Skip to content

System Checks

Subtechnique · ATTACK:enterprise:T1497.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1497.001",
  "title": "System Checks",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1497/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--29be378d-262d-4e99-b00d-852d573628e6",
  "external_id": "T1497.001",
  "domain": "enterprise",
  "created": "2020-03-06T20:57:37.959Z",
  "modified": "2026-09-11T19:25:59.519Z",
  "version": "3.0",
  "aliases": [

  ],
  "tactics": [
    "stealth",
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "Unit 42 OilRig Sept 2018",
      "url": "https://researchcenter.paloaltonetworks.com/2018/09/unit42-oilrig-targets-middle-eastern-government-adds-evasion-techniques-oopsie/"
    },
    {
      "source_name": "McAfee Virtual Jan 2017",
      "url": "https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/stopping-malware-fake-virtual-machine/"
    },
    {
      "source_name": "Deloitte Environment Awareness",
      "url": "https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc/edit"
    }
  ]
}

Explicit source assertions (73)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05d8ec5a-0fc4-4037-913f-4d48e658ee9b

Trend Micro Qakbot May 2020 · ATT QakBot April 2021

ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--081e43bc-3f9e-4110-a1c1-db7396e2ff59

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:S0627 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e843db4-d4be-4252-85d0-7365dcbdbb50

Securelist APT10 March 2021

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--108e61c1-83fc-4ebf-aa5c-4ff19ccbe7cf

ESET Okrum July 2019

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13aed490-7d1f-4839-90c9-32d587d58afd

ESET InvisiMole June 2020

ATTACK:enterprise:G0120 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1646da26-9846-4a24-b9a6-59ebad8c9cb5

ESET EvilNum July 2020

ATTACK:enterprise:S0024 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17f9d6c8-f938-4532-b834-3834655911b8

Symantec Dyre June 2015 · Malwarebytes Dyreza November 2015

ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1bbc2179-9302-4f21-98b8-b1f60ceafed3

ClearSky Lazarus Aug 2020

ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--270d73c2-27fb-43ac-80b9-d4ea3fef2c06

ESET Attor Oct 2019

ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2815c919-1fcb-4ddc-bb04-56dff63854e7

Medium Ali Salem Bumblebee April 2022

ATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2af8a4f4-fcac-4081-86f9-ba74140580dc

Microsoft FinFisher March 2018

ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2cfab77c-89d8-4e95-9ef9-43e0a77c5e4d

Securelist Brazilian Banking Malware July 2020

ATTACK:enterprise:S9018 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--339d80aa-dd56-47ca-8ce0-bb19a4a42502

Palo Alto HeartCrypt DEC 2024

ATTACK:enterprise:S0242 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36b27959-d265-4fb6-b33b-3a1e74d43206

SecureList SynAck Doppelgänging May 2018 · Kaspersky Lab SynAck May 2018

ATTACK:enterprise:S0576 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3cf330d6-3a3c-437f-922b-c1bdce852b71

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f921bea-899f-4b13-94b2-13f7a4813b8b

ESET OceanLotus macOS April 2019 · Unit42 OceanLotus 2017 · 20 macOS Common Tools and Techniques

ATTACK:enterprise:S1048 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43cb492f-99c9-4c36-9de7-2a20537ea8cc

SentinelLabs reversing run-only applescripts 2021

ATTACK:enterprise:S0226 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4929677b-3ce9-4065-9837-cfaa0cad8c89

Talos Smoke Loader July 2018

ATTACK:enterprise:S0561 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4cacddfb-d437-4495-bacb-08b316814c1d

Medium Eli Salem GuLoader April 2021

ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ce1ed77-dc5d-42d8-838e-b927dc6d6afb

Cyphort EvilBunny Dec 2014

ATTACK:enterprise:S0248 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f644120-7b96-4234-b81a-3160b34bca87

ASERT Donot March 2018

ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5473acfd-2cb3-45a8-97cb-c3962c606f1e

Unit 42 Lucifer June 2020

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56889f30-eb6c-4286-b25a-39d35f93a1c0

Microsoft Volt Typhoon May 2023

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59a6a413-1f3f-44bd-8b66-5685a1e8e6df

Talos GravityRAT

ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a8ea0ac-7a51-4440-898b-a70ee71d06a4

TrendMicro LummaStealer 2025 · Fortinet LummaStealer 2024

ATTACK:enterprise:S0337 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ffaf382-3e91-409b-932f-24d107c59308

Unit 42 BadPatch Oct 2017

ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6340a1e8-4880-4c91-b4fd-ce909b35b87f

Talos PoetRAT April 2020

ATTACK:enterprise:S0612 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64c2c440-287d-409a-b6f3-8ef837346ad0

NCC Group WastedLocker June 2020

ATTACK:enterprise:S0264 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a93c25c-c9cb-4cd9-a36b-1f2353e91e32

Unit 42 OilRig Sept 2018

ATTACK:enterprise:S1066 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d9ee797-4756-4a89-ab19-2ece0c96e533

Secureworks DarkTortilla Aug 2022

ATTACK:enterprise:S0333 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--750c8d62-74f3-4566-95fc-97f1685c9ca0

PaloAlto UBoatRAT Nov 2017

ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7976b353-f509-440f-a620-72116e06c30a

Unit 42 WhisperGate January 2022

ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c290539-09a9-4ff2-956a-d5026dba86a5

Telefonica Snip3 December 2021

ATTACK:enterprise:S1018 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80933d22-6aa2-466d-95c2-af486b81c624

Palo Alto Unit 42 OutSteel SaintBot February 2022

ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8395d178-d5e8-494f-8612-3c2542b2f8c9

Lastline DarkHotel Just In Time Decryption Nov 2015 · Microsoft DUBNIUM June 2016

ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86b00142-a259-4237-b1a8-a8183d581b54

Unit42 PlugX June 2017

ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87df7d6c-1001-46a4-8daa-6880ae20bd04

Hunt.io TeamPCP Toolkit MAY 2026 · Wiz Mini Shai-Hulud MAY 2026 · Phoenix TeamPCP 20 MAY 2026

ATTACK:enterprise:S1019 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87e73122-361f-47a2-a401-0e863300e123

ClearSky Siamesekitten August 2021

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88587bdd-ea5a-4d80-af9f-cc900c5705e3

ATTACK:enterprise:S0626 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88f03e47-d816-4d46-ae13-6ce121f1f2a2

Securelist APT10 March 2021

ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8ba9be70-d849-4f64-94b8-edc4384605a5

ESET Grandoreiro April 2020

ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8bbe5f67-f65e-4982-8897-7f7466fc0845

Malwarebytes RokRAT VBA January 2021 · Talos Group123 · NCCGroup RokRat Nov 2018

ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8cb5d843-e5b6-416a-b721-aa6b4c1ae2f3

Talos Remcos Aug 2018

ATTACK:enterprise:S1147 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8dc9ad2b-acae-4bd1-8c6b-02b0d6bc5c90

Symantec Daggerfly 2024

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9122a590-4a01-4f41-a15a-bc3bc92b0439

Check Point Black Basta October 2022 · Palo Alto Networks Black Basta August 2022

ATTACK:enterprise:C0001 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--92cf3ea9-3499-4e12-b885-fcb43e0107ff

Talos Frankenstein June 2019

ATTACK:enterprise:S0270 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--93b08370-9c05-47df-b067-368343dba24a

Unit 42 DarkHydrus July 2018 · Unit42 DarkHydrus Jan 2019

ATTACK:enterprise:S0644 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--94a0ffdf-5244-4f13-9730-3715b1bc6943

Talos Oblique RAT March 2021

ATTACK:enterprise:S0637 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--983e91df-bb1a-4658-aaad-7549b1a81917

MSTIC Nobelium Toolset May 2021

ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9893220d-5db9-4978-a886-ff33cf417584

Secureworks Karagany July 2019

ATTACK:enterprise:G0090 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9a078ba7-22b8-4daa-8673-f691518c7c9f

Palo Alto Ashen Lepus DEC 2025

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9af9b544-da12-4c1d-a5c4-9474b2181365

Aryaka Kimsuky July 2025

ATTACK:enterprise:T1497.001 → subtechnique-of → ATTACK:enterprise:T1497

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ba97a0a-1ae5-4969-9ce4-6fb86d70fae0

ATTACK:enterprise:S9060 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3da0fa7-20c6-407e-9bcc-aef2bdc03418

Mandiant_UNC1549_Feb2024

ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5d8527f-71eb-48e4-b5af-f95d29fdb265

Volexity InkySquid BLUELIGHT August 2021

ATTACK:enterprise:S1122 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b53c54de-bbd9-4862-92e1-86b60091cb15

ESET Security Mispadu Facebook Ads 2019 · SCILabs Malteiro 2021

ATTACK:enterprise:S1207 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bb1bd370-ab2a-40f7-9709-482b86c4dcdd

Google XLoader 2017

ATTACK:enterprise:S1064 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c29ef74c-0ddd-457a-b1e8-70793bbdda85

HP SVCReady Jun 2022

ATTACK:enterprise:S0679 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c5d72f44-5b9c-4927-a232-6cd81fdbcc13

Kaspersky WIRTE November 2021

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c85195a1-97ac-4683-b9da-cbd273ec9cbe

LevelBlue_Vidar_May2026 · QuorumCyber_Vidar_March2023

ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c911e8d7-be27-48cf-8f5a-0be56cbe6592

Microsoft Analyzing Solorigate Dec 2020

ATTACK:enterprise:S1086 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cbed7d53-5d5f-48ee-a2d0-ee10230d4e4c

Morphisec Snip3 May 2021

ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d07fa408-1a12-443f-a280-75fbe4447f6f

HP RaspberryRobin 2024

ATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d7a5d884-d3d9-48c8-915f-75d29d4b259e

MSTIC NOBELIUM Mar 2021 · FireEye SUNSHUTTLE Mar 2021

ATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d80dc743-4799-4497-8708-b1324b38e3e1

Bitsight Latrodectus June 2024 · Latrodectus APR 2024 · Elastic Latrodectus May 2024

ATTACK:enterprise:S0527 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d9a49337-e1a4-49ee-b0f1-ef80c7c37a99

Cybereason Kimsuky November 2020

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e289222f-0544-47cc-b0b6-72657d92d196

Ensilo Darkgate 2018

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eacf7d8c-c60c-4d4b-af28-57c015a54c55

Check Point APT34 April 2021

ATTACK:enterprise:S1179 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eb1b4af3-e5fc-4117-984d-7365d0f3dde0

Symantec BlackByte 2022

ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed8cf613-63f8-4f50-be4d-f73aba6a3467

Elastic Pikabot 2024

ATTACK:enterprise:S1180 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2e6c04f-1304-4279-89f0-1f2bebfa0f37

Trustwave BlackByte 2021

ATTACK:enterprise:S1159 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f66a0d09-cb4a-4fb5-9f83-b7316e3c7db7

Google Cloud APT41 2024

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fea46319-ea16-4e74-a2a7-b41b148413bf

SilentPush_GamaredonFastFlux_Sept2023

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.