Skip to content

Service Stop

Technique · ATTACK:enterprise:T1489

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1489",
  "title": "Service Stop",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1489",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--20fb2507-d71c-455d-9b6d-6104461cf26b",
  "external_id": "T1489",
  "domain": "enterprise",
  "created": "2019-03-29T19:00:55.901Z",
  "modified": "2026-09-11T19:41:40.954Z",
  "version": "1.4",
  "aliases": [

  ],
  "tactics": [
    "impact"
  ],
  "source_references": [
    {
      "source_name": "AWS DisableAWSServiceAccess",
      "url": "https://docs.aws.amazon.com/organizations/latest/APIReference/API_DisableAWSServiceAccess.html"
    },
    {
      "source_name": "SecureWorks WannaCry Analysis",
      "url": "https://www.secureworks.com/research/wcry-ransomware-analysis"
    },
    {
      "source_name": "Datadog Security Labs Cloud Persistence 2025",
      "url": "https://securitylabs.datadoghq.com/articles/tales-from-the-cloud-trenches-the-attacker-doth-persist-too-much/"
    },
    {
      "source_name": "Talos Olympic Destroyer 2018",
      "url": "https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
    },
    {
      "source_name": "Crowdstrike Hypervisor Jackpotting Pt 2 2021",
      "url": "https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/"
    },
    {
      "source_name": "Novetta Blockbuster",
      "url": "https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"
    }
  ]
}

Explicit source assertions (62)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--056d19a6-8f3c-48a6-a459-69394e39fb9a

Unit42 Clop April 2021 · Mcafee Clop Aug 2019

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06a73a32-7ccc-4be5-ae78-7688f121c8e1

CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025 · Security Scorecard Medusa Ransomware January 2024

ATTACK:enterprise:S0582 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08bc171a-147c-4888-a0cb-c5fcebdc9b95

Proofpoint LookBack Malware Aug 2019

ATTACK:enterprise:S1247 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c7d07b5-c838-4858-a404-5f9ba0733ca4

Cyble Embargo Ransomware May 2024 · ESET Embargo Ransomware October 2024

ATTACK:enterprise:S0688 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f677d2e-2cff-4b9f-ae1b-621a5e856b08

Check Point Meteor Aug 2021

ATTACK:enterprise:S1211 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10b78316-c0c9-43cf-9f8c-fefd022706e4

Symantec Bilbug 2022

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1427027f-0fd1-4781-b4b3-06dc8e6e9998

FireEye WannaCry 2017 · SecureWorks WannaCry Analysis

ATTACK:enterprise:S9014 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1bc748d4-6776-4bb4-a5ab-0bb8ac3dfab4

Google UNC5221 Ivanti January 2025

ATTACK:enterprise:S1073 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fe61df4-3a67-4c46-87f5-771a42323e53

Cybereason Royal December 2022

ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2035eee7-c1c3-4039-9fc0-af85b21a5e3f

Fortinet Diavol July 2021

ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--238f92b3-2573-4332-b290-4685301eae6d

Arxiv Avaddon Feb 2021

ATTACK:enterprise:S0365 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24af852e-f761-4c75-8aa0-edc3198bd7eb

Talos Olympic Destroyer 2018

ATTACK:enterprise:S1096 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26cc808a-2986-4dcf-9ce6-86175cfa366c

Trend Micro Cheerscrypt May 2022

ATTACK:enterprise:S1058 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28038d61-fe2d-443c-a573-2ec1dc1123e2

Microsoft Prestige ransomware October 2022

ATTACK:enterprise:S0556 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--287368b4-d3ed-489d-9fe2-288168763ac4

Check Point Pay2Key November 2020

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28e8118a-0baf-412b-9237-2874ccb7d19a

Aryaka Kimsuky July 2025

ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ee6e8e6-914a-4639-88cc-39c01de5d541

Sophos BlackCat Jul 2022 · Microsoft BlackCat Jun 2022

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3071d81a-db65-4324-b280-b53dccca56b6

Halcyon Qilin.B OCT 2024 · HC3 Qilin Threat Profile JUN 2024 · Trend Micro Agenda Ransomware AUG 2022 · Cisco Talos Qilin Ransomware OCT 2025

ATTACK:enterprise:S9052 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39de5d21-d971-4a00-99f7-f931fce320c7

CheckPoint_NimbusManticore_May2026

ATTACK:enterprise:S0400 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e4f8216-03ef-4e7a-8a4a-28905fb0f474

CarbonBlack RobbinHood May 2019

ATTACK:enterprise:M1030 → mitigates → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40cd458c-5a59-4a8d-a04a-3cd3faebaf66

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--411aae3a-f612-41bb-b2f0-1639d2cbc290

Novetta Blockbuster Destructive Malware

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43e15d3b-02ef-4e6c-97f7-a62db9de2e3a

SentinelOne LockBit 2.0

ATTACK:enterprise:S1191 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--457340c8-e8d9-49e3-810b-cbd58c6d6212

Palo Alto Howling Scorpius DEC 2024

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4609386c-f8e8-44d8-828c-ce33cef129ba

Cyfirma_Vidar_June2024 · Logpoint_StealerMalwareFamilies_2024

ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f5efe16-ce46-4e37-9c9d-d45b14d1ab4c

Sogeti CERT ESEC Babuk March 2021 · McAfee Babuk February 2021 · Trend Micro Ransomware February 2021

ATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50900340-6edc-447c-aa1c-f73f5d72e4c6

Intel 471 REvil March 2020 · Secureworks REvil September 2019

ATTACK:enterprise:S0575 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59cb7691-e0a0-4e34-94ae-63d3e22f21c1

CarbonBlack Conti July 2020

ATTACK:enterprise:S0446 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60135ffa-b3f7-4aa8-b12e-faa2719dc5d7

CrowdStrike Ryuk January 2019

ATTACK:enterprise:S0625 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--677ec8f6-e06d-4d84-82de-af20953450ec

McAfee Cuba April 2021

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6cad1b79-d806-4eaa-82d3-59e23ccc6939

Microsoft Prestige ransomware October 2022

ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e54e834-521f-4da8-b3ae-963185496a60

NCC Group LAPSUS Apr 2022

ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71f8c65a-e4fb-4aa0-88b9-353ee56da56c

CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025 · Security Scorecard Medusa Ransomware January 2024

ATTACK:enterprise:S0576 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f58088d-9b5d-46ba-b9e4-fc937ffae294

ATTACK:enterprise:S1217 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f7f5b45-01e1-4ded-9a3d-41f701509f18

Google Cloud Threat Intelligence ESXi VIBs 2022

ATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88484d85-3c8e-4ccc-b82b-650c6c9bc825

Dragos Crashoverride 2017

ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8efafb84-44c7-405d-96b6-55d12f397d01

Trend Micro KillDisk 2

ATTACK:enterprise:S1245 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--91249ccc-a2e2-4d02-af0a-6ea20817b8ef

ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023

ATTACK:enterprise:S0481 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9212f940-021e-49b1-b500-fa1dd76b7132

Sophos Ragnar May 2020

ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--922cc16d-2242-477b-89db-1ba3d5176e12

CISA MAR SLOTHFULMEDIA October 2020

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--92a6471a-aee3-459e-b350-6354afcdaaf0

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026 · TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--92e19c14-504e-402f-b755-08358333cda0

Carbon Black HotCroissant April 2020

ATTACK:enterprise:S1181 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9a7835e3-5d9a-440c-84c2-5a1f60fef646

Microsoft BlackByte 2023

ATTACK:enterprise:S0605 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3a89546-f4fe-47f6-9109-89f6fa5af151

Dragos EKANS · FireEye Ransomware Feb 2020 · Palo Alto Unit 42 EKANS

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b5023b20-4243-4686-8b51-429ae7ac73cb

ATTACK:enterprise:S1053 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b56db835-3b80-49e8-964d-0c1c52d182fe

Malwarebytes AvosLocker Jul 2021

ATTACK:enterprise:M1060 → mitigates → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b774aa5d-7731-46b4-b285-dc1c67a0d01c

TrustedSec OOB Communications

ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b90beadd-a65d-4013-a552-8d114c6c7c28

Joint Cybersecurity Advisory LockBit JUN 2023 · Joint Cybersecurity Advisory LockBit 3.0 MAR 2023 · INCIBE-CERT LockBit MAR 2024 · Sentinel Labs LockBit 3.0 JUL 2022

ATTACK:enterprise:S1150 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bdc99461-1e2b-4fba-bf39-a5e17f7d3384

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c00535d0-6e59-4293-8034-70e5bf94a74a

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd283aa1-23f1-4516-9198-9d565bd4a431

DFIR Ryuk's Return October 2020

ATTACK:enterprise:S0583 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cdbbaa5b-c1d7-4e94-8a0e-a0be60ec377c

CERT-FR PYSA April 2020

ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d4ac896d-31ac-4c4a-a4d5-3134e6bd8622

Qualys Hermetic Wiper March 2022

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dcd5b361-b86b-47c7-8ce8-85918e00a224

Sophos Maze VM September 2020

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2763cbf-c068-47b5-a871-3b20a368497f

Symantec WastedLocker June 2020

ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e28dc4ab-86fe-480e-9f0d-d7fab54c432d

ATTACK:enterprise:S0457 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e6a3f7bf-33c3-4d4c-bb27-46bd2842c750

TrendMicro Netwalker May 2020

ATTACK:enterprise:S9013 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed0f49d3-fe2e-48fd-bc45-65f0de468a50

Google UNC5221 Ivanti January 2025

ATTACK:enterprise:S9015 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1df2991-428f-4ed0-9173-07609e2142c8

CISA BRICKSTORM UNC5221 AR25-338A February 2026

ATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f507e65e-735e-40af-bb77-cd9f0b14f8f1

Cybereason INC Ransomware November 2023

ATTACK:enterprise:S1212 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f52c6c88-f28f-41fe-ab01-7c0a06c425ac

Group-IB RansomHub FEB 2025

ATTACK:enterprise:S1194 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f67c6c6d-8e35-408a-87cf-6f9af30d73b9

CISA Akira Ransomware APR 2024 · Cisco Akira Ransomware OCT 2024 · Palo Alto Howling Scorpius DEC 2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.