Skip to content

Network Share Discovery

Technique · ATTACK:enterprise:T1135

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1135",
  "title": "Network Share Discovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1135",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--3489cfc5-640f-4bb3-a103-9137b97de79f",
  "external_id": "T1135",
  "domain": "enterprise",
  "created": "2017-12-14T16:46:06.044Z",
  "modified": "2025-10-24T17:48:37.475Z",
  "version": "3.2",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "TechNet Shared Folder",
      "url": "https://technet.microsoft.com/library/cc770880.aspx"
    },
    {
      "source_name": "Wikipedia Shared Resource",
      "url": "https://en.wikipedia.org/wiki/Shared_resource"
    }
  ]
}

Explicit source assertions (80)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--003eed51-a560-44f1-9149-5a11bdaebe6f

BitDefender BADHATCH Mar 2021

ATTACK:enterprise:S1180 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--037f8492-bbc1-481e-bbbe-d23f2f7d2870

Trustwave BlackByte 2021

ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0428220b-eb98-45c3-a637-7da54b4496b4

Eset Ramsay May 2020 · Antiy CERT Ramsay April 2020

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05c33a7a-bfd0-4374-a617-f2c407461acb

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:S0575 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0852ea69-52d5-46d0-9847-3af87c8b15dc

CarbonBlack Conti July 2020 · CrowdStrike Wizard Spider October 2020

ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09673a33-d15e-460a-8980-55c67ee2bb19

TrendMicro Tonto Team October 2020

ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--160fe071-f28f-47c3-a87c-e7cfc9e72f31

Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · Broadcom Medusa Ransomware Medusa Group March 2025 · Security Scorecard Medusa Ransomware January 2024

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ba0b437-e809-479c-a254-172e706c3615

ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--203108df-424d-4dfe-ac45-3cbd84c71615

NCC Group Team9 June 2020

ATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20d2449b-aa52-40bc-8a7a-5c6f72eb3ce0

Bitsight Latrodectus June 2024 · Elastic Latrodectus May 2024

ATTACK:enterprise:S0625 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--268e786f-a23c-4bf3-a331-e2b9163b2974

McAfee Cuba April 2021

ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2beb9f29-a94b-469a-870e-2e2072bf941c

Symantec Orangeworm April 2018

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f6ae8d7-29ee-4af6-9284-f698393ee1b7

Trend Micro Qakbot May 2020 · Kaspersky QakBot September 2021

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--307e732c-c407-4466-951b-38062bb5e32b

BitDefender Chafer May 2020

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--348d10f4-8519-47a0-89d4-24119c18b638

GitHub SILENTTRINITY Modules July 2019

ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39aeaed2-f7ca-4fb6-8268-13e8e995461e

Fortinet Diavol July 2021

ATTACK:enterprise:G0105 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a31f8c0-36bf-40b5-90d2-d03c72b2c8d8

Securelist DarkVishnya Dec 2018

ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b5d1788-c59b-4e84-97b0-b109df608619

ATTACK:enterprise:S1141 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3bb1eae7-1653-4a38-9b4b-6bd93503f6ca

ESET Turla Lunar toolset May 2024

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c3f5cdb-f2cd-4bab-8196-26f160b38a5e

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:S0618 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--422b117a-9cb1-4d03-9b2d-000de5d8526e

NCC Group Fivehands June 2021

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--491dc622-fa43-4015-b24a-8ec8d8f5a376

Binary Defense Emotes Wi-Fi Spreader

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f6e677d-427b-4342-b35c-57f4f3ad4ff8

FireEye APT41 Aug 2019 · Group IB APT 41 June 2021

ATTACK:enterprise:S1085 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55ec954d-e553-4055-bc56-56b9dd0c433f

Bitdefender Sardonic Aug 2021

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5bc76bbe-dd5b-4787-ba2d-67ff5d76fbe9

CISA Medusa Group Medusa Ransomware March 2025

ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e7460f8-9ea9-4aa4-b06e-15861b02d70e

Eset PlugX Korplug Mustang Panda March 2022 · CIRCL PlugX March 2013

ATTACK:enterprise:S0488 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61d859c1-c6f4-4f5f-bc5f-032481dddbe4

CME Github September 2018

ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6743c3f6-7f4f-40b3-bc9e-fe488f81f5e1

Crowdstrike Indrik November 2018

ATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c62f14a-0c1a-4dea-82eb-8c352d0c5f70

Cybereason INC Ransomware November 2023

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e1fe223-d295-4784-b64a-2e2b6586b782

Halcyon Qilin.B OCT 2024 · Trend Micro Agenda Ransomware AUG 2022

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6fa815b2-23dc-455f-b358-dacb4e30a073

Github PowerShell Empire

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71cac5bb-2d68-44b8-ae8a-4d159c06ec61

NCC Group Chimera January 2021

ATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7431f8d2-32df-4b26-8b17-24f10f861fde

ESET Bad Rabbit

ATTACK:enterprise:S1181 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b2c432a-d474-4172-ad7b-06b84dc813ae

Microsoft BlackByte 2023

ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7cbc6309-f5fb-41e5-901b-67f02f29a834

ESET Trickbot Oct 2020 · Bitdefender Trickbot March 2020

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d7e63bb-1b78-459d-a300-d21bb270ad7d

FoxIT Wocao December 2019

ATTACK:enterprise:S1075 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e7479b9-57c6-4c40-898b-3c590e93d6f1

Mandiant Suspected Turla Campaign February 2023

ATTACK:enterprise:S1247 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ed71499-07cb-4cea-9a7e-5822a69b28e3

Cyble Embargo Ransomware May 2024

ATTACK:enterprise:S1129 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ef41aaa-7625-4168-b040-92972454b8fb

Kersten Akira 2023

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8129042e-5e4b-412b-bbb7-a127312abf25

FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82660969-2c24-46a6-a451-1b41240b9ed7

CISA AA20-239A BeagleBoyz August 2020 · Microsoft Sapphire Sleet APR 2026

ATTACK:enterprise:S1073 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--855347b7-4f23-4565-8738-f21a014c75cc

Cybereason Royal December 2022

ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c263b12-46f5-452c-908e-3bc80fba3bf5

Cisco Ukraine Wipers January 2022

ATTACK:enterprise:S0617 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8debe90d-927a-4195-b796-793e9b1730ee

FireEye FiveHands April 2021

ATTACK:enterprise:S0660 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e744873-e85e-4b7c-b36c-96448e600c43

Trend Micro DRBControl February 2020

ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98b296c0-467b-4029-a813-0cd94c0a9520

Joint Cybersecurity Advisory LockBit 3.0 MAR 2023

ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9cd85648-3618-4817-a178-d36d7c40631c

Sophos BlackCat Jul 2022 · Microsoft BlackCat Jun 2022

ATTACK:enterprise:C0049 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ce73f8c-85c0-45ee-93a2-11475e14de19

CISA Leviathan 2024

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a106b02a-0a6a-493f-911c-a00576013004

Cobalt Strike TTPs Dec 2017

ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7be99ec-2a20-406a-b552-7c32760bb52c

Arxiv Avaddon Feb 2021

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a9d3ddcc-36fa-44d8-9a0a-07688467a137

Cisco BlackByte 2024

ATTACK:enterprise:S0696 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a9df6783-2c1d-417b-8cee-d9738416a183

NTT Security Flagpro new December 2021

ATTACK:enterprise:S9045 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--af151fa2-39c4-4f60-a66c-8e67982e83b6

AI-Mexico-Govt-Compromise

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--af69bb4e-4cdb-4a9d-afff-5508c99c1276

Windows Anonymous Enumeration of SAM Accounts

ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b8e128df-429d-4a98-9b34-b179272a8344

Mcafee Clop Aug 2019

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba575869-1ac0-4681-aee2-37ecd3e6fed5

DFIR_Quantum_Ransomware

ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bba92907-b2fd-4f62-b356-63fab9d714dd

Sogeti CERT ESEC Babuk March 2021

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c31ccdbd-e501-41cb-98d9-46cdff9be1c0

Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4f4fe39-af57-47d3-8428-fe5bce63bdbb

TrendMicro TropicTrooper 2015

ATTACK:enterprise:S1212 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c5645eeb-3d3d-4ac8-b9c1-2948ec35d425

Group-IB RansomHub FEB 2025

ATTACK:enterprise:S0612 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6f2a62f-3aae-4245-8477-4d2ae96498d8

Sentinel Labs WastedLocker July 2020

ATTACK:enterprise:S0365 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c72b2674-e757-4290-9275-cc08a12713be

Talos Olympic Destroyer 2018

ATTACK:enterprise:G1032 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c7ed191d-dbff-48c9-8a6b-baf056156baf

Huntress INC Ransom Group August 2023

ATTACK:enterprise:G0054 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc495391-9abd-4df1-8ad7-ec8d84feaeb9

Symantec Sowbug Nov 2017

ATTACK:enterprise:S0233 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cffbdd23-bf18-4bb9-bd50-dc74b69784e2

FireEye Periscope March 2018

ATTACK:enterprise:S0165 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d07f2da6-6497-414f-96c1-9dd60155b169

Symantec Buckeye

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d25f8661-bb36-479b-b5ca-ff21abc656b8

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2ef2109-c65f-452b-bb5b-dd06d1b16602

FOX-IT May 2016 Mofang

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2f19ee3-8e1c-46e4-b803-e8b3fa36f62e

US-CERT TA18-074A

ATTACK:enterprise:S1053 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d421d0ce-6821-4d06-9249-214daacac1b0

Joint CSA AvosLocker Mar 2022 · Malwarebytes AvosLocker Jul 2021

ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d7f25b51-f596-4745-8c2d-b0fa074a89b5

Cybereason OperationCuckooBees May 2022

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e07b76a4-98d7-4adc-b90e-a1f7f2266867

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e1d0ec8e-0970-4737-9605-1cf8a3ba1371

ESET InvisiMole June 2018

ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e27ebd5b-4ed3-4c04-96e3-026bd127ed64

Securelist Sofacy Feb 2018

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eaebb080-e57e-4c06-84df-376cc8bff09e

DHS/CISA Ransomware Targeting Healthcare October 2020

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f25505f6-dbd0-4d7b-8e8c-b3885f206cbf

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f3f8ff44-e693-4ba6-8ac8-3aa9d2d38969

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026

ATTACK:enterprise:S0616 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f723b67d-5d1a-4bb2-8e0c-3d418bd93295

FireEye FiveHands April 2021

ATTACK:enterprise:S0686 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f728406e-2862-4eca-be0e-2835255a49cd

Microsoft Actinium February 2022

ATTACK:enterprise:S1159 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff27aa33-f4da-424e-be51-ade535b359b3

Google Cloud APT41 2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.