Skip to content

Modify Registry

Technique · ATTACK:enterprise:T1112

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1112",
  "title": "Modify Registry",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1112",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--57340c81-c025-4189-8fa0-fc7ede51bae4",
  "external_id": "T1112",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:23.587Z",
  "modified": "2026-09-11T19:48:51.536Z",
  "version": "3.0",
  "aliases": [

  ],
  "tactics": [
    "defense-impairment",
    "persistence"
  ],
  "source_references": [
    {
      "source_name": "CISA Russian Gov Critical Infra 2018",
      "url": "https://www.cisa.gov/news-events/alerts/2018/03/15/russian-government-cyber-activity-targeting-energy-and-other-critical-infrastructure-sectors"
    },
    {
      "source_name": "CISA LockBit 2023",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a"
    },
    {
      "source_name": "Avaddon Ransomware 2021",
      "url": "https://arxiv.org/pdf/2102.04796"
    },
    {
      "source_name": "Microsoft BlackCat Jun 2022",
      "url": "https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"
    },
    {
      "source_name": "Microsoft Reg",
      "url": "https://technet.microsoft.com/en-us/library/cc732643.aspx"
    },
    {
      "source_name": "Microsoft Remote",
      "url": "https://technet.microsoft.com/en-us/library/cc754820.aspx"
    },
    {
      "source_name": "SpectorOps Hiding Reg Jul 2017",
      "url": "https://posts.specterops.io/hiding-registry-keys-with-psreflect-b18ec5ac8353"
    },
    {
      "source_name": "Microsoft Reghide NOV 2006",
      "url": "https://docs.microsoft.com/sysinternals/downloads/reghide"
    },
    {
      "source_name": "TrendMicro POWELIKS AUG 2014",
      "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/poweliks-malware-hides-in-windows-registry/"
    },
    {
      "source_name": "Unit42 BabyShark Feb 2019",
      "url": "https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"
    }
  ]
}

Explicit source assertions (176)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0167fba6-d37d-46ba-bb07-5fc70b864b3f

Check Point APT35 CharmPower January 2022

ATTACK:enterprise:C0028 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--052acd65-b05a-4645-943b-1c53a717c419

Booz Allen Hamilton

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--052be04b-5ff3-4757-a5c1-de012997accc

ESET Turla PowerShell May 2019 · Symantec Waterbug Jun 2019

ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--067ece2b-4e66-437f-88e0-8dc3f076331b

Eset PlugX Korplug Mustang Panda March 2022 · CIRCL PlugX March 2013 · DOJ Affidavit Search and Seizure PlugX December 2024

ATTACK:enterprise:S0596 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--072c3b1d-1ad6-447e-9512-2c6bc6e797fd

TrendMicro EarthLusca 2022 · Kaspersky ShadowPad Aug 2017

ATTACK:enterprise:S0457 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0775a1ba-c95a-472e-ab1c-d21108acc907

TrendMicro Netwalker May 2020

ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0841cd91-1151-411f-befc-0204e3a3eb30

Unit 42 Valak July 2020 · SentinelOne Valak June 2020 · Cybereason Valak May 2020

ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ae212be-c07b-4f62-8c5e-9dfc0472254e

Malwarebytes RokRAT VBA January 2021

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ccca05d-955c-40fa-9fd4-c10480abcf3d

FireEye APT38 Oct 2018

ATTACK:enterprise:S0376 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0cf14628-b4c0-470a-9059-43fc562717d8

US-CERT HOPLIGHT Apr 2019

ATTACK:enterprise:S0261 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0dd74596-509c-4669-9d29-e1fb501c9c70

Symantec Catchamas April 2018

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f4c2cab-c3ca-4f31-8557-485248b65761

Gh0stRAT ATT March 2019

ATTACK:enterprise:S0242 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--109b2118-d714-41bb-a39d-b1fd1b755b55

SecureList SynAck Doppelgänging May 2018

ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10fb2420-a482-4909-90c6-fd9f7e5c24a6

CISA MAR SLOTHFULMEDIA October 2020

ATTACK:enterprise:S0608 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--150667a8-2155-4500-b7bb-c2d6bbc568b8

SANS Conficker · Trend Micro Conficker

ATTACK:enterprise:S1033 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--150f7dbe-3e64-4ee4-a621-6d416e53af63

Checkpoint MosesStaff Nov 2021

ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15cd99f1-29b4-4603-ae74-fdc204afead4

FireEye SUNBURST Backdoor December 2020 · Microsoft Analyzing Solorigate Dec 2020 · Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1770cc28-c49c-4b70-b4d0-6976efaede16

TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0569 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--178116a9-6ac9-45c0-bc74-36fe9ba12686

CheckPoint Volatile Cedar March 2015

ATTACK:enterprise:S0518 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--190057d5-13ad-40d2-a2f0-0177850e2905

ESET Dukes October 2019

ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19161920-e6b5-481f-a240-62f05c624010

Symantec Darkmoon Aug 2005

ATTACK:enterprise:S0669 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1aae3796-86d5-4b31-ad21-e1dcc508a3b5

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c4a31d0-3567-4081-93f5-14de47eabecf

Joint Cybersecurity Advisory LockBit 3.0 MAR 2023 · INCIBE-CERT LockBit MAR 2024

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1cebf654-8955-4be0-b01f-392ffa2bad0a

Mandiant_UNC2165

ATTACK:enterprise:S0397 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f5c6a39-aa0b-469e-aabe-67e4d237b213

ESET LoJax Sept 2018

ATTACK:enterprise:S1230 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--202a6c36-ba18-4615-88ae-a6e0005eda71

2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024

ATTACK:enterprise:S0158 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--202b96f6-0f7c-4aed-8004-780f1d880059

FireEye APT32 May 2017

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22af9ec6-fb67-4007-85f8-70a3be7f209f

CISA Medusa Group Medusa Ransomware March 2025

ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2606ed25-9f1d-4e85-822a-af39ce0d8e66

Talos PoetRAT April 2020

ATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c927351-d98a-4734-83db-82ad3231e59f

Secureworks REvil September 2019 · Cylance Sodinokibi July 2019 · Intel 471 REvil March 2020 · McAfee Sodinokibi October 2019 · Secureworks GandCrab and REvil September 2019

ATTACK:enterprise:S0031 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2dec6ce1-e459-4266-86d5-f336ab056f17

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e126b9a-f902-4077-963e-64185c9544ff

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e53dad4-17cc-4fe6-a3b9-d622075d78f7

ESET Grandoreiro April 2020

ATTACK:enterprise:S0011 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e8e6362-ce7e-4fd5-8c9b-8b85b6f35a58

CISA MAR-10292089-1.v2 TAIDOOR August 2021

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f11e661-a5a0-4420-b97e-b080fc4fa441

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:S0668 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f603550-4368-4f34-89d9-50f69eed2fa9

Talos TinyTurla September 2021

ATTACK:enterprise:S0267 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--321c1e2e-c295-42db-87cf-4d71f6c7f164

FireEye FELIXROOT July 2018

ATTACK:enterprise:S0649 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--331f7990-d817-49ec-9d55-c4c64da7f4a6

FireEye SMOKEDHAM June 2021

ATTACK:enterprise:S0517 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--332ce4cd-311a-457f-ae10-6d8e3ef7bc77

Trustwave Pillowmint June 2020

ATTACK:enterprise:S0501 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33823f15-f43f-41ef-bc14-7dea2ab21acf

ESET PipeMon May 2020

ATTACK:enterprise:S1060 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35317fb7-9426-4f6e-9c78-64bb7a2da67f

SentinelLabs Metador Technical Appendix Sept 2022

ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--396a5415-67aa-4ec6-ae27-6be641d69e15

Group IB Silence Sept 2018

ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3debe0d7-63bb-4e21-bf9b-ed5e23140e57

Korean FSI TA505 2020

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40a8f80d-5497-4218-849c-3c0b63796641

ATTACK:enterprise:S1181 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40b51ac6-d391-4fcb-ae32-79705d25301a

Microsoft BlackByte 2023

ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41de9761-477c-4674-aea7-64a0b0b4ab4b

SentinelOne Hermetic Wiper February 2022 · Crowdstrike DriveSlayer February 2022 · Qualys Hermetic Wiper March 2022

ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42a2aec6-4efb-44d0-8ae8-32a208c05da6

Check Point Warzone Feb 2020 · Uptycs Warzone UAC Bypass November 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45376fe9-2a43-4e09-942e-82be661ed572

Talos Cobalt Strike September 2020

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45f35ec0-73a8-42a6-b879-d800d27211c8

Unit 42 C0d0so0 Jan 2016

ATTACK:enterprise:S1201 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a2d2699-a2c0-40e4-8e8d-3450155b9923

Zscaler Kimsuky TRANSLATEXT

ATTACK:enterprise:S0527 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d58ff48-b6d8-48ba-aa29-2f34d4dc1264

Cybereason Kimsuky November 2020

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--516712db-0e82-43a5-bd9f-f1a4cb4939c1

ESET Gelsemium June 2021

ATTACK:enterprise:S0612 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--519beaec-1b79-42d7-9739-8c22e896e0cd

NCC Group WastedLocker June 2020

ATTACK:enterprise:S1059 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51b34c1f-4e2f-4bb7-98a1-fa90ed873eba

SentinelLabs Metador Technical Appendix Sept 2022

ATTACK:enterprise:S1178 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--52b695ee-33cb-445a-96b1-3fa074318d44

Kaspersky ShrinkLocker 2024 · Splunk ShrinkLocker 2024

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--53d6538d-5b30-4503-94a3-077ddc428a3a

Unit42 Bookworm Nov2015

ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--53e09f15-3162-4480-8eb4-709e9c18d7fb

CISA AR18-352A Quasar RAT December 2018 · GitHub QuasarRAT

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--541855dd-0249-4f63-8e95-0024f760484e

Symantec Trojan.Hydraq Jan 2010 · Symantec Hydraq Jan 2010

ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--552afd93-370d-4f8e-b2c0-e27d9d7e050e

Microsoft BlackCat Jun 2022

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56b203da-eda9-4866-8a69-f978a1d34821

Picus BlackByte 2022 · Cisco BlackByte 2024

ATTACK:enterprise:S1131 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58bddfb4-2236-444b-8681-2b2e0fe1f7e2

Huntress NPPSPY 2022

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5abf323d-03be-4996-ab4b-89317883d0ab

Cyble Black Basta May 2022 · Palo Alto Networks Black Basta August 2022 · Trend Micro Black Basta May 2022 · NCC Group Black Basta June 2022 · Deep Instinct Black Basta August 2022 · Minerva Labs Black Basta May 2022

ATTACK:enterprise:S0254 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5bbe7733-4e20-4ee1-a29c-b8e7111781dd

Rancor Unit42 June 2018

ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c89cacf-96fc-40e2-a6ed-b4d4f107cec3

Cisco LotusBlossom 2025

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5cb4493b-1830-436a-8c1b-5aab2ef37442

FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5edb6931-3262-40a9-acce-3016ac4153d4

ESET Gamaredon June 2020 · CERT-EE Gamaredon January 2021 · ESET Gamaredon Sept2024 · SymantecCarbonBlack_ShuckwormUSB_Apr2025

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60202ca3-cadc-4756-99c8-a4b18e07d116

GitHub SILENTTRINITY Modules July 2019

ATTACK:enterprise:S1190 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60a8cf92-7bd7-4e4a-9681-91d227b2609a

WithSecure Kapeka 2024

ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61360c2f-0a26-49ca-ac7c-2758fcd26ea2

Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

ATTACK:enterprise:S0579 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--631ba90c-982c-4415-a13c-75cf06e53252

Trend Micro Waterbear December 2019

ATTACK:enterprise:S0157 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6592447f-31c8-46d0-8e88-47584fa301f0

FireEye APT32 May 2017

ATTACK:enterprise:C0002 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66a7d5ae-7975-448d-ae40-b0786a3a8cd6

McAfee Night Dragon

ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66f2f7b3-3df9-4d4a-bedc-ecacac3039e8

Riskiq Remcos Jan 2018 · Fortinet Remcos Campaign NOV 2024

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66f5e718-f910-487f-852a-98a8d752b0ba

ESET InvisiMole June 2018 · ESET InvisiMole June 2020

ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--676c5a2a-323b-4166-9c83-8c6e5e25bb1f

Medium Metamorfo Apr 2020 · Fortinet Metamorfo Feb 2020 · FireEye Metamorfo Apr 2018 · ESET Casbaneiro Oct 2019

ATTACK:enterprise:S0256 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--67e6b603-a45d-4cbc-9b3e-546392934f7f

ESET Turla Mosquito Jan 2018

ATTACK:enterprise:S0560 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--69356661-76fb-46fe-94ce-d029ee7f8a64

Check Point Sunburst Teardrop December 2020

ATTACK:enterprise:S0142 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--69bff194-c90e-4e30-a369-57da4cff014d

Cylance Shell Crew Feb 2017

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6bbefe61-008f-4298-8a9b-364c51ba7c20

Picus Qilin MAR 2025 · Halcyon Qilin.B OCT 2024 · Cisco Talos Qilin Ransomware OCT 2025

ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d39de5f-6fbd-43e3-8da8-03a4cbe46656

ESET Attor Oct 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.