palo Alto MoonWind March 2017

ATTACK:enterprise:S0152 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0fec9b91-cd45-493b-b23e-abb3ed2513a0

PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:S0161 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11ed82c1-88af-4c23-860e-185505389288

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14dcdf1b-6788-429d-a7d0-910e86a2e6d6

Github PowerShell Empire

ATTACK:enterprise:S0339 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15d01a81-5d77-4373-81d0-8962e708ad20

Radware Micropsia July 2018

ATTACK:enterprise:S0113 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1879905d-a4f6-43a7-aafe-a7e436e5c559

ESET Operation Groundbait

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a49c7e5-32b0-4393-a464-1491b1ebc279

FireEye APT38 Oct 2018

ATTACK:enterprise:S0410 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b023598-278c-4a0f-b058-4d169b51f45a

Fysbis Palo Alto Analysis

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1bd467ff-6e94-40c5-ae4d-2ed7c62bc0d5

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d65c2d6-6f59-40e4-af56-83ad4d9efea8

Cofense RevengeRAT Feb 2019 · Cylance Shaheen Nov 2018

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f02b84e-b79e-402f-b1c1-3f5b5c8bc8c6

CISA AA24-038A PRC Critical Infrastructure February 2024

ATTACK:enterprise:S0167 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f99a883-e78f-423d-9837-2b5ebb14fe63

ClearSky Wilted Tulip July 2017 · CopyKittens Nov 2015

ATTACK:enterprise:G0130 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fbd56ed-e8fe-4601-b676-62e42370cbcc

Check Point Rocket Kitten

ATTACK:enterprise:S0381 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ff4d9b1-3a94-4bde-87cf-d4f19ac1ef50

Korean FSI TA505 2020

ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23e2dc58-4b8d-48d8-82fd-d051892a7d58

ESET RTM Feb 2017 · Unit42 Redaman January 2019

ATTACK:enterprise:S0454 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26339d57-98d9-4323-97e8-03642f82e245

Symantec Chafer Dec 2015

ATTACK:enterprise:S1249 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28636e59-9685-4b10-8364-11d8f38d6945

Socket HexEval BeaverTail Contagious Interview June 2025

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28bde4e9-cc84-4356-a872-b18fc3dd49ab

Securelist Dtrack

ATTACK:enterprise:S0434 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28d30695-5015-431d-baa6-9e75088a2a83

Imminent Unit42 Dec2019

ATTACK:enterprise:S0261 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29f2ee6a-682d-4812-b7d6-ff00cabf09dc

Symantec Catchamas April 2018

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2aa0dea4-ca6d-4095-8c20-9250308c3315

cobaltstrike manual · Amnesty Intl. Ocean Lotus February 2021 · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0033 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2be17426-9704-4913-981b-6d8fe4471147

Kaspersky NetTraveler

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d450e2f-25c9-49af-b83f-6c91029ed28a

Microsoft SIR Vol 19 · TrendMicro Pawn Storm Dec 2020 · DOJ GRU Indictment Jul 2018

ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ede8fe4-0a44-4c31-ba4c-d3282d57b4b8

Kaspersky BlindEagle AUG 2024 · GitHub QuasarRAT · Volexity Patchwork June 2018

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f5f2d31-739e-4dc5-b137-840401985244

Symantec Remsec IOCs · Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S1159 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30bbf24a-ee93-46e1-be89-d948f3248c17

Google Cloud APT41 2024

ATTACK:enterprise:S0072 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33caa1a2-8465-47b9-89c4-94f4e9a899c7

ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3450fcde-caba-4595-b28b-99f18b4a4b7a

BH Manul Aug 2016

ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--366c4cf9-7ea1-4751-9415-bcd3a1c52b27

Volexity InkySquid RokRAT August 2021 · Talos ROKRAT

ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37c94531-1e56-4640-93fd-e9fd65da4f80

Kaspersky Darkhotel

ATTACK:enterprise:S0019 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--385f57f4-87b6-4126-ab67-531e482ec9bc

Kaspersky Regin

ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38f209df-bb69-4971-bbd8-db5a54bbf217

CIRCL PlugX March 2013

ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39b38f3b-e878-4bce-967b-59035a528595

CISA MAR SLOTHFULMEDIA October 2020

ATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a0c8e81-6110-4cf3-a965-b700e00fd66c

Unit42 BabyShark Apr 2019

ATTACK:enterprise:S0257 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3dde25bf-03e8-4842-94cd-d596688c44d9

Unit 42 VERMIN Jan 2018

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e09a5ce-a6a0-4f03-8c23-a7ebb4dfd74c

Forcepoint Monsoon · PaloAlto Patchwork Mar 2018 · TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ef89472-470c-42c9-be01-155efe607b78

FireEye Poison Ivy · Symantec Darkmoon Aug 2005

ATTACK:enterprise:S0652 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42407045-4fd2-42b0-9686-ba6bbeafcaea

Kaspersky Ferocious Kitten Jun 2021

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--438f9fb0-bf82-4c72-8fdf-0dbc39bcf4fc

Trendmicro Evolving ThiefQuest 2020

ATTACK:enterprise:S1233 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4484ae6e-e546-4033-81c1-fe824f4f3ed3

Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025

ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--458eebea-e73b-4417-9ce0-11417f6b0289

PaloAlto CardinalRat Apr 2017

ATTACK:enterprise:S1235 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49421e3d-7c36-4f68-b7f3-c72442c3d44c

Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025

ATTACK:enterprise:S0375 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4df0f8e9-5956-4ccf-b603-00c32afee0d0

Securelist Remexi Jan 2019

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50001cfb-68b5-423c-9c18-6c26f6daad3f

ESET InvisiMole June 2020

ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5208e38a-0f5c-49cc-ad0e-860a94e21ff5

Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

ATTACK:enterprise:S0213 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--52278e18-f8b3-4bf1-a5d3-ac819ccfd301

FireEye APT37 Feb 2018 · Unit 42 Nokki Oct 2018

ATTACK:enterprise:S0253 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5375b22d-1da8-4178-b728-5b91b6917a5c

McAfee Gold Dragon

ATTACK:enterprise:S9013 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55b5ee19-4623-4c5d-9f8f-1c20a3263af6

Google UNC5221 Ivanti January 2025 · Picus Security UNC5221 Ivanti May 2025

ATTACK:enterprise:S0569 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56694ef7-3ce3-4d8a-914b-71a201dc5921

CheckPoint Volatile Cedar March 2015 · ClearSky Lebanese Cedar Jan 2021

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5680146f-fc33-4b3e-bbc0-66a7f74587d3

District Court of NY APT10 Indictment December 2018

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5903c147-70f5-45fe-a63c-418c61566422

Malwarebytes Kimsuky June 2021 · KISA Operation Muzabi

ATTACK:enterprise:S1207 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d7243c5-e35d-4547-bfff-bcacefe76122

Google XLoader 2017

ATTACK:enterprise:S0115 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5dcc3242-4a1e-4789-b70e-be6c66534e61

Kaspersky Transparent Tribe August 2020 · Proofpoint Operation Transparent Tribe March 2016 · Cisco Talos Transparent Tribe Education Campaign July 2022

ATTACK:enterprise:S0062 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e2e672a-02d4-4510-a629-942d44a558f1

ATTACK:enterprise:T1056.001 → subtechnique-of → ATTACK:enterprise:T1056

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5eac9edf-ec42-4ad9-846e-e36b533fd257

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5f8f4204-228c-49d3-8ec6-863b13038001

ATTACK:enterprise:S1050 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--612c9ce1-a4d6-45bb-b807-5808207c6c45

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61c71926-6802-44e8-9918-d2b3a8b19f94

FireEye Southeast Asia Threat Landscape March 2015 · Mandiant Advanced Persistent Threats

ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61ecf569-fd27-4c61-b1a9-a516fba16fac

TrendMicro Tonto Team October 2020

ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6249eaef-c1bd-4c5f-945c-ce6df3248147

ESET MirrorFace DEC 2022 · ITOCHU LODEINFO JAN 2024 · Trend Micro Earth Kasha NOV 2024

ATTACK:enterprise:S0337 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--626b1cb2-60a8-4077-913e-1ee4e788cec6

Unit 42 BadPatch Oct 2017

ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6494b2d2-8f8f-4e81-886c-dadd57df6edc

FSecure Lokibot November 2019

ATTACK:enterprise:S0625 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64eedc04-9dca-4e47-9465-a3d0b51d02f1

McAfee Cuba April 2021

ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64fc52d7-7e49-4fda-8193-8e38e8ac1811

Profero APT27 December 2020 · Trend Micro DRBControl February 2020

ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65f57f42-9784-4ca2-8192-bfa90ffc075f

Rapid7 KeyBoy Jun 2013

ATTACK:enterprise:S1245 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6672498e-4e40-4f1a-b469-fa7fc05ee68a

Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024 · ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024 · PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023

ATTACK:enterprise:S1122 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--668b180d-a227-4585-98ee-55dddd6eea92

ESET Security Mispadu Facebook Ads 2019 · Metabase Q Mispadu Trojan 2023 · SCILabs URSA/Mispadu Evolution 2023

ATTACK:enterprise:S0170 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--699ac754-3f3e-46de-9b2a-5ea450ef47fd

Palo Alto OilRig May 2016

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.