Skip to content

Ingress Tool Transfer

Technique · ATTACK:enterprise:T1105

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1105",
  "title": "Ingress Tool Transfer",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1105",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--e6919abc-99f9-4c6c-95a5-14761e7b2add",
  "external_id": "T1105",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:16.408Z",
  "modified": "2026-09-11T19:48:23.794Z",
  "version": "2.6",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [
    {
      "source_name": "T1105: Trellix_search-ms",
      "url": "https://www.trellix.com/blogs/research/beyond-file-search-a-novel-method/"
    },
    {
      "source_name": "Google Cloud Threat Intelligence COSCMICENERGY 2023",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/cosmicenergy-ot-malware-russian-response/"
    },
    {
      "source_name": "Dropbox Malware Sync",
      "url": "https://www.technologyreview.com/2013/08/21/83143/dropbox-and-similar-services-can-sync-malware/"
    },
    {
      "source_name": "University of Birmingham C2",
      "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf"
    },
    {
      "source_name": "t1105_lolbas",
      "url": "https://lolbas-project.github.io/#t1105"
    },
    {
      "source_name": "PTSecurity Cobalt Dec 2016",
      "url": "https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf"
    }
  ]
}

Explicit source assertions (533)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00de3cf9-73c4-4b04-a074-a5d73e9b61de

CISA AA20-259A Iran-Based Actor September 2020

ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0109ee05-c2a9-4dcf-80d1-f859500c97c9

Cyphort EvilBunny Dec 2014

ATTACK:enterprise:S0664 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0110e04e-5812-4b69-9700-037b52d3ebb4

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0177d430-a0b9-4f2f-8c66-8dfa4391611a

FOX-IT May 2016 Mofang

ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01c84feb-9dcf-455f-8900-fba08e8e7bc3

Lab52 MUSTANG PANDA PUBLOAD MAY 2023 · IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025 · 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024 · 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload · Palo Alto Networks, Unit 42

ATTACK:enterprise:S1118 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01d9bce9-9ae9-4167-b279-0f0ee4e6b263

Mandiant Cutting Edge Part 3 February 2024 · Mandiant Cutting Edge Part 2 January 2024

ATTACK:enterprise:S1066 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02c8a28f-c188-47a9-ab93-d9abb862abab

Secureworks DarkTortilla Aug 2022

ATTACK:enterprise:S0627 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--035dca04-cf9e-45ac-a037-f171b06078e6

Securelist APT10 March 2021

ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03c86a72-8298-4558-afc7-19cc09da4ff5

Forcepoint BITTER Pakistan Oct 2016 · Cisco Talos Bitter Bangladesh May 2022

ATTACK:enterprise:S1019 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03d6c33c-22d4-484f-8f16-8d49c307da80

Accenture Lyceum Targets November 2021 · ClearSky Siamesekitten August 2021

ATTACK:enterprise:S0284 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0485006f-c4f6-4657-85a0-6beec8d9368a

Talos Cobalt Group July 2018 · Security Intelligence More Eggs Aug 2019

ATTACK:enterprise:S0185 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--04ecc705-0027-4dda-85fe-d6ce028ef05e

FireEye APT34 Webinar Dec 2017

ATTACK:enterprise:S0515 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05dc9f8c-a1ea-4cdf-ae86-e98af40d5bd7

CISA WellMail July 2020

ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05ff481d-299f-4b72-9210-f07e7c5bf938

Rapid7 HAFNIUM Mar 2021 · Microsoft HAFNIUM March 2020

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07ab4fde-e1fd-4740-863e-c40cc8722d32

PTSecurity Cobalt Group Aug 2017 · PTSecurity Cobalt Dec 2016 · Morphisec Cobalt Gang Oct 2018

ATTACK:enterprise:S0255 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--083cbf6f-82e3-4d78-b18f-aa2d1f566713

Rancor Unit42 June 2018

ATTACK:enterprise:S1048 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a8e3f80-f415-450c-9976-feb917facd8a

ATTACK:enterprise:S0516 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0aebf9e4-9730-45ce-877d-f78432c13fad

CISA SoreFang July 2016 · NCSC APT29 July 2020

ATTACK:enterprise:S1074 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b15b2f4-ba30-4393-88ec-08235206bfac

Mandiant Suspected Turla Campaign February 2023

ATTACK:enterprise:S1013 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0bde7434-49de-40c4-906c-fc5f3bfc6d16

Cisco Talos Bitter Bangladesh May 2022

ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0beeaf4e-f9cf-46af-9e2f-116fff614d5f

Sygnia Emperor Dragonfly October 2022

ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d88d99d-88b0-4e49-b2c3-3607a32069ed

TrendMicro PE_URSNIF.A2 · TrendMicro BKDR_URSNIF.SM

ATTACK:enterprise:S1189 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0dc7c2ef-bbeb-4d0a-be04-4f2d8c57be6f

GitHub Neo-reGeorg 2019

ATTACK:enterprise:S0070 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e12d7d1-5c46-4314-97fb-263853eed6af

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e7999e0-a0d4-4f08-be18-8db59a46f69e

Microsoft BlackByte 2023

ATTACK:enterprise:S1028 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e7cace2-18db-4068-8a99-3dc66ed24741

MalwareBytes SideCopy Dec 2021

ATTACK:enterprise:S0207 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e8a0760-f21e-4936-80a1-769c7ef61950

Symantec Vasport May 2012

ATTACK:enterprise:S0472 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0efece7a-dc3a-46e1-b56c-7db9e3b61149

Trend Micro Tick November 2019

ATTACK:enterprise:S9007 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f164983-ed7d-44cc-b6db-90b141e271ff

Gen Digital Kimsuky HTTPTroy October 2025

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f47a6e7-af7e-4e23-a401-4dec08da4e64

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:S0574 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f55c28a-835f-4a85-a733-8fac5b819dcf

Unit42 BendyBear Feb 2021

ATTACK:enterprise:S0206 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f7e7dc5-ea9c-4d9e-9acd-5fa0dd25910a

Symantec Wiarp May 2012

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--106dcc28-3070-4882-8751-1791d471d564

Mandiant VMware vSphere JUL 2025

ATTACK:enterprise:S0210 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--107e2686-a764-4ace-9200-43ead29ce579

Symantec Ristol May 2012

ATTACK:enterprise:S0613 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--107f8870-4adf-4f63-acf2-d28677905235

BlackBerry CostaRicto November 2020

ATTACK:enterprise:S0336 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10806c6b-100d-456b-bb05-62d90713be64

DigiTrust NanoCore Jan 2017 · PaloAlto NanoCore Feb 2016

ATTACK:enterprise:S0380 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10974f3d-30fc-4ab6-b691-21acff792a05

Kaspersky StoneDrill 2017

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--115562b8-9d7c-435e-af6e-0be6249742d0

ESET Twitter Ida Pro Nov 2021 · TrendMicro macOS Dacls May 2020 · Novetta Blockbuster Destructive Malware · Novetta Blockbuster Loaders · Novetta Blockbuster · Qualys LolZarus · Lazarus APT January 2022 · SentinelOne Lazarus macOS July 2020 · Kaspersky ThreatNeedle Feb 2021 · Google TAG Lazarus Jan 2021

ATTACK:enterprise:S0504 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--116996cd-b855-4730-814d-869fd90e7ce1

Cyberreason Anchor December 2019 · Medium Anchor DNS July 2020

ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--117ecbd3-b4cd-4ad2-a5f4-30ba79563406

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:S0199 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1251d1e2-21d3-48f2-a869-44507b34943a

FireEye APT33 Sept 2017

ATTACK:enterprise:G0068 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1255a34c-e280-4b16-b606-7b03682cd76d

Microsoft PLATINUM June 2017

ATTACK:enterprise:S1088 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--128afec2-d9a5-4433-89d9-0cc65abf15bd

MoustachedBouncer ESET August 2023

ATTACK:enterprise:S0445 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--137f13ee-0607-47ba-952b-dbe39c1330bb

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0081 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--138c4559-eae3-49a2-baea-b9549aef881c

Accenture Dragonfish Jan 2018

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--140dda5e-b3d5-47ce-aac5-22060d5bddf2

ESET Okrum July 2019

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--151dd9ac-7e33-4580-a4a4-09f71fa73f51

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1525d82a-05a7-4027-9d2d-02f8039d68b5

Microsoft NICKEL December 2021

ATTACK:enterprise:S0630 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--156d46b3-538e-4481-ad53-b85de891f6d5

Bitdefender Naikon April 2021

ATTACK:enterprise:S0401 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15bb2796-7c6d-4d03-8d86-8d83254bcf0b

ESET TeleBots Oct 2018 · ANSSI Sandworm January 2021

ATTACK:enterprise:S1173 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1632dc5e-5ec9-4c93-9fc3-e4496879dfab

Symantec Crambus OCT 2023

ATTACK:enterprise:S0686 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16446d10-cf55-4e1e-bbf8-7ce6b8a2fb2b

Microsoft Actinium February 2022

ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--168ab4a2-db4d-4d64-9951-6547145aabe6

Fidelis njRAT June 2013 · Kaspersky BlindEagle AUG 2024 · Trend Micro njRAT 2018

ATTACK:enterprise:C0004 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16cdc452-d4dc-43f7-be53-dc6b62135d20

BlackBerry CostaRicto November 2020

ATTACK:enterprise:S0639 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1715a3b2-1c13-403e-8add-e8709fc7f92c

Trend Micro Ransomware February 2021

ATTACK:enterprise:S0388 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1729ebeb-c92c-4d8e-a859-0d081b3821a1

TrendMicro TropicTrooper 2015

ATTACK:enterprise:S0087 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18572125-3439-4f7c-92c8-d787913dc989

Fidelis INOCNATION

ATTACK:enterprise:G0107 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1898925b-236a-4847-8a97-e934c07cdde1

Symantec Whitefly March 2019

ATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18d97b33-8ad5-426e-a390-72bea109bee0

Unit42 BabyShark Apr 2019 · CISA AA20-301A Kimsuky

ATTACK:enterprise:S1182 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1918de84-79d9-447f-9bef-0b8fa601758a

Cisco MagicRAT 2022

ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--197a0e84-5361-49cc-8e14-24c331665862

Volexity InkySquid RokRAT August 2021 · Volexity InkySquid BLUELIGHT August 2021 · FireEye APT37 Feb 2018 · Securelist ScarCruft May 2019

ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--197ade21-6787-4ed3-a3ce-ff4b59b2f15c

Unit 42 BackConfig May 2020

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b16de68-c627-4f38-a85f-bbba2fef7e20

GitHub SILENTTRINITY Modules July 2019

ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b95cd32-155b-488d-bbf8-e16f22e2a1d5

Unit 42 Bisonal July 2018 · Kaspersky CactusPete Aug 2020 · Talos Bisonal Mar 2020

ATTACK:enterprise:S0520 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c33c9cd-afac-490a-b487-bd97c93a14cc

US-CERT BLINDINGCAN Aug 2020

ATTACK:enterprise:S0374 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c3d2111-f234-4624-999e-ce902367c212

CheckPoint SpeakUp Feb 2019

ATTACK:enterprise:S0390 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1cfc5611-b428-4fce-8b8d-f591523c9d9c

Flashpoint FIN 7 March 2019

ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d2111ce-5034-472a-89a7-1818d11280fb

MalwareBytes SideCopy Dec 2021

ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ddae833-8280-4afa-b2b0-e250e22104fe

University of Birmingham C2

ATTACK:enterprise:S0436 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e54c837-6d59-40dc-a114-3bcef0037327

JPCert TSCookie March 2018

ATTACK:enterprise:S9052 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ead4216-76d0-4062-ba4d-9eda4014e6f6

CheckPoint_NimbusManticore_May2026

ATTACK:enterprise:S0468 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1eb0fe9c-86e9-4c8c-8a24-c7b139559971

Trend Micro Skidmap

ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f5aee41-e3bc-4ed0-a0e2-fa8f7cd6de26

Cylance Shaheen Nov 2018

ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fc9bf47-32e7-45e5-87f3-3e7a5efdd35d

Cisco Operation Layover September 2021

ATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20011401-761f-4937-bd16-d0d058e44bf9

Aikido TeamPCP Telnyx MAR 2026 · Wiz TeamPCP KICS MAR 2026

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2011a4ee-6b40-45a1-8bcf-f19568d16d02

Talos Kimsuky Nov 2021 · Crowdstrike GTR2020 Mar 2020 · Securonix Kimsuky February 2025 · Aryaka Kimsuky July 2025

ATTACK:enterprise:S0688 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--201f9d85-be41-4aeb-984f-6ece40d4177d

Check Point Meteor Aug 2021

ATTACK:enterprise:S0086 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2025480a-6d91-4ef5-a6ea-cc025c8aecfb

Cylance Dust Storm

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20b90b04-4ce1-4e9a-9dbb-9fc93569d3e1

ESET Turla Mosquito May 2018

ATTACK:enterprise:S9053 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21148a22-4814-47b4-8edb-3360f5b93ca4

CheckPoint_NimbusManticoreEurope_Sept2025

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.