Skip to content

Automated Collection

Technique · ATTACK:enterprise:T1119

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1119",
  "title": "Automated Collection",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1119",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--30208d3e-0d6b-43c8-883e-44462a514619",
  "external_id": "T1119",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:27.985Z",
  "modified": "2026-09-11T19:58:54.721Z",
  "version": "1.4",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "Mandiant UNC3944 SMS Phishing 2023",
      "url": "https://www.mandiant.com/resources/blog/unc3944-sms-phishing-sim-swapping-ransomware"
    }
  ]
}

Explicit source assertions (80)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b566985-7ec1-43f0-b511-bad72e0cedb6

Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

ATTACK:enterprise:S0098 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11bc3d01-fc44-415c-b5a3-5576f5cb6057

Palo Alto T9000 Feb 2016

ATTACK:enterprise:S0090 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--121a09bd-f603-4476-a149-a3cba52f268c

Palo Alto Rover

ATTACK:enterprise:S0339 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12c94395-26b4-46a5-bb10-dab19b5f1a30

Radware Micropsia July 2018

ATTACK:enterprise:S1043 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13183327-ca7a-4237-98be-c4c7215bf3d3

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ab19016-645d-4176-b0f4-025990fd4b36

Ensilo Darkgate 2018

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1de5c5fb-ba73-446b-8596-225cb5bcb611

ESET Gamaredon June 2020

ATTACK:enterprise:S0244 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--228e71e2-0e76-4020-a850-7a568412259b

Palo Alto Comnie

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26088143-9fdc-4fb5-aa04-27ea21836da0

FoxIT Wocao December 2019

ATTACK:enterprise:S0684 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34efccbe-b184-444d-8ce3-3a3e2bc2f988

ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--394a227d-585f-48a5-84ac-cc40a0ad80e6

Red Canary NETWIRE January 2020

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b7d8e64-9f14-486a-aae3-170834dac98c

Cadet Blizzard emerges as novel threat actor

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42430a20-2bc2-4078-9da6-9c065cbf5224

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45d6e0d0-5de1-4382-ae08-acf4f035a740

ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47aebf09-4bee-4639-94e3-27b095d7558a

Talos PoetRAT April 2020

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4be42e8a-4547-43c5-97bf-01440994f95b

Talos Frankenstein June 2019

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4c2924c1-dec5-4390-87d7-c52e24a92512

ATTACK:enterprise:M1029 → mitigates → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4df90c69-8ac5-4f22-b0cf-dd4debb8e051

ATTACK:enterprise:S0238 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ed42682-d3ad-4a4f-8576-ccdf28ce642b

McAfee GhostSecret

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5027a119-ff43-4ca6-a862-3efe39b29b3e

TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0467 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5197fd7a-766f-45da-87f5-c469377460d1

Kaspersky TajMahal April 2019

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--53fb076c-5f59-45da-bbc2-94b5f3a3eb91

Microsoft NICKEL December 2021

ATTACK:enterprise:G0053 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55ffbd77-ec97-4dca-9399-b9e4b62fbbf8

Mandiant FIN5 GrrCON Oct 2016

ATTACK:enterprise:S0257 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57a9c0ef-6b92-415e-9f72-a78483e35f5f

Unit 42 VERMIN Jan 2018

ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e1a2fcd-bb4e-43b2-8f42-33fb5bf80b21

Microsoft Silk Typhoon MAR 2025

ATTACK:enterprise:G1030 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c83315d-c8b5-4ab8-b345-3c79b11d690a

Unit42 Agrius 2023

ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6caff042-f300-421c-b6c8-6c8dd6d69f1b

FireEye Metamorfo Apr 2018

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f918e2b-d89f-4cf1-8180-ef83b2674f10

QuorumCyber_Vidar_March2023

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--715d1910-181b-47a8-9b3c-86cba51b8ba4

DOJ GRU Indictment Jul 2018

ATTACK:enterprise:S9008 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7618d723-b62a-4dca-9b83-153410dcdda7

Aikido Shai-Hulud September 2025 · Netskope Shai-Hulud November 2025 · Microsoft Shai-Hulud December 2025

ATTACK:enterprise:S9058 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--794cb340-3f00-4272-b7fc-b99295b09b73

Mandiant_UNC1549_Nov2025

ATTACK:enterprise:S0466 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a6c1581-a077-4c8f-8111-3264fa9e1e9c

objective-see windtail2 jan 2019

ATTACK:enterprise:S0136 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a892ca0-f915-4dc1-817a-cdcfb6777f28

ESET Sednit USBStealer 2014

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f1c1e43-07dc-4deb-a27f-9f140a894c51

KISA Operation Muzabi

ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7fb8ef27-0c19-4e31-9122-f89cd4283427

SentinelOne Valak June 2020

ATTACK:enterprise:S1017 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82b85b1c-e6f8-443a-b64a-11b63907755f

Palo Alto Unit 42 OutSteel SaintBot February 2022

ATTACK:enterprise:S0395 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83d16911-5fa1-4646-9718-6af0852dcb9a

ESET LightNeuron May 2019

ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86c5119f-eea3-48c6-a89b-1c77bbb84246

Trend Micro SharePoint Attacks JUL 2025 · Palo Alto SharePoint Vulnerabilities JUL 2025

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87648492-36d0-4f94-b318-17280b101678

McAfee Bankshot

ATTACK:enterprise:S1109 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8790dab9-2fc9-45cf-b46c-bbe2b1f2c20e

Mandiant Pulse Secure Zero-Day April 2021

ATTACK:enterprise:S0491 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8ec92ea1-6021-4e0f-9737-826e9f243830

Bitdefender StrongPity June 2020

ATTACK:enterprise:S1044 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f7fe970-0a16-4007-84ae-e7294d06595f

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:C0040 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90b8dc08-3d90-4430-be9f-ba4f1e9c0976

Google Cloud APT41 2024

ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--954a1ee1-454a-4d1a-b922-620f755887b3

CERT-UA WinterVivern 2023

ATTACK:enterprise:M1041 → mitigates → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--967c7069-6bb3-4f10-ba6b-5befdabe6c97

ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--982474f3-d61d-49ac-b5be-30553e872db1

ESET Attor Oct 2019

ATTACK:enterprise:G0142 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--985bb7ab-6853-4906-98a0-1945e4504ee8

TrendMicro Confucius APT Aug 2021

ATTACK:enterprise:C0046 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b3ddb15-242c-42e5-b4e3-eedec58fd995

CCCS ArcaneDoor 2024

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a24299ed-9735-453c-bd13-66269b2d5d16

Unit42 OilRig Playbook 2023

ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6046634-68c8-4a9e-a58f-58fd8876346a

Eset Ramsay May 2020

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a69fa027-82b4-4c29-90b0-37fffe680d8a

Sekoia Raccoon2 2022 · Sekoia Raccoon1 2022 · S2W Racoon 2022

ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a83182d2-b619-4ca4-984b-21ecfe43da26

ESET RTM Feb 2017 · Unit42 Redaman January 2019

ATTACK:enterprise:C0001 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab431fe4-eb1b-48ed-a105-7d50b8d0beda

Talos Frankenstein June 2019

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac7d5b88-7929-4f64-abcd-8219caafac24

Trend Micro FIN6 October 2019 · FireEye FIN6 April 2016

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b0a0e3c7-e1b2-4b84-8e37-8989147785d0

TrendMicro Patchwork Dec 2017

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b3dd4e4e-0bb8-4487-8336-b5d9024045eb

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b5766b7d-0a7d-4bbc-8a44-211825de80db

ATT Sidewinder January 2021

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b61e25f5-89cd-4c64-90e6-15b8b21a3a10

NCC Group Chimera January 2021

ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b6e78cd0-4bf6-486a-8133-4d04c154e61a

Flashpoint Mini Shai-Hulud MAY 2026

ATTACK:enterprise:S0597 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b98063a7-6649-429f-8376-4d59499e7674

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b990e235-dcf4-48c7-800d-b8a10a62eda4

SecureWorks BRONZE UNION June 2017

ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bab58303-c3d2-45c8-b175-e2cb6f19b720

Splunk LAMEHUG SEP 2025 · Nov AI Threat Tracker

ATTACK:enterprise:C0062 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc96f71f-560a-4d41-b85a-09c4fbc14994

Anthropic AI Orchestrated Campaign NOV 2025

ATTACK:enterprise:S0699 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd651c13-04c8-4bff-9e68-b53b5f662510

Mythc Documentation

ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd88fffc-e2ca-4800-92cd-8061537fce16

Cybereason LumaStealer Undated

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c51dce73-f92b-4eaa-b00b-4466f3e3ae09

Secureworks BRONZE PRESIDENT December 2019

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c87cbebf-6b1f-480d-802d-5a2004256183

ESET InvisiMole June 2018 · ESET InvisiMole June 2020

ATTACK:enterprise:S0538 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9e82790-f096-46f0-ba55-579d77ec3ea8

ESET Crutch December 2020

ATTACK:enterprise:S0170 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd58d271-9ee2-45d6-9ca3-22ae8da639b5

Palo Alto OilRig May 2016

ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d7b8831f-948f-47a1-a751-01b5b81e13ea

Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dcb7110b-c7d8-407b-9ebb-a5233d4f8201

AI-Mexico-Govt-Breach

ATTACK:enterprise:S1078 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dd380abd-e1d8-4c8a-bd87-6e7a110fe0b4

RotaJakiro 2021 netlab360 analysis

ATTACK:enterprise:S1131 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e71bcde1-03cd-46c3-ab59-aede8aefe8b9

Huntress NPPSPY 2022

ATTACK:enterprise:S1091 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e8edbb73-b8bf-42f5-85a3-091b3a4fd955

ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e9a4ceb4-ed33-48c4-b1f3-f73883b0e207

ESET Zebrocy Nov 2018 · ESET Zebrocy May 2019

ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ef704a2d-c73c-4cf1-947d-f70efbee6894

PaloAlto StrelaStealer 2024 · DCSO StrelaStealer 2022 · Fortgale StrelaStealer 2023 · IBM StrelaStealer 2024

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2f93fbb-2164-4de7-9d0b-24ad93caf7f2

Symantec Cicada November 2020

ATTACK:enterprise:S1101 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f3182645-cd5b-43af-b1ec-c1fb9e15f2af

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S0445 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f47a9039-b5c0-49e5-9998-2820b075643f

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0443 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f60b8223-eea6-422e-99c6-7f9b70e8ea53

FireEye MESSAGETAP October 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.