Skip to content

Drive-by Compromise

Technique · ATTACK:enterprise:T1189

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1189",
  "title": "Drive-by Compromise",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1189",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--d742a578-d70e-4d0e-96a6-02a9c30204e6",
  "external_id": "T1189",
  "domain": "enterprise",
  "created": "2018-04-18T17:59:24.739Z",
  "modified": "2025-10-24T17:49:28.067Z",
  "version": "1.7",
  "aliases": [

  ],
  "tactics": [
    "initial-access"
  ],
  "source_references": [
    {
      "source_name": "Shadowserver Strategic Web Compromise",
      "url": "http://blog.shadowserver.org/2012/05/15/cyber-espionage-strategic-web-compromises-trusted-websites-serving-dangerous-results/"
    },
    {
      "source_name": "push notification -mcafee",
      "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/scammers-impersonating-windows-defender-to-push-malicious-windows-apps/"
    },
    {
      "source_name": "Push notifications - viruspositive",
      "url": "https://viruspositive.com/resources/blogs/the-dark-side-of-web-push-notifications"
    },
    {
      "source_name": "push notifications - malwarebytes",
      "url": "https://www.malwarebytes.com/blog/news/2019/01/browser-push-notifications-feature-asking-abused"
    }
  ]
}

Explicit source assertions (50)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02fa0350-978f-4b61-b004-82380e70beee

Proofpoint Operation Transparent Tribe March 2016 · Unit 42 ProjectM March 2016 · Talos Transparent Tribe May 2021

ATTACK:enterprise:G0048 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03e67769-31da-4a46-a5a6-1ccbdd0cf29f

ESET RTM Feb 2017 · ESET Buhtrap and Buran April 2019

ATTACK:enterprise:G0068 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0583724d-7778-42ed-995c-acad526db4ba

Microsoft PLATINUM April 2016

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c3668cf-32c1-420f-a1c0-0c8598360ad8

objective-see windtail1 dec 2018

ATTACK:enterprise:M1050 → mitigates → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e6c88fb-11fc-481d-990a-81d74a69e02f

TechNet Moving Beyond EMET · Wikipedia Control Flow Integrity

ATTACK:enterprise:S0215 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2445349c-0bdb-40a7-acca-03f3908b1f35

FireEye APT37 Feb 2018

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25b092ce-9293-4458-95f3-53153a0993dc

Trendmicro_IcedID

ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29a1fc8a-58c3-4465-b170-d9ec7c2d4d22

TrendMicro EarthLusca 2022

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d27c0d9-7e8e-4713-b3e1-0d82db27ac9a

CISA AA20-239A BeagleBoyz August 2020 · FireEye APT38 Oct 2018

ATTACK:enterprise:S0482 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ee78986-9275-4248-9fde-125c3312b657

MacKeeper Bundlore Apr 2019

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37880f36-c47a-4d1f-aedf-bb7d9fb2fd9f

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--478f7f77-6b6b-4949-ac87-f28419b5e2ab

Unit 42 C0d0so0 Jan 2016

ATTACK:enterprise:M1051 → mitigates → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47e2fc5c-3dab-411d-a402-0052d8e725d3

Browser-updates

ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f62c818-2129-4dc2-9f80-105412df4b1d

Kaspersky Darkhotel

ATTACK:enterprise:G0138 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4fd205f2-656f-4211-b60b-510d53dfa8d3

AhnLab Andariel Subgroup of Lazarus June 2018 · TrendMicro New Andariel Tactics July 2018

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51fcdcd6-9c5a-425a-ab87-92d4faeb2ea4

Leonard TAG 2023 · Secureworks IRON TWILIGHT Active Measures March 2017

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5253d038-08a8-4d17-9549-bbcf67c37603

Secureworks IRON LIBERTY July 2019 · US-CERT TA18-074A · Gigamon Berserk Bear October 2021

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54947050-5539-43fe-a1b4-684900c528d4

Mandiant 3cx UNC4736 2023

ATTACK:enterprise:M1048 → mitigates → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56f490de-51e8-47c4-9eae-ecdd1a55e6ef

Windows Blogs Microsoft Edge Sandbox · Ars Technica Pwn2Own 2017 VM Escape

ATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ac3cb45-2d9c-42da-b35f-8f797c2e1ef8

ESET Bad Rabbit · Secure List Bad Rabbit

ATTACK:enterprise:G0070 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ade424d-5a9d-4209-8aa4-a129783ffaa3

Lookout Dark Caracal Jan 2018

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e8f23be-48b6-4236-9475-89f11e769ee6

ESET ComRAT May 2020 · Secureworks IRON HUNTER Profile

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62fd473e-e045-4a47-828a-ab5ee7b4fcf0

Symantec Patchwork · Volexity Patchwork June 2018

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--67b0c62c-ce4f-4e08-8d8c-9e1fd4afe255

CISA AA21-200A APT40 July 2021

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72f9bf47-61ac-42c8-acbf-65be7c25af0f

ESET OceanLotus · Volexity Ocean Lotus November 2020

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--731d14c6-a141-4e71-ac61-c344636e13d5

Symantec Tick Apr 2016

ATTACK:enterprise:M1021 → mitigates → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d8a729c-3656-4b31-85c0-42b75001f913

push notifications -infosecinstitute · mac security virus popup · site notifications - krebsonsecurity

ATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--820a35e0-11fe-42c4-84d2-a29cc5026426

Cylance Dust Storm

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--829f88fc-453a-40d1-8566-90dfe0934173

RATANKBA · Google TAG Lazarus Jan 2021

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83075ee3-b372-48a4-a54c-ca54afdd8c0b

Dell TG-3390 · Securelist LuckyMouse June 2018

ATTACK:enterprise:C0010 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--855c5caf-8553-45d0-a08b-842a9358d138

Mandiant UNC3890 Aug 2022

ATTACK:enterprise:S0451 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--870c08fa-6112-4d08-9b84-59df09f27b4d

ESET LoudMiner June 2019

ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e69eee2-ee5b-4db2-a39e-4446be3afc8f

CERT-UA WinterVivern 2023

ATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e724de0-431e-4db8-b118-979405ede39a

SocGholish-update

ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--91b22928-d538-4460-a5ff-7a0a5e797430

CSM Elderwood Sept 2012 · Symantec Elderwood Sept 2012 · Security Affairs Elderwood Sept 2012

ATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--91ec91fa-f468-47fa-a931-aeb9b4f74ba3

Secureworks REvil September 2019 · McAfee Sodinokibi October 2019 · Picus Sodinokibi January 2020 · Secureworks GandCrab and REvil September 2019

ATTACK:enterprise:G1020 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9a255458-7c76-4705-98f1-e2602ebc7795

SocGholish-update · SentinelOne SocGholish Infrastructure November 2022 · Red Canary SocGholish March 2024 · Secureworks Gold Prelude Profile

ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6d35df2-0711-4b18-b733-6200467056ec

Volexity InkySquid BLUELIGHT August 2021 · FireEye APT37 Feb 2018 · Securelist ScarCruft Jun 2016

ATTACK:enterprise:G0077 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bad12e35-72da-43bb-b61b-505ed72883c5

Symantec Leafminer July 2018

ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bb23e7d5-23d6-4dde-a67f-36e19e8d2250

Securelist Brazilian Banking Malware July 2020 · IBM Grandoreiro April 2020

ATTACK:enterprise:G0095 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bb2be1f4-f2fc-4029-8ee6-e89f52210dfd

Securelist Machete Aug 2014

ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bff4fc3f-9d4d-404f-996c-eaae6426eb0d

PWC Yellow Liderc 2023

ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c041783a-0746-49fd-aa9c-3c680029b3a5

ATTACK:enterprise:S1086 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c7b780c4-7a9a-4eb2-9132-6c80a8671a94

Telefonica Snip3 December 2021

ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e1fe915a-cc33-4aae-8bd2-d60ee0ff110d

ESET EvasivePanda 2024

ATTACK:enterprise:G0056 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e898946c-2c9d-4bf4-9253-67acfadc5b0a

Bitdefender StrongPity June 2020

ATTACK:enterprise:S0216 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f32828b5-ab55-4bf5-af89-1d6e42d559b0

FireEye APT37 Feb 2018

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f8e92dfb-d6c2-42bc-a56c-19f690d9b957

Logpoint_StealerMalwareFamilies_2024

ATTACK:enterprise:G0124 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f983de6b-eb17-4947-b4b0-50bd530f50e3

ESET Windigo Mar 2014

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff16b0d1-e77c-4985-85cb-842da787daf3

ClearSky Kittens Back 3 August 2020

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.