Compute Hijacking
Subtechnique · ATTACK:enterprise:T1496.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1496.001",
"title": "Compute Hijacking",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1496/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--a718a0c8-5768-41a1-9958-a1cc3f995e99",
"external_id": "T1496.001",
"domain": "enterprise",
"created": "2024-09-25T13:34:30.100Z",
"modified": "2025-04-15T22:08:46.014Z",
"version": "1.0",
"aliases": [
],
"tactics": [
"impact"
],
"source_references": [
{
"source_name": "Unit 42 Hildegard Malware",
"url": "https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"
},
{
"source_name": "CloudSploit - Unused AWS Regions",
"url": "https://medium.com/cloudsploit/the-danger-of-unused-aws-regions-af0bf1b878fc"
},
{
"source_name": "Kaspersky Lazarus Under The Hood Blog 2017",
"url": "https://securelist.com/lazarus-under-the-hood/77908/"
},
{
"source_name": "Trend Micro Exposed Docker APIs",
"url": "https://www.trendmicro.com/en_us/research/19/e/infected-cryptocurrency-mining-containers-target-docker-hosts-with-exposed-apis-use-shodan-to-find-additional-victims.html"
},
{
"source_name": "Trend Micro War of Crypto Miners",
"url": "https://www.trendmicro.com/en_us/research/20/i/war-of-linux-cryptocurrency-miners-a-battle-for-resources.html"
}
]
}Explicit source assertions (15)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1496.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0493bf17-29a1-4825-b1a2-6e037288637f
Unit 42 Lucifer June 2020ATTACK:enterprise:S0468 → uses → ATTACK:enterprise:T1496.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0bb4fb8a-0b0f-46c6-820b-d46c5f98fa12
Trend Micro SkidmapATTACK:enterprise:T1496.001 → subtechnique-of → ATTACK:enterprise:T1496
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--10b76c75-11f1-421d-899a-30d22f7e8260
ATTACK:enterprise:S0492 → uses → ATTACK:enterprise:T1496.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--46af303d-51d3-4b85-90e2-ee75f62c022c
Unit42 CookieMiner Jan 2019ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1496.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--46c37037-00da-4cf5-bde1-4296e10e6483
Talos Rocke August 2018 · Unit 42 Rocke January 2019ATTACK:enterprise:S0486 → uses → ATTACK:enterprise:T1496.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c0d9758-34f0-49b4-ad12-91329b4398e2
ESET ForSSHe December 2018ATTACK:enterprise:S0451 → uses → ATTACK:enterprise:T1496.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--774302ff-3ab9-4328-a434-6188efe0928a
ESET LoudMiner June 2019ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1496.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--790c8ce0-9002-4b95-9fc5-ceb55724e259
Ensilo Darkgate 2018ATTACK:enterprise:G0108 → uses → ATTACK:enterprise:T1496.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8042dc21-37e4-4a60-aef1-457179f346e5
RedCanary Mockingbird May 2020ATTACK:enterprise:S0434 → uses → ATTACK:enterprise:T1496.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f0e7661-fa5d-47c4-84b0-44cd31b49764
Imminent Unit42 Dec2019ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1496.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f4e363a-ce2b-4a36-92fb-791d8ffc30d5
Cado Security TeamTNT Worm August 2020 · Cisco Talos Intelligence Group · Lacework TeamTNT May 2021ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1496.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ebc2d8a-a945-4b5d-805f-56e16bcc6676
FireEye APT41 Aug 2019 · apt41_mandiantATTACK:enterprise:S0601 → uses → ATTACK:enterprise:T1496.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ae8d16f8-ba51-4b17-987b-5fbeedfc1780
Unit 42 Hildegard MalwareATTACK:enterprise:C0045 → uses → ATTACK:enterprise:T1496.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f503a9ba-4761-4932-8ebc-53b03680a316
Oligo ShadowRay Campaign MAR 2024ATTACK:enterprise:S0599 → uses → ATTACK:enterprise:T1496.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fdf3767f-49ad-43f3-943c-486099ffa3a8
Sysdig Kinsing November 2020 · Aqua Kinsing April 2020