Skip to content

Domain Account

Subtechnique · ATTACK:enterprise:T1087.002

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1087.002",
  "title": "Domain Account",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1087/002",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--21875073-b0ee-49e3-9077-1e2a885359af",
  "external_id": "T1087.002",
  "domain": "enterprise",
  "created": "2020-02-21T21:08:26.480Z",
  "modified": "2026-05-12T15:12:00.622Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "CrowdStrike StellarParticle January 2022",
      "url": "https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/"
    }
  ]
}

Explicit source assertions (64)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1159 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0136018a-db45-4517-9834-7261488bc3fe

Google Cloud APT41 2024

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09cc5150-b68e-45de-9172-5fec7623c9ac

CrowdStrike StellarParticle January 2022 · Secureworks IRON RITUAL Profile

ATTACK:enterprise:S0516 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0cf8d5da-a127-4b48-bbf9-e5a0376033b4

CISA SoreFang July 2016

ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14612b22-b271-4e93-8f66-d86ce8e10c29

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16510fcf-70a0-4da5-9b80-f4772abca436

Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022

ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1685aa0e-d1be-40ea-ade0-21ff64e0d372

NCC Group Team9 June 2020 · DFIR Ryuk's Return October 2020

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16c7058c-8fa5-4477-8332-9e76fcb38924

FireEye FIN6 April 2016

ATTACK:enterprise:S0488 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--182ae728-bd77-41ca-bd0d-dd2b3d6cf50b

CME Github September 2018

ATTACK:enterprise:S1146 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18cccfc2-e5a7-41ca-93ad-4ffef966b50b

Symantec Daggerfly 2023

ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e5c4c77-5e8b-4fe0-95f8-251f5a1f6fc0

Trend Micro Earth Kasha NOV 2024

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20710360-f3dd-4445-8a48-a2c905abdcdc

Rostovcev APT41 2021

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20f863a1-f7de-4d66-a564-c4adee24fdbe

Mandiant Operation Ke3chang November 2014

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--225f57e8-5001-4f20-b610-b62faf650fc9

CrowdStrike Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023 · Mandiant VMware vSphere JUL 2025 · MSTIC Octo Tempest Operations October 2023

ATTACK:enterprise:S0018 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2eb985a1-e73e-4554-8638-2e6f27690ec0

AlienVault Sykipot 2011

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--313102fa-9545-46c9-84cd-74c6e29a5ad3

Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

ATTACK:enterprise:S0635 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--362e332d-7763-488d-b25d-f12965f56d62

MSTIC Nobelium Toolset May 2021

ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3bad8943-4d47-4967-b2f4-c159c42a1eac

Cisco LotusBlossom 2025 · Symantec Bilbug 2022

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40527571-0b01-4568-b72b-568ad8b419ae

Trend Micro Muddy Water March 2021

ATTACK:enterprise:S0105 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44259d7d-e156-4e09-a401-ff62f0706cdd

TechNet Dsquery · Mandiant APT41

ATTACK:enterprise:G1032 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--493429f4-9d83-4131-8308-44e167a1a909

SOCRadar INC Ransom January 2024

ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e0775fd-17b6-44cd-9598-98f1a185b32b

Microsoft BlackCat Jun 2022

ATTACK:enterprise:S0521 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e2594cc-f6e0-4153-b878-930bc03fc0ad

CrowdStrike BloodHound April 2018

ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5235ff3c-646a-4608-b90e-394bc2c54330

NCC Group LAPSUS Apr 2022 · MSTIC DEV-0537 Mar 2022

ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54a5c9b4-7447-44fd-8aca-4162e6d51c85

Cato LAMEHUG JUL 2025

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57da83d5-2698-41b0-92b8-a92da8a4599c

Cycraft Chimera April 2020 · NCC Group Chimera January 2021

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58b7b9bf-d09b-49f4-acf5-351979171317

Github PowerShell Empire · SecureWorks August 2019

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a6942dc-eab7-4f45-b5fa-6149774e2acc

PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b999234-d801-44c1-9436-319b3352d851

Check Point VOID MANTICORE Handala Hack March 2026

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5f5af879-c239-416b-99ec-b46e2f9926a2

Palo Alto OilRig May 2016

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60f2ddcf-9b88-4a87-8baf-2777c9c49d39

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61dd6d75-a95b-488d-9a1d-924563592df7

FireEye APT34 Dec 2017

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63cda638-c359-470f-b509-446be108b607

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--689d5a99-cfcf-43d6-ae55-9bf920986f63

ESET ComRAT May 2020

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d55d9e0-34cb-43fe-bbd4-8dd2c88fec54

Microsoft BlackByte 2023

ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7903f25e-388e-4cda-bd09-bc83fa64d62e

Cybereason OperationCuckooBees May 2022

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--800b5705-d504-41af-86cb-252c6b3e267f

GitHub SILENTTRINITY Modules July 2019

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82dee5a5-7890-4bed-bc8c-83ffa13a8bcf

Mandiant FIN12 Oct 2021 · DFIR Ryuk's Return October 2020

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8ac91e9e-447c-4def-9f4a-9c29c355c832

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b425ec5-7be4-4225-a7c5-8f219fed7b6c

CISA AA20-259A Iran-Based Actor September 2020

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8baa00da-64da-4acb-831e-2c001399394a

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d43c2da-0d5e-478a-aacb-b9da651854ce

FoxIT Wocao December 2019

ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f1bdb28-7941-4b76-bcf3-2fe73321f0c5

ESET Lazarus Jun 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--909db543-0968-4f02-b1d9-de64c0730c0a

Cyberreason Anchor December 2019

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--94229aa6-c862-48b8-9959-1e1d3c04dd5e

DFIR_Quantum_Ransomware · IBM IcedID November 2017

ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--959c7695-01a5-4be1-9951-799749796cf4

Palo Alto Brute Ratel July 2022 · Trend Micro Black Basta October 2022

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9879a7e4-04b0-4cf2-a429-bad37bfd0741

BlackBerry_FIN7_April2024

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ef08a26-d881-4a36-952b-c07808093c6b

UCF STIG Elevation Account Enumeration

ATTACK:enterprise:G0033 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a602be33-6ed6-4f73-b7f6-10b47581707a

Kaspersky Poseidon Group

ATTACK:enterprise:T1087.002 → subtechnique-of → ATTACK:enterprise:T1087

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6baf58a-f679-4ba7-abfd-4e1e67ad407b

ATTACK:enterprise:S0165 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab109b93-76a9-46da-8934-58751125fd1e

Symantec Buckeye

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac6ce385-79d5-40bd-ab16-bd873fb1a821

McAfee Bankshot

ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8adb1db-0e1d-4f11-866b-de4dd5d31334

Mandiant_UNC1549TTPsTools_Nov2025

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd71b4dd-c049-47d4-bd0c-04f3a36d23e2

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d317032f-75dc-4d73-95ec-eabf3ed9d947

Microsoft Storm-1811 2024

ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d4faeb90-07ee-4ae2-b77d-e002418d1b22

Cybereason Valak May 2020

ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d682570b-068d-421e-a6b4-a93640bd34dc

CrowdStrike IceApple May 2022

ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e45efac0-c894-4676-a503-d8c1aa0cb117

Microsoft Storm-501 Sabbath Ransomware Embargo September 2024

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e506d4d7-c214-436c-a876-7ff2c71fcc87

Cisco Talos Qilin Ransomware OCT 2025

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e52c1bab-01f3-47c0-a5c9-361ba56d7e6a

Secureworks BRONZE SILHOUETTE May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023

ATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f451a96a-9266-4252-bd1f-d61c12691708

Elastic Latrodectus May 2024

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f6cf6ad8-7a42-4cf5-82ab-45d6a5107aeb

ESET Telebots Dec 2016

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fa155ccc-b9db-48f6-bb1a-a367596668ad

Secureworks BRONZE BUTLER Oct 2017

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fa6f9dc7-e984-411a-9ce4-a822d4213bc6

US-CERT TA18-074A

ATTACK:enterprise:S0552 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb21ff9d-1cd5-4908-a3a4-5f0d22cb8c10

Red Canary Hospital Thwarted Ryuk October 2020 · Cybereason Bumblebee August 2022 · FireEye Ryuk and Trickbot January 2019 · Symantec Bumblebee June 2022 · FireEye FIN6 Apr 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.