Skip to content

Malicious File

Subtechnique · ATTACK:enterprise:T1204.002

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1204.002",
  "title": "Malicious File",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1204/002",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--232b7f21-adf9-4b42-b936-b9d6f7df856e",
  "external_id": "T1204.002",
  "domain": "enterprise",
  "created": "2020-03-11T14:49:36.954Z",
  "modified": "2026-05-12T15:12:00.623Z",
  "version": "1.6",
  "aliases": [

  ],
  "tactics": [
    "execution"
  ],
  "source_references": [
    {
      "source_name": "Password Protected Word Docs",
      "url": "https://www.bleepingcomputer.com/news/security/psa-dont-open-spam-containing-password-protected-word-docs/"
    },
    {
      "source_name": "Mandiant Trojanized Windows 10",
      "url": "https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government"
    }
  ]
}

Explicit source assertions (201)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1026 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01653d7c-2616-4ccc-9bab-225e897b01f2

SCILabs Malteiro 2021

ATTACK:enterprise:S0669 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08c45e87-edef-455d-a15a-4612f2312e29

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:C0037 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b4b6ab2-df1f-4142-bbfa-5f26980d805b

TrendMicro Pikabot 2024

ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0baf5506-35fb-4508-ba9a-09ca2962df43

Malwarebytes Konni Aug 2021

ATTACK:enterprise:G0005 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c9b6c09-8fc9-42c7-bfd7-316e9bbfa271

Moran 2014 · Trend Micro IXESHE 2012

ATTACK:enterprise:S0453 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d1cb122-5195-4d04-b5c9-85f4747886fa

Malwarebytes Pony April 2016

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e37d046-454c-4463-b27f-f348ef6f817e

Gen Digital Kimsuky HTTPTroy October 2025 · Talos Kimsuky Nov 2021 · CISA AA20-301A Kimsuky · Cybereason Kimsuky November 2020 · Malwarebytes Kimsuky June 2021 · VirusBulletin Kimsuky October 2019 · NaumaanProofpoint_GlobalClickFix_April2025 · ThreatConnect Kimsuky September 2020

ATTACK:enterprise:G0095 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f880e99-efaa-4e85-91c3-cac3d81d6b9a

Cylance Machete Mar 2017 · Securelist Machete Aug 2014 · ESET Machete July 2019 · 360 Machete Sep 2020

ATTACK:enterprise:S0631 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--110ef143-aff1-4e73-abc2-cceaeab69c60

Cybereason Chaes Nov 2020

ATTACK:enterprise:S1064 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11670d59-3a21-4dec-bec4-9e6e8de8d89a

HP SVCReady Jun 2022

ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1262d88d-0eb1-4d19-b84a-9793ef3e4d03

CSM Elderwood Sept 2012 · Symantec Elderwood Sept 2012

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13189e47-4ae9-49ea-8c0f-605177626ada

Proofpoint Operation Transparent Tribe March 2016 · Kaspersky Transparent Tribe August 2020 · Talos Oblique RAT March 2021 · Talos Transparent Tribe May 2021 · Unit 42 ProjectM March 2016

ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13646672-412d-43e8-bd07-f54ef34d79f3

ESET MirrorFace 2025

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14dbc3a9-5e47-454a-805c-b8e22659362f

Gigamon Berserk Bear October 2021

ATTACK:enterprise:G0090 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--178dda13-999c-481f-8a1b-8dc062d7b0ff

Check Point Wirte NOV 2024 · Palo Alto Ashen Lepus DEC 2025 · Kaspersky WIRTE November 2021

ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1873a6d4-fc01-4fd5-aa85-ded977998eab

Check Point Warzone Feb 2020 · Uptycs Confucius APT Jan 2021

ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19b364c2-100b-489c-a48b-fd7829fa5e1e

SecurityScorecard Contagious Interview October 2024 · SecurityScorecard Contagious Interview FamousChollima October 2024

ATTACK:enterprise:S0637 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19ca041f-64be-42f8-9ed1-361410a4c28b

MSTIC Nobelium Toolset May 2021

ATTACK:enterprise:G0048 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1bf08293-5342-4736-b3a9-c1f160ad9c81

Group IB RTM August 2019

ATTACK:enterprise:G1007 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c306018-7f22-4080-81c5-939bd0bd81be

SentinelOne Aoqin Dragon June 2022

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1cd41777-3d65-4e39-8de7-3951d1568c16

Bitdefender Agent Tesla April 2020

ATTACK:enterprise:S0499 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d56986b-e6fd-4624-87b4-5e0dd9f05c2f

FireEye Hancitor

ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fb7af43-604f-4ef7-9594-a61fa7f1d9bc

Palo Alto Ashen Lepus DEC 2025

ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20118b8d-dc6e-4c71-8d99-789901c10e73

Talos PoetRAT April 2020

ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20599767-204a-4cbf-ada7-0f931ee925e4

Check Point Blind Eagle MAR 2025 · Recorded Future TAG-144 AUG 2025 · Zscaler BlindEagle DEC 2025 · QiAnXin APT-C-36 Feb2019

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--219dcd0b-a6fe-47d4-99b9-24d945b1f168

Trend Micro Banking Malware Jan 2019 · Carbon Black Emotet Apr 2019 · IBM IcedID November 2017

ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21cd565f-4cdc-46d6-95b3-32b2d618674e

FireEye Metamorfo Apr 2018 · ESET Casbaneiro Oct 2019

ATTACK:enterprise:S1026 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23ebaddf-0f99-4ed9-9aa4-39577490fa81

SentinelOne Aoqin Dragon June 2022

ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24021025-b5db-4ebb-89cb-49fe5c4d709e

Microsoft Iranian Threat Actor Trends November 2021

ATTACK:enterprise:G0084 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2552aaa5-2cd7-4940-a428-220412851242

Symantec Gallmaker Oct 2018

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--283ba7b1-cd3b-44e9-bfae-70023c53d446

Anomali Pirate Panda April 2020

ATTACK:enterprise:G0070 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--285ab221-15cf-4215-aa68-a8e74b635633

Lookout Dark Caracal Jan 2018

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a58bdf1-2421-434d-938a-28d096f31736

group-ib_redcurl1 · group-ib_redcurl2 · trendmicro_redcurl

ATTACK:enterprise:S0634 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2af5de71-33c3-49d2-9f3e-4fd90919e228

MSTIC Nobelium Toolset May 2021

ATTACK:enterprise:G0079 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b91534d-4687-457b-bcb0-96be9357fa6d

Unit 42 DarkHydrus July 2018 · Unit 42 Playbook Dec 2017

ATTACK:enterprise:S9026 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f58bb9b-17cd-4f5a-a055-891710ed9ab8

Trend Micro Earth Kasha Anel NOV 2024

ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--301ea2aa-e593-4e19-b3d1-7cf7734611ec

Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · EclecticIQ Mustang Panda PlugX

ATTACK:enterprise:G0068 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3350f278-af37-4183-b1be-8d79abce27ac

Microsoft PLATINUM April 2016

ATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33666771-34e3-41a9-8e98-57a99e92c40a

Cylance Dust Storm

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--350e9dad-4dd3-450f-b649-60340710505a

Accenture Hogfish April 2018 · FireEye APT10 April 2017 · FireEye APT10 Sept 2018 · PWC Cloud Hopper Technical Annex April 2017 · District Court of NY APT10 Indictment December 2018

ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--354551e4-c6aa-495a-aba5-b7437c485d34

Unit 42 TA551 Jan 2021

ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36693ec3-9b3c-4129-af32-b8372c75211c

ClearSky Siamesekitten August 2021 · Dragos Hexane · SecureWorks August 2019 · Zscaler Lyceum DnsSystem June 2022

ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3683548e-0331-4407-98b0-82253efc0b09

Securelist Brazilian Banking Malware July 2020

ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38a6e4b2-40c2-41f2-a415-7fbf586cc232

Unit 42 NETWIRE April 2020 · FireEye NETWIRE March 2019 · Proofpoint NETWIRE December 2020

ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3aacea96-941f-4a1d-8981-36d2a0e62cf3

FireEye Obfuscation June 2017 · FireEye Know Your Enemy FIN8 Aug 2016 · FireEye Fin8 May 2016

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d6e0a95-3265-4a0c-aee1-feff2807489b

Trend Micro DRBControl February 2020

ATTACK:enterprise:S0665 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3da23733-c783-4743-8238-5fc96714409b

Kaspersky ThreatNeedle Feb 2021

ATTACK:enterprise:S0660 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3db909a5-8ae8-4ab4-9aa9-910e90155cf3

Trend Micro DRBControl February 2020

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--403e9797-7824-4840-87ad-b975023d9199

Crowdstrike Qakbot October 2020 · Cyberint Qakbot May 2021 · Group IB Ransomware September 2020 · Kaspersky QakBot September 2021 · Trend Micro Qakbot May 2020 · Microsoft Ransomware as a Service · ATT QakBot April 2021 · Kroll Qakbot June 2020 · Trend Micro Qakbot December 2020 · Deep Instinct Black Basta August 2022

ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4127f483-dbd5-4189-84a8-209f04259443

DCSO StrelaStealer 2022

ATTACK:enterprise:C0001 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42f078b7-f1ad-4507-9774-a4673a4c4acd

Talos Frankenstein June 2019

ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--445c926e-e0fb-4ac1-ba70-4ed45a68c592

Forcepoint BITTER Pakistan Oct 2016 · Cisco Talos Bitter Bangladesh May 2022

ATTACK:enterprise:G0137 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--471ea836-ef54-4306-b131-cf66de5811c4

Kaspersky Ferocious Kitten Jun 2021

ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47415b89-a254-49a8-95c4-7efae85cac2c

FireEye APT37 Feb 2018

ATTACK:enterprise:C0005 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48cff69b-577c-4837-b894-95b19f255134

ESET Operation Spalax Jan 2021

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49430af3-18b0-40e1-a500-5deab8ea8e48

Kaspersky ToddyCat June 2022

ATTACK:enterprise:G0140 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4995fdc6-d705-48dc-a2e3-c6797ba2439f

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:G0056 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49be75c9-8484-492e-9ebc-f81d2e203e4e

Talos Promethium June 2020 · Bitdefender StrongPity June 2020

ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49d6508c-f350-4376-ba32-f64693d7fd10

IBM TA505 April 2020 · Trend Micro TA505 June 2019 · Proofpoint TA505 Sep 2017 · ProofPoint SettingContent-ms July 2018 · Proofpoint TA505 June 2018 · Proofpoint TA505 Mar 2018 · Cybereason TA505 April 2019 · Proofpoint TA505 Jan 2019 · Proofpoint TA505 October 2019

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a98aeee-5b53-43ca-a75a-5839792756d7

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:S0635 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4baffcd6-9cdc-4f1e-9b54-4084e7dc2c42

MSTIC Nobelium Toolset May 2021

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e50db0c-4e54-4266-b675-3b279ec45427

FBI FLASH APT39 September 2020 · FireEye APT39 Jan 2019 · BitDefender Chafer May 2020 · Symantec Chafer February 2018

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e7d7d9e-c3d5-4a9d-a948-d50724932321

Google TAG COLDRIVER January 2024

ATTACK:enterprise:S1122 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f5d4ab0-6514-4a99-a5b9-456c903e4717

ESET Security Mispadu Facebook Ads 2019 · Metabase Q Mispadu Trojan 2023 · SCILabs Malteiro 2021

ATTACK:enterprise:S1075 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f99a9ac-ccd8-4c9b-9893-0703ba60543c

Mandiant Suspected Turla Campaign February 2023

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ff8a2ad-2e69-4933-a5f4-201c891eef87

Malwarebytes Higaisa 2020 · Zscaler Higaisa 2020

ATTACK:enterprise:G0075 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--503c4b74-7ca5-45e3-bb11-85a99ca1810f

Rancor Unit42 June 2018

ATTACK:enterprise:S1142 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--510caea2-109f-4936-96e9-3e8125f39b27

ESET Turla Lunar toolset May 2024

ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51656ee5-4d21-42c9-9719-826645b3508f

Unit 42 Valak July 2020 · SentinelOne Valak June 2020 · Cybereason Valak May 2020

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--53e1bf2f-7ab4-4173-879b-9975618c4527

CrowdStrike Grim Spider May 2019 · CrowdStrike Wizard Spider October 2020 · Mandiant FIN12 Oct 2021

ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54e6596d-ca80-4406-93f3-5fab013bc913

IBM Grandoreiro April 2020

ATTACK:enterprise:S0402 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--557288c3-8463-4900-b2e5-aa9856d428cd

Carbon Black Shlayer Feb 2019 · Intego Shlayer Feb 2018

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--557d3feb-0699-429e-bc83-ff114cf138ef

Check Point APT34 April 2021 · ClearSky OilRig Jan 2017 · Unit 42 OopsIE! Feb 2018 · Unit 42 QUADAGENT July 2018 · Crowdstrike Helix Kitten Nov 2018

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55fb787a-6622-43c7-a47d-48b4db7e8d81

ESET Telebots Dec 2016 · US District Court Indictment GRU Unit 74455 October 2020

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56d37b60-03e0-4aac-b106-0350c2a4ec46

ClearSky Kittens Back 3 August 2020

ATTACK:enterprise:S1014 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57c8dc86-93a0-43d6-a47c-f0f5892948b3

ClearSky Siamesekitten August 2021 · SecureWorks August 2019

ATTACK:enterprise:G0085 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59b6b000-c8c5-4b4a-8801-5102de111111

FireEye Hacking FIN4 Video Dec 2014 · FireEye Hacking FIN4 Dec 2014

ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a817bea-020f-47f5-8bf3-80e0c8bdef79

ESET RedLine Stealer November 2024 · Kroll RedLine Stealer August 2024 · McAfee RedLine Stealer April 2024 · Veriti RedLine Stealer MAAS April 2023

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b078c2e-229d-4ef0-8e46-2164354caee9

Talos Cobalt Group July 2018 · Unit 42 Cobalt Gang Oct 2018

ATTACK:enterprise:S0390 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60b2b967-6481-4842-9904-547a7c626ea6

Flashpoint FIN 7 March 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.