Shared Modules
Technique · ATTACK:enterprise:T1129
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1129",
"title": "Shared Modules",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1129",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--0a5231ec-41af-4a35-83d0-6bdf11f28c65",
"external_id": "T1129",
"domain": "enterprise",
"created": "2017-05-31T21:31:40.542Z",
"modified": "2026-09-11T19:58:20.992Z",
"version": "2.3",
"aliases": [
],
"tactics": [
"execution"
],
"source_references": [
{
"source_name": "RotaJakiro 2021 netlab360 analysis",
"url": "https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/"
},
{
"source_name": "Apple Dev Dynamic Libraries",
"url": "https://developer.apple.com/library/archive/documentation/DeveloperTools/Conceptual/DynamicLibraries/100-Articles/OverviewOfDynamicLibraries.html"
},
{
"source_name": "Unit42 OceanLotus 2017",
"url": "https://unit42.paloaltonetworks.com/unit42-new-improved-macos-backdoor-oceanlotus/"
},
{
"source_name": "Microsoft DLL",
"url": "https://learn.microsoft.com/troubleshoot/windows-client/deployment/dynamic-link-library"
},
{
"source_name": "Linux Shared Libraries",
"url": "https://tldp.org/HOWTO/Program-Library-HOWTO/shared-libraries.html"
}
]
}Explicit source assertions (24)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02d4ee3d-adb9-49fc-8e91-3379c508692b
Gh0stRAT ATT March 2019ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--15455c48-f71c-480d-91b8-e41f12608705
Symantec Trojan.Hydraq Jan 2010 · Symantec Hydraq Jan 2010ATTACK:enterprise:S0196 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--163c1ca5-c5cb-4cc8-b9e4-d0a137d41e52
FireEye Know Your Enemy FIN8 Aug 2016ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--261e7ed2-9252-40ea-9f06-abc45797c004
Nicolas Falliere, Liam O Murchu, Eric Chien February 2011ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c89cab1-efbb-405c-930d-197ae1910e5b
ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30c9343b-bb15-494a-a1cf-4449131ec216
Cybereason Astaroth Feb 2019ATTACK:enterprise:S1185 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5cf3da17-8c0a-4a4d-8926-3fc251085ddf
Huntress LightSpy macOS 2024ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--75640de7-9608-4c19-a0b3-6fb4816ec56a
Trend Micro KillDisk 1ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79cb18f3-0640-4b9d-9e93-62e3300f99d8
Fortinet Metamorfo Feb 2020ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a520abb-af16-4501-935c-bb13fc490813
Eset PlugX Korplug Mustang Panda March 2022ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7bbc0809-d6ba-4be5-9397-e44b9481f317
Prevailion DarkWatchman 2021ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--831513ed-bbf2-406f-ab74-bfffa8a376b7
ESET Attor Oct 2019ATTACK:enterprise:S0661 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91d0f880-8928-4173-bb2f-518876a8c0b3
MSTIC FoggyWeb September 2021ATTACK:enterprise:S1078 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9da28d8d-5111-491a-9557-bee7004fc3a6
RotaJakiro 2021 netlab360 analysisATTACK:enterprise:S0520 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2c141ff-d733-4d73-96af-618ed26b7547
US-CERT BLINDINGCAN Aug 2020ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a7ec0d1d-462b-4909-acee-f2aa1f9199b1
Medium Ali Salem Bumblebee April 2022ATTACK:enterprise:S0467 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b4ef6c6e-d7aa-451a-b071-faf0138cfbff
Kaspersky TajMahal April 2019ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--da8e4a55-195f-4fbc-8a8b-565581d3a3d4
ESET Ebury May 2024ATTACK:enterprise:S0415 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db3b37f1-9c85-4e52-bbd7-4b71ad68400d
FireEye FIN7 Oct 2019ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e07d9070-6989-43e7-aee0-1b18aff1ffbe
CyberBit DtrackATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e6e81473-84f4-40f0-b7a1-122599f801e6
Unit42 OceanLotus 2017ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f1c37a4a-bcfe-4626-94bb-749112023a44
QuorumCyber_Vidar_March2023ATTACK:enterprise:S0501 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f77738b8-e17c-4b6b-98fc-ffcc569cc008
ESET PipeMon May 2020ATTACK:enterprise:S1154 → uses → ATTACK:enterprise:T1129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fd385a66-84ba-4bd5-8ab2-afd7c7699e57
Lumen Versa 2024