Code Repositories
Subtechnique · ATTACK:enterprise:T1213.003
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1213.003",
"title": "Code Repositories",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1213/003",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--cff94884-3b1c-4987-a70b-6d5643c621c3",
"external_id": "T1213.003",
"domain": "enterprise",
"created": "2021-05-11T18:51:16.343Z",
"modified": "2026-05-12T15:12:00.717Z",
"version": "1.2",
"aliases": [
],
"tactics": [
"collection"
],
"source_references": [
{
"source_name": "Wired Uber Breach",
"url": "https://www.wired.com/story/uber-paid-off-hackers-to-hide-a-57-million-user-data-breach/"
},
{
"source_name": "Krebs Adobe",
"url": "https://krebsonsecurity.com/2013/10/adobe-to-announce-source-code-customer-data-breach/"
}
]
}Explicit source assertions (15)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1213.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e610bf7-149f-46f2-9177-cf5f745488ad
ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1213.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b7d9c6e-8149-4b2f-91a2-e80ec673e42d
NCC Group LAPSUS Apr 2022 · MSTIC DEV-0537 Mar 2022ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1213.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--45e23658-bbbb-46ff-a1f3-ad370c2a3ad5
Koi Glassworm New Tricks December 2025 · Koi Glassworm InvisibleCode October 2025 · Socket GlassWorm January 2026ATTACK:enterprise:T1213.003 → subtechnique-of → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b060a1c-932f-4864-a5a4-83f324b62338
ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1213.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79305255-7451-45ad-b265-b641e97f7182
Intel471_SH_Aug2021ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1213.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8e09a040-057f-4b15-80c3-e7e299b274df
CISA Scattered Spider Advisory November 2023 · MSTIC Octo Tempest Operations October 2023ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1213.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91c1be4d-6031-4e86-a4af-192e345d836d
Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1213.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93dc5023-3f2b-41a3-bd5a-68121a94280d
Microsoft Internal Solorigate Investigation BlogATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1213.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--99e7e929-1e72-4d9a-8997-15f977f36218
ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1213.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b33f3a0e-d6ae-467c-8d4e-d92fc1bcfb86
Phoenix TeamPCP 20 MAY 2026ATTACK:enterprise:S9008 → uses → ATTACK:enterprise:T1213.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b9e23661-ec72-4e1f-8025-04e2ec12a82a
Aikido Shai-Hulud September 2025ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1213.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cb8572e5-de4e-4160-ba8c-d994ebd01e51
ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1213.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d0f0a908-c1d6-4783-8396-2137ced13603
Rostovcev APT41 2021ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1213.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f8878fab-91a9-49d2-b985-fefa10e22ade
ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1213.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff945dd5-cfe6-46a9-9aa3-bdb454e55447
Github TruffleSecurity Trufflehog April 2025