Skip to content

Proxy

Technique · ATTACK:enterprise:T1090

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1090",
  "title": "Proxy",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1090",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--731f4f55-b6d0-41d1-a7a9-072a66389aea",
  "external_id": "T1090",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:08.479Z",
  "modified": "2026-09-08T20:28:07.390Z",
  "version": "3.2",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [
    {
      "source_name": "Trend Micro APT Attack Tools",
      "url": "http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/"
    }
  ]
}

Explicit source assertions (85)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1210 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02226352-d8cd-4b84-99bc-2df35f66f37a

Cisco LotusBlossom 2025

ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--060a6b38-18fb-46ac-97c1-b1c40d493b6c

Red Canary NETWIRE January 2020

ATTACK:enterprise:S1114 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--096d97b6-57d0-4722-a204-685fb48ed5ca

Mandiant Cutting Edge Part 2 January 2024 · Mandiant Cutting Edge January 2024

ATTACK:enterprise:S1212 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12c19ecc-2d25-45c6-b13b-439220248d4e

Group-IB RansomHub FEB 2025

ATTACK:enterprise:S0669 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14ab71d4-a158-41f2-82d4-c70f3121fa11

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1542332b-788b-4c1e-b5e5-69d032cb7814

CISA AA24-038A PRC Critical Infrastructure February 2024 · Microsoft Volt Typhoon May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023

ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a9510e3-0bb0-4469-bbf8-2d02a3a00d66

Proofpoint TA505 October 2019

ATTACK:enterprise:S0615 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ab94260-498a-4090-85c9-54b89d8b6bb3

CISA AR21-126A FIVEHANDS May 2021

ATTACK:enterprise:S0040 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b27cec5-241a-4c2e-a3db-e9cea241496c

Operation Quantum Entanglement · NCSC Joint Report Public Tools

ATTACK:enterprise:S1144 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b885f53-1194-472d-a120-381f000d7b53

ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c401eba-48ed-4daa-a123-6b4752c84026

Recorded Future RedDelta 2025

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2050b131-d5e1-419c-ad85-660fba4004d7

ESET Telebots Dec 2016

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20b9ce88-4d97-4395-b586-92732080808e

Havoc Framework Documentation

ATTACK:enterprise:S0347 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2485b970-f934-4fdb-80a4-0e11c179845d

TrendMicro Lazarus Nov 2018

ATTACK:enterprise:T1090.001 → subtechnique-of → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--284aadab-ec10-4869-8bdb-7258c19432c4

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2bd05bbf-886e-4211-8aab-63cd8581a695

Talos ZxShell Oct 2014 · FireEye APT41 Aug 2019

ATTACK:enterprise:T1090.003 → subtechnique-of → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c78a913-5b17-4942-a6e9-8bfa4c24149b

ATTACK:enterprise:T1090.004 → subtechnique-of → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2cf3d3a5-85ab-43d9-8462-684469f79c6a

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e162cdf-e917-4bc5-a2d2-1623e05d0b61

ESET Turla PowerShell May 2019

ATTACK:enterprise:C0048 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30bff73c-7c73-4d18-84ab-bf5033f63d34

Volexity UPSTYLE 2024

ATTACK:enterprise:S0376 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--321703ba-7871-46c0-837e-6a2e1dc5aba9

US-CERT HOPLIGHT Apr 2019

ATTACK:enterprise:G0052 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3393682e-22a6-4e27-b890-747f1392741b

Microsoft POLONIUM June 2022

ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3504541e-cfcf-4b92-9de1-d34f1e814d40

JPCERT MirrorFace JUL 2024

ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--384c2ef7-ae14-4ba2-ad86-bfeea3c14f33

Check Point Warzone Feb 2020

ATTACK:enterprise:T1090.002 → subtechnique-of → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d16dbff-d1fc-42e0-b736-69ddee747ffe

ATTACK:enterprise:S0508 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e16f380-633b-4d27-9249-9bcf25717f5a

Zdnet Ngrok September 2018 · MalwareBytes Ngrok February 2020

ATTACK:enterprise:S1121 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41fd4cc5-8d62-43f6-833b-1068a8f3003c

Mandiant Cutting Edge Part 3 February 2024

ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4393f669-4e67-4cd6-a89b-52907138fca7

MSTIC DEV-0537 Mar 2022

ATTACK:enterprise:S9044 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--46ab37b0-4a91-45d3-ac5a-7912494fcf10

Artic Wolf Labs Kali365 Device Code April 2026 · Huntress Kali365 Device Code June 2026 · SpyCloud Kali365 June 2026

ATTACK:enterprise:G0108 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4c26e6e8-8303-44ad-9e5d-452dff52858f

RedCanary Mockingbird May 2020

ATTACK:enterprise:S1189 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f895e31-5953-4d83-bfe0-f1606f3cc83e

GitHub Neo-reGeorg 2019

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5886efa7-c69d-4f66-949a-4979ca230f06

CERT Polska · ESET DynoWiper Update JAN 2026

ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b68c97c-8eb7-45eb-b2d2-a91bf0fff2a0

Sygnia Emperor Dragonfly October 2022

ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d4cf656-ce12-4a52-93ad-0a0545c8a144

Google Salesforce JUN 2025

ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ed5deda-543f-40f7-8f5d-df8f93c545e2

Riskiq Remcos Jan 2018 · Fortinet Remcos Campaign NOV 2024

ATTACK:enterprise:S0245 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5f6e76c5-732c-4bc8-9c17-ac1e58a5d88e

US-CERT BADCALL

ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62d56cae-9131-4088-ad0a-810a731d2a9f

BitDefender BADHATCH Mar 2021

ATTACK:enterprise:S1197 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--660e8d4a-4de9-4566-92d7-0bd7e8e85d19

S2W Troll Stealer 2024

ATTACK:enterprise:S0108 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--69c1806d-e6ae-4c11-bce6-8fbebd8bbee5

Securelist fileless attacks Feb 2017

ATTACK:enterprise:G1019 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6abb1f16-7e68-4b0d-a1ae-4001f5a7f87b

MoustachedBouncer ESET August 2023

ATTACK:enterprise:S0435 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e23cb4f-61dd-4a6a-8c25-7eb79c376558

JPCert PLEAD Downloader June 2018

ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f7ee9ba-fb3d-4f22-a78a-8003da718ec4

Dell Dridex Oct 2015 · Checkpoint Dridex Jan 2021

ATTACK:enterprise:S0246 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74bb0ae9-589c-4479-9bd5-b9a71a20e82d

US-CERT HARDRAIN March 2018

ATTACK:enterprise:S0487 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75aa57b2-5d2e-49ec-9c26-317b361632c3

ESET ForSSHe December 2018

ATTACK:enterprise:S0436 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c119557-d417-4708-a024-5be9c4d4d86c

JPCert BlackTech Malware September 2019

ATTACK:enterprise:G0124 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c776fbc-592a-4643-bd4f-423546a4732e

ESET Windigo Mar 2014

ATTACK:enterprise:G1005 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81eaf78c-2282-4e86-baa9-820020a54031

Microsoft POLONIUM June 2022

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82758a74-b7e2-4839-ad52-bdc6c57c0dba

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83491142-3547-4944-b208-2a94d8536008

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:S0263 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83e001e3-95d3-43d9-9f8c-8b954686287a

US-CERT TYPEFRAME June 2018

ATTACK:enterprise:S1187 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86bf339d-20a1-45c2-bad8-12b264bc7c5b

Fortinet reGeorg MAR 2019 · Mandiant APT29 Eye Spy Email Nov 22 · GitHub reGeorg 2016

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8756af3a-a756-4e0d-a537-8cab1e983b9b

ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--887fda04-92e9-4819-bf6c-5458348cc046

Juniper RedPenguin MAR 2025 · Mandiant UNC3886 Juniper Routers MAR 2025

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8fd75064-d1b8-4b8c-b9ea-5b65a1cc0ea8

Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0690 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--92b8dedc-360a-4763-bc31-5f7b0a698460

Objective See Green Lambert for OSX Oct 2021 · Glitch-Cat Green Lambert ATTCK Oct 2021

ATTACK:enterprise:S1044 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--93900b40-be44-48eb-92bc-c171a5ce5501

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9df6635a-b3ed-494c-845e-b743e494861c

FoxIT Wocao December 2019

ATTACK:enterprise:S0629 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a01e0e7c-1694-4a6a-8fea-4d4d8a83e034

Bitdefender Naikon April 2021

ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a03d084b-c216-4962-93e8-6c0dc8f0cb91

PaloAlto CardinalRat Apr 2017

ATTACK:enterprise:S0273 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a13feeb0-d376-4460-8335-f86c0f163d4b

TrendMicro Patchwork Dec 2017

ATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a424a85c-a3c6-4d84-85f7-e55c8dbe21fc

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a637133c-2b07-4e57-8822-5c3bc4b584d7

CISA AA20-259A Iran-Based Actor September 2020 · ClearSky Pay2Kitten December 2020 · Check Point Pay2Key November 2020

ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--acde21f1-6ece-44c6-89b4-aee4a6cf0ae1

Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025

ATTACK:enterprise:S0207 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b150e3fd-54c0-49ec-a41f-860e92712344

Symantec Vasport May 2012

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b3bbe6c1-b715-418f-ae7c-17488948f9b8

FalconFeeds_Iran_Mar2026

ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b7cba2d6-7f3e-4402-b195-a21b0cf5e5d2

ESET ToolShell JUL 2025 · Microsoft SharePoint Exploit JUL 2025

ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba218f25-8703-4042-98b0-42afe1c49503

GitHub QuasarRAT · Volexity Patchwork June 2018

ATTACK:enterprise:S1190 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be2fde8e-796c-4647-9351-edd9c97fe2b3

WithSecure Kapeka 2024

ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bee75401-9e24-4c5d-9203-0b3cdca01cbf

TrendMicro EarthLusca 2022

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c00bdbcc-fc8d-4abf-9901-2a5cf291e763

CrowdStrike Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1205923-690a-4bfb-9116-0a60eb931b26

DFIR Phosphorus November 2021

ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c2bbf923-e30e-4888-894c-7c8ba655c753

NJCCIC Ursnif Sept 2016 · ProofPoint Ursnif Aug 2016

ATTACK:enterprise:S0456 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c7f1b492-eea7-45d1-ab78-6794c7560c67

CheckPoint Naikon May 2020

ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8df91dd-3060-4829-93a2-121b85b6c49b

Talos Bisonal Mar 2020

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca493dc3-e2ef-45ee-a352-6c7363bc6c57

CarveyODonnellWelchHuntress_TheGentlemen_May2026

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb0931f7-4d6c-4f21-95a8-fd9d74ba30e0

FireEye APT41 Aug 2019

ATTACK:enterprise:S0117 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d3234cf8-0ef7-4447-ae3a-9624f3229265

Crowdstrike DNC June 2016

ATTACK:enterprise:S1141 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d403d31c-59d6-42bf-91c5-728e14a3f60c

ESET Turla Lunar toolset May 2024

ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d50b5687-ea69-40f9-86f3-eecd7e015bac

University of Birmingham C2

ATTACK:enterprise:S1099 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8e8d071-fa60-4b6d-a0a4-dc6102f229c8

Kaspersky ToddyCat June 2022

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.