Traffic Signaling
Technique · ATTACK:enterprise:T1205
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1205",
"title": "Traffic Signaling",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1205",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--451a9977-d255-43c9-b431-66de80130c8c",
"external_id": "T1205",
"domain": "enterprise",
"created": "2018-04-18T17:59:24.739Z",
"modified": "2026-05-12T15:12:00.629Z",
"version": "3.0",
"aliases": [
],
"tactics": [
"stealth",
"persistence",
"command-and-control"
],
"source_references": [
{
"source_name": "Bleeping Computer - Ryuk WoL",
"url": "https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/"
},
{
"source_name": "AMD Magic Packet",
"url": "https://www.amd.com/system/files/TechDocs/20213.pdf"
},
{
"source_name": "Mandiant - Synful Knock",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/synful-knock-acis/"
},
{
"source_name": "Cisco Synful Knock Evolution",
"url": "https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices"
},
{
"source_name": "Hartrell cd00r 2002",
"url": "https://www.giac.org/paper/gcih/342/handle-cd00r-invisible-backdoor/103631"
},
{
"source_name": "Cisco Blog Legacy Device Attacks",
"url": "https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954"
}
]
}Explicit source assertions (27)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--15c274dd-c045-43d6-a038-fa969dd04c8d
Mandiant Cutting Edge Part 3 February 2024ATTACK:enterprise:S1114 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27611566-a11a-4e43-96be-a221878cbf23
Mandiant Cutting Edge January 2024ATTACK:enterprise:S1118 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--291e3bfc-90e7-44ac-828c-8bbf7b36431c
Mandiant Cutting Edge Part 3 February 2024ATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b5e8e16-ddf4-4339-859b-f70f980d612b
ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5488dd31-2a28-4250-89ff-963214f46b92
Kaspersky Turla Penquin December 2014 · Leonardo Turla Penquin May 2020ATTACK:enterprise:S0519 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d9b14c3-70ea-46b3-9b0d-1595c215efec
Mandiant - Synful KnockATTACK:enterprise:T1205.001 → subtechnique-of → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--624c4ae2-f367-4be2-a584-0fb5ec94c694
ATTACK:enterprise:S0430 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76625152-3f62-4a1e-a769-5503811b0276
Chronicle Winnti for Linux May 2019ATTACK:enterprise:S0220 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--788ec1d9-9192-46c9-8bc3-7397ccb854df
Chaos Stolen BackdoorATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ad7a5f3-8c10-4677-b0ce-f41fbb6f0306
Hunt.io TeamPCP Toolkit MAY 2026ATTACK:enterprise:S0221 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--85af8200-2e4c-4253-a334-0390ac4065f8
Umbreon Trend MicroATTACK:enterprise:S0641 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--894e96b2-2dac-4958-8f14-8eacf169b9b6
ESET Kobalos Feb 2021 · ESET Kobalos Jan 2021ATTACK:enterprise:S0664 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f27fb1d-f888-4167-a08c-781dde29755d
Trend Micro Iron Tiger April 2021ATTACK:enterprise:S0446 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9fb463af-4ad8-48b5-89cf-68bac34a68d7
Bleeping Computer - Ryuk WoLATTACK:enterprise:S1219 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a0a94b9a-a81f-4ca6-b98c-f81291402f61
Google Cloud Mandiant UNC3886 2024 · Mandiant Fortinet Zero DayATTACK:enterprise:T1205.002 → subtechnique-of → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a31ed7a5-8ed3-46e7-8e3b-32935023e19b
ATTACK:enterprise:S1203 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b3bd6363-e6dc-4c4a-ac41-2091127e1860
Lumen J-Magic JAN 2025ATTACK:enterprise:S9011 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf16e2d4-6d9a-4487-882a-776012a21831
Picus Security UNC5221 Ivanti May 2025ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c2a79396-f264-4439-94f1-113e3bf3a6be
ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc0c7d4b-eebb-4e95-9e03-972b1e943208
CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024 · IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025 · 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload · PaloAlto MUSTANG PANDA PUBLOAD MARCH 2024ATTACK:enterprise:S1201 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d3f8f346-d5a7-4a3a-ad15-ea872e12781e
Zscaler Kimsuky TRANSLATEXTATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d71ad22f-7e01-4140-9080-bce4ae880880
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d74d9573-af4b-4984-ba5c-2cbd2b010fb2
Mandiant Fortinet Zero DayATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--de50e857-f9c7-4d62-a228-91f1aa226e21
Trend Micro Mustang Panda Earth Preta Toneshell February 2025 · 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload · Trend Micro Mustang Panda Earth Preta TONESHELL June 2023ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--df4f6956-07d1-49ec-bc7f-b1b1bfd7a244
Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb3ab439-c88b-4ef5-befd-8a356b6570c5
CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ede02fd1-e1c4-434e-a1be-732b3255eacd
Zscaler Kimsuky TRANSLATEXT