Skip to content

Archive via Custom Method

Subtechnique · ATTACK:enterprise:T1560.003

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1560.003",
  "title": "Archive via Custom Method",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1560/003",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--143c0cbb-a297-4142-9624-87ffc778980b",
  "external_id": "T1560.003",
  "domain": "enterprise",
  "created": "2020-02-20T21:09:55.995Z",
  "modified": "2025-10-24T17:48:26.190Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "ESET Sednit Part 2",
      "url": "http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"
    }
  ]
}

Explicit source assertions (40)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07ab0a67-7c7b-4971-9a3e-45069f234800

ESET Attor Oct 2019

ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c3e8b5e-1908-4a17-ba56-f8df99991cd9

Volexity InkySquid BLUELIGHT August 2021

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c78e3a7-45c5-454f-8905-a831fbede841

Trend Micro FIN6 October 2019 · FireEye FIN6 April 2016

ATTACK:enterprise:S0038 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f3af4de-b1cc-4cc2-9eb7-9aa46cdebfcd

Symantec W32.Duqu

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--160d9be2-967e-4116-9c75-44b5b0a8927b

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:S0035 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23df6015-0167-481c-84aa-3d15d3e38a85

ATTACK:enterprise:G0052 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--292b2a10-ebee-4fbb-b359-2eee16aa46ba

CopyKittens Nov 2015

ATTACK:enterprise:S0661 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a9fde8d-dbec-42e9-ad73-02f80e765a91

MSTIC FoggyWeb September 2021

ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33eb3d03-426d-4410-b028-3528b3fefe5c

FireEye NETWIRE March 2019

ATTACK:enterprise:S0448 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39663ad3-549e-4984-a81b-acce5cb02090

McAfee Sharpshooter December 2018

ATTACK:enterprise:S0491 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ad041f8-30ca-44bb-bad5-2e5b3e5d6242

Talos Promethium June 2020 · Bitdefender StrongPity June 2020

ATTACK:enterprise:S0258 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40e636e8-a891-46fb-ba04-69db00062354

Unit 42 RGDoor Jan 2018

ATTACK:enterprise:S0169 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--53ad6525-7888-4651-bd43-c010b489ccc0

TrendMicro RawPOS April 2015 · Mandiant FIN5 GrrCON Oct 2016 · Visa RawPOS March 2015

ATTACK:enterprise:S1059 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--609a0483-ac4a-49d6-bc5d-3cb0ff6e8a97

SentinelLabs Metador Sept 2022

ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71abba24-84a2-449d-811a-ba006382d723

Eset Ramsay May 2020

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7687477f-ea5e-4a3f-806d-e561f5c8adb4

Avira Mustang Panda January 2020

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78f09c1a-8e37-4b2c-9296-d464be9b46c5

Securelist Kimsuky Sept 2013

ATTACK:enterprise:S0264 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87b3ebab-fb4d-44c2-b8ad-9fffbac277f3

Unit 42 OopsIE! Feb 2018

ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88ad5157-7e81-4189-9899-a5e436713261

Google Cloud Mandiant UNC3886 2024

ATTACK:enterprise:S0615 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b76353e-6ed6-4d20-b52d-ca7dde9dec9b

BlackBerry CostaRicto November 2020

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b95c259-d8eb-4258-aec0-e7c92bf3ac05

ESET Machete July 2019

ATTACK:enterprise:S0172 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98d3455f-49cc-4539-ba35-4b11bec0ddcd

Palo Alto Reaver Nov 2017

ATTACK:enterprise:S0391 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ee0e760-3084-4341-b1c3-3f50a0506595

FireEye HAWKBALL Jun 2019

ATTACK:enterprise:S0072 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a83992e1-5be5-433e-b3f1-d9ccde98c9ca

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--afd03a56-6d2b-4b00-895a-012f5d348898

ESET InvisiMole June 2018

ATTACK:enterprise:S0098 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bb11119c-c409-4615-8c3f-8491749f2d3b

Palo Alto T9000 Feb 2016

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c0e78590-0266-43e0-8fb5-efd95556c20c

ESET Sednit Part 2

ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4741ab7-7e20-4e4a-a0f6-189984c564cd

Cisco LotusBlossom 2025

ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca140f83-3fc6-44e8-b588-806fb60e7e7e

ZScaler Squirrelwaffle Sep 2021

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cebe7625-3bb7-4353-9b48-cd4251410968

ESET Okrum July 2019

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cfae5caf-6084-4082-a2a4-8728ea424807

Unit42 OceanLotus 2017

ATTACK:enterprise:S1044 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d29ff57c-2821-45e9-94b5-beb62f63f8ea

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:S0443 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d6ddaace-75b2-4ff0-bb94-751095d6a357

FireEye MESSAGETAP October 2019

ATTACK:enterprise:T1560.003 → subtechnique-of → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2980209-0a3b-4d12-8a85-1984b8e1844b

ATTACK:enterprise:S1042 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e7c29485-c988-4313-8081-60241abe1178

Mandiant UNC3890 Aug 2022

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e9249ab2-eeee-4984-9ee2-78ff52335077

ATTACK:enterprise:S0503 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f4c346b3-91ec-4edc-a648-a6273c965e02

SentinelOne FrameworkPOS September 2019

ATTACK:enterprise:S0092 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f4c6cb3f-b24c-4a1e-9bba-7b129b89a17a

ThreatExpert Agent.btz

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f60afd0d-68d1-4b71-bb07-b943e9542b2d

Novetta Blockbuster Loaders · Novetta Blockbuster RATs · Novetta Blockbuster · McAfee Lazarus Resurfaces Feb 2018

ATTACK:enterprise:S0036 → uses → ATTACK:enterprise:T1560.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9669551-29f8-4aaf-83b9-50e541bbdced

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.