Skip to content

Data Encrypted for Impact

Technique · ATTACK:enterprise:T1486

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1486",
  "title": "Data Encrypted for Impact",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1486",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--b80d107d-fa0d-4b60-9684-b0433e8bdba0",
  "external_id": "T1486",
  "domain": "enterprise",
  "created": "2019-03-15T13:59:30.390Z",
  "modified": "2026-05-12T15:12:00.709Z",
  "version": "1.5",
  "aliases": [

  ],
  "tactics": [
    "impact"
  ],
  "source_references": [
    {
      "source_name": "CarbonBlack Conti July 2020",
      "url": "https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/"
    },
    {
      "source_name": "FireEye WannaCry 2017",
      "url": "https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html"
    },
    {
      "source_name": "Rhino S3 Ransomware Part 1",
      "url": "https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/"
    },
    {
      "source_name": "Halcyon AWS Ransomware 2025",
      "url": "https://www.halcyon.ai/blog/abusing-aws-native-services-ransomware-encrypting-s3-buckets-with-sse-c"
    },
    {
      "source_name": "Varonis",
      "url": "https://www.varonis.com/blog/vmware-esxi-in-the-line-of-ransomware-fire"
    },
    {
      "source_name": "Crowdstrike Hypervisor Jackpotting Pt 2 2021",
      "url": "https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/"
    },
    {
      "source_name": "NHS Digital Egregor Nov 2020",
      "url": "https://digital.nhs.uk/cyber-alerts/2020/cc-3681#summary"
    },
    {
      "source_name": "US-CERT Ransomware 2016",
      "url": "https://www.us-cert.gov/ncas/alerts/TA16-091A"
    },
    {
      "source_name": "US-CERT NotPetya 2017",
      "url": "https://www.us-cert.gov/ncas/alerts/TA17-181A"
    },
    {
      "source_name": "US-CERT SamSam 2018",
      "url": "https://www.us-cert.gov/ncas/alerts/AA18-337A"
    }
  ]
}

Explicit source assertions (89)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--006e029e-0714-4f99-befd-53b9fbc7c8c8

FireEye Maze May 2020

ATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0252fc3f-1bf0-433f-b619-b874137f84f3

Secure List Bad Rabbit

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02c4488b-6041-4222-9363-18a63ce3b835

wardle evilquest partii

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02e23a00-846a-4b86-9146-4a7354c23667

FireEye APT38 Oct 2018

ATTACK:enterprise:S0481 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05951058-e8d4-4ace-a6b8-54735c6a4769

Sophos Ragnar May 2020 · Cynet Ragnar Apr 2020

ATTACK:enterprise:G1032 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05a9fa5f-7273-4c4e-846c-1b04754208c6

Secureworks GOLD IONIC April 2024 · Cybereason INC Ransomware November 2023 · SentinelOne INC Ransomware · SOCRadar INC Ransom January 2024 · Huntress INC Ransom Group August 2023 · Bleeping Computer INC Ransomware March 2024

ATTACK:enterprise:S1180 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0802fe34-8d63-4ac8-9143-a7a386868c47

Trustwave BlackByte 2021

ATTACK:enterprise:C0038 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0fbd1a64-07c1-4b5f-bb3a-2de93a9088a9

CISA Iran Albanian Attacks September 2022 · Mandiant ROADSWEEP August 2022 · Microsoft Albanian Government Attacks September 2022

ATTACK:enterprise:S1073 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11e07c1f-4b28-459f-92db-ab4ebe1c5740

Cybereason Royal December 2022 · Kroll Royal Deep Dive February 2023 · Trend Micro Royal Linux ESXi February 2023

ATTACK:enterprise:S0389 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--164aec0b-1e3e-4e79-b9c3-43d602a1674a

Carbon Black JCry May 2019

ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17f8969b-b2a5-440f-bf7b-9214826fe5f7

Check Point VOID MANTICORE Handala Hack March 2026 · DOJ FBI Handala Hack March 2026

ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18355c9b-c3e8-4bc7-a389-425e5d7c6351

Sogeti CERT ESEC Babuk March 2021 · McAfee Babuk February 2021 · Medium Babuk February 2021 · Trend Micro Ransomware February 2021

ATTACK:enterprise:S1137 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--187b15ea-f564-4abf-80d8-756115f47be2

CheckPoint Agrius 2023

ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18fbf9cb-5008-4701-99de-11cfa35978df

ESET MirrorFace DEC 2022 · Kaspersky LODEINFO Part II OCT 2022 · ITOCHU LODEINFO JAN 2024

ATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c30f3e0-f621-4e59-934d-f4091cb9eca5

Talos Sodinokibi April 2019 · Secureworks REvil September 2019 · Cylance Sodinokibi July 2019 · Intel 471 REvil March 2020 · Kaspersky Sodin July 2019 · Picus Sodinokibi January 2020 · McAfee REvil October 2019 · Tetra Defense Sodinokibi March 2020

ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e549632-405c-49fc-8594-3666ad22c681

Fortinet Diavol July 2021

ATTACK:enterprise:S0625 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2212e364-d161-49ba-9a3f-a4e9e2260b2e

McAfee Cuba April 2021

ATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22409a5a-ed28-4930-a6ed-73e82f3b411b

Palo Alto TeamPCP MAR 2026

ATTACK:enterprise:S1162 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23f12b64-a938-4cf7-97ab-81e90ee3992d

CISA Play Ransomware Advisory December 2023 · Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--277e1ee7-74d2-4024-8975-4611d2e87430

CarveyODonnellWelchHuntress_TheGentlemen_May2026 · TrendAI_TheGentlemen_Sept2025 · Sophos_TheGentlemen_Sept2026 · SoučekESET_Gentlemen_Jun2026

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27b82cee-dbc4-44c9-9f00-2168b8921a27

Ensilo Darkgate 2018

ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29cec373-a87c-444b-b192-9ab94f69a008

Microsoft BlackCat Jun 2022

ATTACK:enterprise:S1058 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a28ee8a-0ecd-43da-a4f8-a653ef5fd123

Microsoft Prestige ransomware October 2022

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30da3c92-05b8-40fd-b8b6-29cb20a597a1

DFIR Phosphorus November 2021 · Microsoft Iranian Threat Actor Trends November 2021

ATTACK:enterprise:S0372 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31daba72-fb27-45a9-9224-991032b605a8

CarbonBlack LockerGoga 2019 · Unit42 LockerGoga 2019 · Wired Lockergoga 2019

ATTACK:enterprise:S0616 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34c6a059-9496-4f1e-9331-c1986e62b6a1

FireEye FiveHands April 2021

ATTACK:enterprise:S0605 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36106fcd-5f7f-47b9-8a45-1faa89d2ba36

Dragos EKANS · Palo Alto Unit 42 EKANS

ATTACK:enterprise:S0654 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e3df746-053d-42e6-95c7-3f99c31be8be

Group IB Ransomware September 2020

ATTACK:enterprise:S1053 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40861c0e-9cbc-4355-a7c0-cc0405c70b82

Joint CSA AvosLocker Mar 2022 · Malwarebytes AvosLocker Jul 2021 · Trend Micro AvosLocker Apr 2022 · Cisco Talos Avos Jun 2022

ATTACK:enterprise:S0617 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4765866e-48c9-48f7-a2c0-cb1251680b56

FireEye FiveHands April 2021

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47a9cbf2-d225-4cdd-ad8a-760e2c32f6cb

CrowdStrike Scattered Spider JUL 2025 · Check Point Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023 · Mandiant VMware vSphere JUL 2025 · MSTIC Octo Tempest Operations October 2023

ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4c8da471-3483-4f75-8e1a-952d2d05454d

Crowdstrike Indrik November 2018

ATTACK:enterprise:S1096 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50fc9c04-4251-43f3-8c88-3fc58a3b4b5b

Sygnia Emperor Dragonfly October 2022 · Trend Micro Cheerscrypt May 2022

ATTACK:enterprise:S1181 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--53ab3350-e0d1-4376-94f1-8402c4f97cfa

Microsoft BlackByte 2023

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c56206f-8ae3-4296-ab89-bc2036b74896

FireEye WannaCry 2017 · SecureWorks WannaCry Analysis · LogRhythm WannaCry

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ed383c7-a4b7-441b-8f99-a9927689aea0

BlackBerry_FIN7_April2024 · Mandiant FIN7 Apr 2022 · CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:S1150 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5f408271-9f8a-4eab-ac54-a8c81be61724

CISA Iran Albanian Attacks September 2022 · Mandiant ROADSWEEP August 2022 · Microsoft Albanian Government Attacks September 2022

ATTACK:enterprise:S1033 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--696c0ce2-7829-4d95-baab-ae64db59c62a

Checkpoint MosesStaff Nov 2021

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6aedddc0-0c82-48f0-b9cc-071d440a367c

BlackBerry Black Basta May 2022 · Check Point Black Basta October 2022 · Cyble Black Basta May 2022 · Palo Alto Networks Black Basta August 2022 · Trend Micro Black Basta May 2022 · NCC Group Black Basta June 2022 · Uptycs Black Basta ESXi June 2022 · Trend Micro Black Basta Spotlight September 2022 · Deep Instinct Black Basta August 2022 · Minerva Labs Black Basta May 2022

ATTACK:enterprise:S0612 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c1ca5ac-fa01-44f3-997c-ef8b28dc22f3

Symantec WastedLocker June 2020 · NCC Group WastedLocker June 2020 · Sentinel Labs WastedLocker July 2020

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6cfee0a9-4f55-42e9-8670-86a0fa3e6280

Costa AvosLocker May 2022 · Cisco Talos Avos Jun 2022

ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72afd916-54df-4524-acbd-1058b5dbe650

Microsoft Storm-0501 Embargo Ransomware August 2025

ATTACK:enterprise:S0583 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7893dc40-721b-4455-b411-3ccda7f4a3a2

CERT-FR PYSA April 2020

ATTACK:enterprise:S1178 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78a8b5dd-0dfc-4dea-bc07-b5a3a10f0483

Kaspersky ShrinkLocker 2024 · Splunk ShrinkLocker 2024

ATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d8dcd8d-3ca4-4464-b8ab-9dee24f93c70

Cybereason INC Ransomware November 2023 · SentinelOne INC Ransomware · SOCRadar INC Ransom January 2024 · Huntress INC Ransom Group August 2023

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89b2422c-6b9a-479c-bb07-52e73967066a

Picus Qilin MAR 2025 · Halcyon Qilin.B OCT 2024 · HC3 Qilin Threat Profile JUN 2024 · Trend Micro Agenda Ransomware AUG 2022 · SentinelOne Qilin NOV 2022 · Cisco Talos Qilin Ransomware OCT 2025 · BushidoToken Qilin RaaS JUN 2024 · Trend Micro Agenda Ransomware OCT 2025

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89bd9b10-f1cb-4569-977c-784cbfbb23e1

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:S0576 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b245546-d5ed-4ff8-b5a6-7c97250ce026

IBM MegaCortex · mbed-crypto

ATTACK:enterprise:S0242 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c1c7c51-f9bf-4163-a01b-7d922a2d1a93

SecureList SynAck Doppelgänging May 2018

ATTACK:enterprise:S0618 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--93f1d277-685d-46ee-a796-a50641364fbc

FireEye FiveHands April 2021 · CISA AR21-126A FIVEHANDS May 2021 · NCC Group Fivehands June 2021

ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--965ddb53-b695-4e13-9f3b-dba8c6509edb

Microsoft SharePoint Exploit JUL 2025 · Palo Alto SharePoint Vulnerabilities JUL 2025

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--973de5df-473f-4791-877d-9c8e7b5527e4

Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025 · Security Scorecard Medusa Ransomware January 2024

ATTACK:enterprise:S0575 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97ef26b5-5dda-458b-926e-933ec0d099d6

CarbonBlack Conti July 2020 · Cybleinc Conti January 2020 · DFIR Conti Bazar Nov 2021 · CrowdStrike Wizard Spider October 2020 · Cybereason Conti Jan 2021

ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98ccbadd-dbfa-44d3-b3f2-3a55c8fa37e1

Unit42 Xbash Sept 2018

ATTACK:enterprise:S0556 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9a8d5690-94b9-46d2-a383-6f26a3c25c80

ClearkSky Fox Kitten February 2020 · Check Point Pay2Key November 2020

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c8dee77-e751-40b6-ab99-ccfe6a832e0a

Halcyon AWS Ransomware 2025 · win10_asr

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e65e16c-eecc-4b8f-befa-01a5cf94ca8c

Microsoft Prestige ransomware October 2022

ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ed66c72-199a-47d7-8bdd-95c34a370d33

CISA Akira Ransomware APR 2024 · BushidoToken Akira 2023

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a33939b9-83e7-435a-bfc5-1889d720b7ec

Microsoft Storm-1811 2024

ATTACK:enterprise:S1212 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3e75daa-c9a5-41c5-9225-dd7b69400edc

Group-IB RansomHub FEB 2025 · CISA RansomHub AUG 2024

ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3eb4cec-8053-4830-b256-e46748dba3d9

NHS Digital Egregor Nov 2020 · Cybereason Egregor Nov 2020

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5ee5826-e742-4847-9816-d9124827262a

Crowdstrike Indrik November 2018 · Mandiant_UNC2165

ATTACK:enterprise:S0368 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aac8f64e-54d1-4aad-80ee-dd3cd887f30e

Talos Nyetya June 2017 · US-CERT NotPetya 2017 · US District Court Indictment GRU Unit 74455 October 2020

ATTACK:enterprise:S0370 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac263a26-1773-4ac1-b81b-b29f9ace484a

Sophos SamSam Apr 2018

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--acfaf7ec-7b92-40ec-a844-17089791a663

apt41_dcsocytec_dec2022 · FireEye APT41 Aug 2019

ATTACK:enterprise:S0446 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--adbb2fb8-9a9f-4068-b123-7b557491861d

CrowdStrike Ryuk January 2019 · CrowdStrike Wizard Spider October 2020

ATTACK:enterprise:S1194 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b5ae6046-3a14-4cae-8612-c9d414567e19

Cisco Akira Ransomware OCT 2024 · Palo Alto Howling Scorpius DEC 2024

ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b844f979-ddd2-4def-8d07-89b56ef10713

Arxiv Avaddon Feb 2021

ATTACK:enterprise:G1050 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b9080073-c6c8-4220-894b-26153cc04f61

BushidoToken Qilin RaaS JUN 2024

ATTACK:enterprise:S0457 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b9a67332-54a8-4531-948f-51e3ae2a0399

TrendMicro Netwalker May 2020

ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6cfaa54-2ce3-40c8-af91-cd09e6e9c167

KillDisk Ransomware

ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c7daa7ca-ca5a-4940-a370-d9eccb8f3c9a

Mcafee Clop Aug 2019 · Unit42 Clop April 2021 · Cybereason Clop Dec 2020

ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c99ee3c6-7d62-4514-bdac-4bf899ea0c16

Proofpoint TA505 Sep 2017

ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb043548-a193-4ade-b69d-d83e3378d255

trendmicro xcsset xcode project 2020

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2ccd7a6-117e-4d10-bb86-2f9ea6cb911b

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026

ATTACK:enterprise:S0639 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d4221b38-c9cf-4773-9a49-afa7b07b917a

Trend Micro Ransomware February 2021

ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d7f4f6eb-05b8-43af-8d8a-e06b1d950165

Palo Alto Shamoon Nov 2016 · Unit 42 Shamoon3 2018

ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d96dafc9-c011-4f5b-a823-ff174ab7d345

Joint Cybersecurity Advisory LockBit JUN 2023 · Joint Cybersecurity Advisory LockBit 3.0 MAR 2023 · INCIBE-CERT LockBit MAR 2024 · Sentinel Labs LockBit 3.0 JUL 2022

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d9701e96-5901-4e81-95d8-8938bbff9566

Palo Alto Lockbit 2.0 JUN 2022 · SentinelOne LockBit 2.0

ATTACK:enterprise:S1133 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e0a19456-e5f7-4b08-884d-188a9fc173ef

SentinelOne Agrius 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.