Skip to content

Web Protocols

Subtechnique · ATTACK:enterprise:T1071.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1071.001",
  "title": "Web Protocols",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1071/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--df8b2a25-8bdf-4856-953c-a04372b1c161",
  "external_id": "T1071.001",
  "domain": "enterprise",
  "created": "2020-03-15T16:13:46.151Z",
  "modified": "2026-09-11T19:29:05.359Z",
  "version": "1.5",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [
    {
      "source_name": "CrowdStrike Putter Panda",
      "url": "http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf"
    },
    {
      "source_name": "University of Birmingham C2",
      "url": "https://arxiv.org/pdf/1408.1136"
    },
    {
      "source_name": "Brazking-Websockets",
      "url": "https://securityintelligence.com/posts/brazking-android-malware-upgraded-targeting-brazilian-banks/"
    }
  ]
}

Explicit source assertions (434)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1047 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--004cc00b-0a84-4783-aa4e-16b47f7465b2

DHS CISA AA22-055A MuddyWater February 2022

ATTACK:enterprise:S0275 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00d1f959-5469-4a9c-b33d-93f315719a6c

ESET MirrorFace 2025 · Trend Micro Earth Kasha Anel NOV 2024 · FireEye APT10 Sept 2018

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00f4c60b-36c4-4ec5-affd-38f89687d957

Unit42 RDAT July 2020

ATTACK:enterprise:S1108 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02321807-3d39-444d-b977-8737b3c2bacf

Mandiant Pulse Secure Zero-Day April 2021

ATTACK:enterprise:S0207 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02642f69-af18-42ba-a07e-ea44d3a311ea

Symantec Vasport May 2012

ATTACK:enterprise:S0502 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--029a75f4-62a8-4c9e-bdf2-ea2d8aed8900

NSA/FBI Drovorub August 2020

ATTACK:enterprise:S0144 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03c9b56e-f006-43b2-ac98-bcbe0c05e979

Palo Alto menuPass Feb 2017 · JPCERT ChChes Feb 2017

ATTACK:enterprise:S1246 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--040ab48a-edc1-4ab1-97ee-7cffb9b226d7

Socket BeaverTail XORIndex HexEval Contagious Interview July 2025 · PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023

ATTACK:enterprise:S1023 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--044afcd4-997f-4069-8600-a45bff6616c5

Microsoft POLONIUM June 2022

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--062b1f19-2afb-4bdc-908e-99594ff114cf

Kaspersky Turla · Kaspersky Turla Aug 2014

ATTACK:enterprise:S1026 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--062e9fe2-bfc1-49dc-85b2-e8356757a2e8

SentinelOne Aoqin Dragon June 2022

ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06eac254-32a7-4e32-97b2-c46f79b4adb3

Unit42 Xbash Sept 2018

ATTACK:enterprise:S0578 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--072ce102-e907-455c-a707-cded0bb29216

Guidepoint SUPERNOVA Dec 2020 · Unit42 SUPERNOVA Dec 2020

ATTACK:enterprise:S1119 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08474c5d-ddca-47b4-a916-d78fe16d7c71

Mandiant Cutting Edge Part 2 January 2024

ATTACK:enterprise:S0653 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a6b2a04-b01a-45a6-a0da-221dcdcf1c51

Checkpoint IndigoZebra July 2021

ATTACK:enterprise:G0075 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a975ec6-5754-4a42-aa0f-f468d67a2c91

Rancor Unit42 June 2018

ATTACK:enterprise:S1051 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b7f61c3-8600-4da7-bd6e-b304dd338d37

ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c225034-209b-4ea5-b311-65ee9e82f8fe

Unit 42 QUADAGENT July 2018

ATTACK:enterprise:G1013 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d116456-322a-470c-a219-6d313f801b89

SentinelLabs Metador Sept 2022

ATTACK:enterprise:S0599 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d3bf2be-d9e2-480d-b64a-fea7e0bac12c

Aqua Kinsing April 2020

ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d8f1592-92ba-4707-a814-465d37d808f3

Recorded Future RedDelta 2025

ATTACK:enterprise:G1042 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0dec56fa-b975-4575-ac3c-0afc48b579d8

RecordedFuture RedEcho 2021

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f76d408-be8a-478e-8a5a-aab1d1f96572

PaloAlto Patchwork Mar 2018

ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0fc4c1db-001c-4b17-82c9-c55319a26534

Forcepoint BITTER Pakistan Oct 2016 · Cisco Talos Bitter Bangladesh May 2022

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0fd9bb83-40f0-42ae-8e73-5d207434a757

McAfee Bankshot

ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10f21b9c-893d-46be-9bf2-50422d380d4f

Microsoft Moonstone Sleet 2024

ATTACK:enterprise:S0282 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11f12767-22ca-4f4a-a911-8211dc8ac478

objsee mac malware 2017

ATTACK:enterprise:S0042 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12cc7738-bb90-4e77-a96d-8e4f312e07d4

FireEye admin@338

ATTACK:enterprise:S9060 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14098193-5125-4aef-8684-2cddb8755b1e

Mandiant_UNC1549_Feb2024

ATTACK:enterprise:S0686 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--142307da-c957-49ff-985f-9dd503c8626b

Microsoft Actinium February 2022

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14b70990-48b0-482b-bd5a-3a99d9d9a653

FireEye APT34 Dec 2017 · FireEye APT34 Webinar Dec 2017

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--166326b3-6864-4667-aee9-4d7b24cc75d8

FireEye APT34 July 2019 · FireEye APT34 Webinar Dec 2017 · Unit42 OilRig Playbook 2023

ATTACK:enterprise:S0137 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--167e1e15-1fe1-4073-aac1-062557fdd79f

Microsoft SIR Vol 19 · FireEye APT28

ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--168f47ab-980f-4e10-91f4-ffd2acf09a7f

Medium Metamorfo Apr 2020 · ESET Casbaneiro Oct 2019

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16e57ad0-b460-41bd-bef0-5bf110d8db8f

ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1782abeb-8d28-42a1-8abe-c137f23b282c

NorthSec 2015 GData Uroburos Tools · ESET ComRAT May 2020 · CISA ComRAT Oct 2020

ATTACK:enterprise:S0520 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1909b21c-27c1-480b-a550-374af83c47dd

US-CERT BLINDINGCAN Aug 2020

ATTACK:enterprise:S0284 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19e0594c-c5b4-45c8-926e-ae884164d294

Talos Cobalt Group July 2018 · Security Intelligence More Eggs Aug 2019

ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19ef17d1-a6d5-499d-a551-3692a87eb109

Flashpoint Mini Shai-Hulud MAY 2026 · Trend Micro TeamPCP MAY 2026

ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1af945ec-f8bf-4aa9-9756-47e0d41690e3

Splunk LAMEHUG SEP 2025

ATTACK:enterprise:S0238 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1be07482-c5ed-42f9-8be1-5dbb44152461

McAfee GhostSecret

ATTACK:enterprise:S1223 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c9ab3fb-f19b-4bc1-8afd-309c39672749

Mandiant Fortinet Zero Day

ATTACK:enterprise:S0538 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ca96a8d-898b-4778-b3c3-3c80ccbb407f

ESET Crutch December 2020

ATTACK:enterprise:S1050 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1cadb8d8-d569-4d02-9e0c-f20d71e37cda

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d8442ee-ca18-4c12-a784-3094c85ae5e7

CAL_MuddyWater_Mar2026 · SecureListUbiedo_Tsundere_Nov2025

ATTACK:enterprise:G0071 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d90aad5-e0fb-4a8c-862a-71d3db99bae9

Symantec Orangeworm IOCs April 2018

ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1da4f275-e4a1-4a0c-b5a6-4b0be08aa45d

DCSO StrelaStealer 2022 · Fortgale StrelaStealer 2023 · IBM StrelaStealer 2024

ATTACK:enterprise:S0594 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e2a3e72-5d25-47fb-b0ff-e804073cc272

Trend Micro Muddy Water March 2021

ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e363612-b503-47b2-b697-daf75ef3740a

ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--210f5206-8763-48ac-a4c3-a08440892b5d

Kaspersky Carbanak

ATTACK:enterprise:S0159 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2121683c-ab01-4212-b2d2-af290dd8ed17

FireEye APT10 April 2017

ATTACK:enterprise:S0435 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--213423ab-05cf-4354-9cea-d536686cf21d

JPCert PLEAD Downloader June 2018 · TrendMicro BlackTech June 2017

ATTACK:enterprise:S0257 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--213b2924-9f77-4352-b92c-da83d00da353

Unit 42 VERMIN Jan 2018

ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21590c70-e34e-47be-a6e7-8f5b18eee229

Koi Glassworm InvisibleCode October 2025

ATTACK:enterprise:S0046 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22301618-a676-4d94-975a-2a56e5a7f919

F-Secure CozyDuke

ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--226403d7-7318-4f15-9cf6-83fd6684c33f

CERT-UA WinterVivern 2023 · SentinelOne WinterVivern 2023

ATTACK:enterprise:G0070 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23c6c48b-f602-43f9-9c23-d4e46fba9194

Lookout Dark Caracal Jan 2018

ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23d2aa8e-0b95-4714-8b76-b1a0735ffdeb

CISA MAR SLOTHFULMEDIA October 2020

ATTACK:enterprise:S1210 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--258071a5-0eb3-4905-b316-9b5258fc29af

Symantec Bilbug 2022

ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25e11828-0e27-4eb6-afb6-5c048ae9189b

Cyphort EvilBunny Dec 2014

ATTACK:enterprise:S1201 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--261f6370-34f3-493f-a395-17bc2100728a

Zscaler Kimsuky TRANSLATEXT

ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26de5bd2-2b58-421f-b1f9-ccf02b2c79ea

ESET EvasivePanda 2024

ATTACK:enterprise:S0020 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27561720-48cb-427c-892f-b31ce4d61d9e

FireEye Periscope March 2018

ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--277c6e7e-8c39-4c41-ac6f-f740bfb862b8

ESET Dukes October 2019

ATTACK:enterprise:S0087 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27a64a3a-62cb-4c1b-adfc-5070e2f1e744

Fidelis INOCNATION

ATTACK:enterprise:S0067 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27afb647-85a1-4e89-8762-c6c7d04bc1c5

CrowdStrike Putter Panda

ATTACK:enterprise:S0015 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27d4f0a9-7f8f-4d3d-b130-fd096bede2e9

Moran 2013 · Trend Micro IXESHE 2012

ATTACK:enterprise:S0062 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2892eada-7633-4428-80e0-0e965d5faf5c

ATTACK:enterprise:S0436 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2978353c-a652-4d42-a5da-4b937b09c8cf

JPCert BlackTech Malware September 2019 · JPCert TSCookie March 2018

ATTACK:enterprise:S0043 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b2cdb6b-c23c-4792-8cfb-8c4d9279a186

FireEye admin@338

ATTACK:enterprise:S0066 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d659138-90e5-4b67-8956-02120d99506f

CrowdStrike Putter Panda

ATTACK:enterprise:S0564 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d72a376-5bfb-4e6b-a79f-2f75f97de99e

Microsoft GALLIUM December 2019

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2dd15583-34cd-4b49-a6ba-4bd647b7ff27

DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022 · Unit 42 Magic Hound Feb 2017

ATTACK:enterprise:S0643 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e50e37b-29fd-48a7-8692-9f928ef9d36f

Proofpoint Operation Transparent Tribe March 2016

ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f3389a4-e0a6-4dc5-b5ff-38fd185e2821

Fortinet Diavol July 2021

ATTACK:enterprise:S9015 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f7ef5ad-df17-417b-8e63-1d55e161b282

CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025 · CISA BRICKSTORM UNC5221 AR25-338A February 2026 · Picus Security BRICKSTORM UNC5221 October 2025 · Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024 · NVISO BRICKSTORM April 2025 · Google BRICKSTORM September 2025

ATTACK:enterprise:S0430 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2fc3c031-8a39-4bc9-b3e1-4c5f6ac1e292

Chronicle Winnti for Linux May 2019

ATTACK:enterprise:S0019 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2fe9c7cf-44aa-495b-bde6-80cbfc4fbed9

Kaspersky Regin

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30496669-0d01-4855-b566-6d5bfd9c97c1

wardle evilquest partii · reed thiefquest ransomware analysis

ATTACK:enterprise:S0671 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30565d66-2743-4e39-81ce-bc861149ce1e

Kaspersky Tomiris Sep 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.