Skip to content

Inhibit System Recovery

Technique · ATTACK:enterprise:T1490

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1490",
  "title": "Inhibit System Recovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1490",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a",
  "external_id": "T1490",
  "domain": "enterprise",
  "created": "2019-04-02T13:54:43.136Z",
  "modified": "2026-05-12T15:12:00.724Z",
  "version": "1.6",
  "aliases": [

  ],
  "tactics": [
    "impact"
  ],
  "source_references": [
    {
      "source_name": "Dark Reading Code Spaces Cyber Attack",
      "url": "https://www.darkreading.com/attacks-breaches/code-hosting-service-shuts-down-after-cyber-attack"
    },
    {
      "source_name": "FireEye WannaCry 2017",
      "url": "https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html"
    },
    {
      "source_name": "Cybereason",
      "url": "https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware"
    },
    {
      "source_name": "Talos Olympic Destroyer 2018",
      "url": "https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
    },
    {
      "source_name": "Diskshadow",
      "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow"
    },
    {
      "source_name": "Crytox Ransomware",
      "url": "https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware"
    },
    {
      "source_name": "Rhino Security Labs AWS S3 Ransomware",
      "url": "https://rhinosecuritylabs.com/aws/s3-ransomware-part-2-prevention-and-defense/"
    },
    {
      "source_name": "ZDNet Ransomware Backups 2020",
      "url": "https://www.zdnet.com/article/ransomware-victims-thought-their-backups-were-safe-they-were-wrong/"
    },
    {
      "source_name": "disable_notif_synology_ransom",
      "url": "https://x.com/TheDFIRReport/status/1498657590259109894"
    }
  ]
}

Explicit source assertions (61)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--003071c1-a640-4f29-8405-a3998dfaf11f

Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025 · Security Scorecard Medusa Ransomware January 2024

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0260e86a-488e-4307-a467-2ccabf430212

Avertium Black Basta June 2022 · Check Point Black Basta October 2022 · Cyble Black Basta May 2022 · Palo Alto Networks Black Basta August 2022 · Trend Micro Black Basta May 2022 · NCC Group Black Basta June 2022 · Trend Micro Black Basta Spotlight September 2022 · Deep Instinct Black Basta August 2022 · Minerva Labs Black Basta May 2022

ATTACK:enterprise:S0481 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06dd311f-393f-4c24-beee-19d690ae4ba2

Sophos Ragnar May 2020

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e9818a5-90ec-4b12-a6e2-20188d78a69f

ESET InvisiMole June 2018

ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a549ce9-124b-4a88-997f-c52b3a39a6bc

Microsoft Storm-0501 Embargo Ransomware August 2025

ATTACK:enterprise:S1162 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26fe80fc-b6ec-4ca0-8693-d61e63901af3

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:S0612 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2781807b-4dd7-4bd7-b453-bd258bc375ee

Symantec WastedLocker June 2020 · NCC Group WastedLocker June 2020 · Sentinel Labs WastedLocker July 2020

ATTACK:enterprise:S0132 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d090e9d-f9fb-4f73-99df-0e17a7489adb

Cisco H1N1 Part 2

ATTACK:enterprise:S0400 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f5583d9-e0bf-4d76-ad74-6d9bd3efa69c

CarbonBlack RobbinHood May 2019

ATTACK:enterprise:S0446 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3194fa27-46b8-4a05-8d3a-12d7bfe9ad15

CrowdStrike Ryuk January 2019

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--331e8ea2-15c4-4cba-8a26-163b24d819b7

Prevailion DarkWatchman 2021

ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3924f0e4-f79b-4804-87d5-57df4ceddb95

Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025 · Security Scorecard Medusa Ransomware January 2024

ATTACK:enterprise:S0605 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4238bdb9-71ad-413f-a2fa-4c090ed4c469

Dragos EKANS · Palo Alto Unit 42 EKANS

ATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--46a953d5-132d-4748-aa5d-7950103e684d

Cybereason INC Ransomware November 2023

ATTACK:enterprise:S0576 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48c9c2f3-9358-4342-88b7-57c8e5df893b

ATTACK:enterprise:S0616 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e7966c2-7ac7-4959-8ee0-dfc6d812e000

FireEye FiveHands April 2021

ATTACK:enterprise:S1073 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5364714b-0c15-4453-9b09-7fcca3d3db01

CISA Royal AA23-061A March 2023 · Cybereason Royal December 2022 · Kroll Royal Deep Dive February 2023

ATTACK:enterprise:S1181 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56aabb26-2bc3-428e-b8ea-ed69a2ea80e7

Microsoft BlackByte 2023

ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b8d22c5-f191-4dc3-a4ee-04c7d8b799da

Hornet Security Avaddon June 2020 · Arxiv Avaddon Feb 2021

ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5f58daef-b978-4b88-957c-ef981ca26fca

Check Point VOID MANTICORE Handala Hack March 2026

ATTACK:enterprise:S1058 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61b0b64f-da02-4f36-949e-016b83fa747f

Microsoft Prestige ransomware October 2022

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--650ae259-991e-4d54-a173-cc12e31ead50

Ensilo Darkgate 2018

ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ac34520-de4a-4033-92a4-52d7463592b9

Qualys Hermetic Wiper March 2022 · ESET Hermetic Wizard March 2022 · Crowdstrike DriveSlayer February 2022

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76d0be57-e439-4640-b26d-db422353d9e5

FireEye WannaCry 2017 · SecureWorks WannaCry Analysis · LogRhythm WannaCry

ATTACK:enterprise:S1247 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76fbcff9-f756-47d7-8a86-8bb8dc748433

Cyble Embargo Ransomware May 2024

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--773fc200-e44d-4049-b972-043c1e3d9035

Mandiant FIN12 Oct 2021

ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--813370e8-ec26-4533-b8e2-39474edb7006

Sogeti CERT ESEC Babuk March 2021 · McAfee Babuk February 2021

ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--833e14f8-0f37-488a-a67c-3ff2fe524ac3

Crowdstrike Indrik November 2018

ATTACK:enterprise:S1180 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--84a5d9d6-1ec6-4064-be95-b69de01c578b

Trustwave BlackByte 2021

ATTACK:enterprise:S0617 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--84d34520-0386-4d41-96b6-3350d727150b

FireEye FiveHands April 2021

ATTACK:enterprise:S0457 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87343ae5-53c9-426c-abab-602c8041dafe

TrendMicro Netwalker May 2020 · Sophos Netwalker May 2020

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8ab39b8c-44af-4ec5-ab8e-1a94142a2f7b

Picus BlackByte 2022 · Symantec BlackByte 2022

ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9104be87-33ad-4a35-96db-3e2ed5c17f46

ATTACK:enterprise:S1212 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--999097f3-7fe8-425f-a9cc-81ee310e05f1

Group-IB RansomHub FEB 2025 · CISA RansomHub AUG 2024

ATTACK:enterprise:S0618 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9a91c3cf-b39d-470f-85fc-14bbebe39e98

FireEye FiveHands April 2021 · CISA AR21-126A FIVEHANDS May 2021

ATTACK:enterprise:S0575 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e22871c-2e16-4c81-903c-e081c140f7a2

CarbonBlack Conti July 2020

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a831f997-d585-4e17-9342-7f9100edf6fb

ATTACK:enterprise:S1129 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aeb5cdda-6344-4048-9b41-a0e0e75ef099

CISA Akira Ransomware APR 2024 · Kersten Akira 2023

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b2426c20-11cd-4211-a251-4c8e5980fe82

BradyUnit42_TheGentlemen_July2026 · CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026 · TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc733ee6-f441-42b1-a201-9ff84e0f522c

Mcafee Clop Aug 2019

ATTACK:enterprise:S1135 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bf0a21c1-6549-4137-b05a-ae66b2764209

Unit42 Agrius 2023

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4cd9acb-aaea-4b77-890e-f153a58623a4

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cbd8ee31-9b73-40b7-b054-3620a29b021f

Mandiant UNC3944 May 2025

ATTACK:enterprise:S0688 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd38ce72-655d-40f5-afbc-5a9ad0624a6a

Check Point Meteor Aug 2021

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d62f97e9-2b94-44d9-88db-99f849a804ec

ATTACK:enterprise:S0583 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d6dcaa34-12d9-45f3-8f7b-397c2da0995a

CERT-FR PYSA April 2020

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d84bb8c3-7a8c-4dfb-bad4-a6d5b401b6a7

Microsoft Prestige ransomware October 2022

ATTACK:enterprise:S0608 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2b49348-8590-42a9-8b38-871c2eb3ada1

ATTACK:enterprise:S0365 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e4c2c54e-3980-45a4-92cb-c0d99bc0a428

Talos Olympic Destroyer 2018

ATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e8924eab-e270-43ed-8d7b-8e14cb739720

Talos Sodinokibi April 2019 · Secureworks REvil September 2019 · Cylance Sodinokibi July 2019 · Intel 471 REvil March 2020 · Kaspersky Sodin July 2019 · McAfee Sodinokibi October 2019 · Picus Sodinokibi January 2020 · Secureworks GandCrab and REvil September 2019 · Tetra Defense Sodinokibi March 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ea32ebd2-9827-43ec-a3d3-f0148fee8ed8

McAfee Maze March 2020 · Sophos Maze VM September 2020

ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ec0ea37c-cb59-4138-ac0a-ad401b37d5fe

Fortinet Diavol July 2021

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eebb9c93-2d18-4b27-92aa-b7e597c27616

Sophos Qilin MSP APR 2025 · Halcyon Qilin.B OCT 2024 · Trend Micro Agenda Ransomware AUG 2022 · Cisco Talos Qilin Ransomware OCT 2025

ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f074afef-4b9a-474e-b5fd-21143a927d83

Joint Cybersecurity Advisory LockBit JUN 2023 · Joint Cybersecurity Advisory LockBit 3.0 MAR 2023 · INCIBE-CERT LockBit MAR 2024

ATTACK:enterprise:S0389 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f0c94372-2818-46ff-899c-0c57fe0af46a

Carbon Black JCry May 2019

ATTACK:enterprise:S1136 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2304e7f-50b3-41cc-81df-5c7baed21b89

Unit42 Agrius 2023

ATTACK:enterprise:S1150 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f5d844e2-b442-4422-9880-e648ee387d67

CISA Iran Albanian Attacks September 2022 · Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S0654 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f86ad19e-67a2-453d-8af9-c73a130651a4

Group IB Ransomware September 2020

ATTACK:enterprise:M1053 → mitigates → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9e62f6d-a091-44a9-91e6-3660b89ba2b9

Unit 42 Palo Alto Ransomware in Public Clouds 2022 · Crowdstrike Hypervisor Jackpotting Pt 2 2021 · Ready.gov IT DRP

ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc3e0e8c-d6d3-4f2d-8374-86b7902079a9

Microsoft BlackCat Jun 2022

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd1a359c-c834-4368-915c-bd278e179d5c

Cybereason Lockbit 2.0 · FBI Lockbit 2.0 FEB 2022

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.