Hidden Window
Subtechnique · ATTACK:enterprise:T1564.003
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1564.003",
"title": "Hidden Window",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1564/003",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--cbb66055-0325-4111-aca0-40547b6ad5b0",
"external_id": "T1564.003",
"domain": "enterprise",
"created": "2020-03-13T20:26:49.433Z",
"modified": "2026-05-12T15:12:00.716Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"stealth"
],
"source_references": [
{
"source_name": "Cantoris Computing",
"url": "https://cantoriscomputing.wordpress.com/2016/07/22/powershell-malware/"
},
{
"source_name": "Cybereason - Hidden Malicious Remote Access",
"url": "https://www.cybereason.com/blog/behind-closed-doors-the-rise-of-hidden-malicious-remote-access"
},
{
"source_name": "LOLBAS Project GitHub Device Cred Dep",
"url": "https://lolbas-project.github.io/lolbas/Binaries/DeviceCredentialDeployment/"
},
{
"source_name": "Hidden VNC",
"url": "https://www.malwaretech.com/2015/09/hidden-vnc-for-beginners.html"
},
{
"source_name": "Anatomy of an hVNC Attack",
"url": "https://securityintelligence.com/anatomy-of-an-hvnc-attack/"
},
{
"source_name": "SecureList BlueNoroff Device Cred Dev",
"url": "https://securelist.com/bluenoroff-methods-bypass-motw/108383/"
},
{
"source_name": "Antiquated Mac Malware",
"url": "https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/"
},
{
"source_name": "PowerShell About 2019",
"url": "https://docs.microsoft.com/en-us/powershell/module/Microsoft.PowerShell.Core/About/about_PowerShell_exe?view=powershell-5.1"
}
]
}Explicit source assertions (65)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--05491bb5-e209-4480-a1a8-9b385efe14ad
Cybereason Astaroth Feb 2019ATTACK:enterprise:S0686 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ac2c282-04a7-4fb7-b6ac-ec8a9bac6db1
Microsoft Actinium February 2022ATTACK:enterprise:S0491 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1248ffe0-ad3b-43a6-a358-763d8eab7fba
Talos Promethium June 2020ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1279ae2b-fb00-4980-a5cc-9a802ad2901d
ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--133a678e-66cc-4d28-b768-a8f7c6fcd753
Palo Alto Lockbit 2.0 JUN 2022ATTACK:enterprise:S1020 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17ac7d6e-828c-4b8c-84de-4e0575f1703a
Kaspersky Lyceum October 2021ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c1296da-4504-4f00-b16a-8ecc29820ea9
FireEye Operation Double TapATTACK:enterprise:T1564.003 → subtechnique-of → ATTACK:enterprise:T1564
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26d64c06-c277-473d-94e8-e9990b6adc8e
ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2798da1f-3e11-43d3-b581-2b5e0926feb5
FBI IC3 Flash VOID MANTICORE Handala Hack March 2026ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27e91ac8-9463-4a7a-8f1f-89abeba1b02d
Palo Alto Sofacy 06-2018 · McAfee APT28 DDE1 Nov 2017ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e6e8722-d09d-402e-9ea8-ccf8412339d0
FireEye APT19ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--331313a6-8f2d-46ef-939f-2688d06af86e
Gemini_FIN7_Jan2022ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3339e98d-9078-496e-bc24-8bcf5f86ac33
MalwareBytes LazyScripter Feb 2021ATTACK:enterprise:S0037 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3877277b-ae7c-4cb8-b564-3263b235c1e7
FireEye APT29ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--393b11b3-cf22-48e0-afb6-e9c05411b400
GitHub SILENTTRINITY Modules July 2019ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--41664428-398a-4b71-9418-b1bd1e4cefc4
CISA AR18-352A Quasar RAT December 2018ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--527e03b3-5b14-4a6c-ab05-0e18bac0357d
PWC KeyBoys Feb 2017ATTACK:enterprise:S1089 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--52ba680e-2884-4874-a0ea-470c96c4af51
MoustachedBouncer ESET August 2023ATTACK:enterprise:S0500 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57cb89ed-ead5-46b1-ade9-68e580274f65
Secureworks MCMD July 2019ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5991c9be-2b16-4099-9c01-4361b6f4b333
Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:S0669 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b17eed1-2db5-4c35-b04e-cbb0b7edb8d4
MalwareBytes LazyScripter Feb 2021ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b874a36-35e7-46da-ad9a-209e8310de52
Koi Glassworm InvisibleCode October 2025ATTACK:enterprise:S0360 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c9bea96-819a-4a39-9814-62f3473530a4
FireEye APT34 Dec 2017ATTACK:enterprise:M1033 → mitigates → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61b6152c-6606-474c-926a-a874a3084ac8
ATTACK:enterprise:S1172 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--62a9e155-9ecd-4781-8914-1c0e5183b98f
ESET OilRig Downloaders DEC 2023ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6375b66d-a3de-4f89-8cf2-c4f70fc46a8f
SophosGnGal_SystemBC_Dec2020ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--673bf715-0ccc-48fd-93b5-570b417cc41a
Alperovitch 2014ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--74a577af-ef40-4767-a80a-68222fff5126
Unit42 Bookworm Nov2015ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--75bd34c6-c8b3-4b5e-aac4-9e410515169c
Malwarebytes Agent Tesla April 2020ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--783f71a1-8a2b-4dbe-9011-a24042f36c88
Telefonica Snip3 December 2021ATTACK:enterprise:S0437 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ded147e-f252-490a-b0d7-d8b3492c84eb
TrendMicro BlackTech June 2017ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--85a1a7f3-bdcc-4473-ba3c-46d6946d6996
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8c4aec9b-9927-4903-897b-fbd6552cde2e
Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:G0052 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--948a5d37-65d1-403f-99bb-0f08186aeebc
ClearSky Wilted Tulip July 2017ATTACK:enterprise:S1076 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f434edb-a9f5-4306-9868-0914efbb1b8a
Mandiant Suspected Turla Campaign February 2023ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a195cd11-43dc-4ad8-a48d-a1c705bb8b90
PTSecurity Higaisa 2020ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a987bd4f-dcb3-4fa8-8ca3-b76cfea921f6
Unit 42 Gamaredon February 2022 · VenereCiscoTalos_Gamaredon_Mar2025ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aa70970f-e39d-4808-baea-c02c4435e02f
Check Point Blind Eagle MAR 2025ATTACK:enterprise:G0079 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab3cf933-236f-4255-9ca6-24826f9bbe99
Unit 42 DarkHydrus July 2018ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0bac30d-7e77-41dd-9af8-c3daab9fa7b8
Bitdefender Trickbot VNC module Whitepaper 2021ATTACK:enterprise:S1053 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b1aab9dc-267d-4208-b1bc-14396d7e0d8d
Malwarebytes AvosLocker Jul 2021ATTACK:enterprise:S1152 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5c99a08-a5ab-41fc-88fa-1f3d3f9da504
PWC Yellow Liderc 2023ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b682bc04-73f7-4597-a772-264b28468fed
Kaspersky ToddyCat Check Logs October 2023ATTACK:enterprise:S1245 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c2def47b-3f77-4102-b8ff-3b5fb959ea35
ESET Contagious Interview BeaverTail InvisibleFerret February 2025ATTACK:enterprise:S0688 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c3e3d9d3-6fd2-43a0-ba72-bf7c259768d5
Check Point Meteor Aug 2021ATTACK:enterprise:G0133 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c9076ac7-11d9-44fc-91dc-0f927d62497f
ESET Nomadic Octopus 2018ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc1a0331-2b30-489c-ab4d-8853cff3a0b0
ESET InvisiMole June 2020ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ce0e4e49-3c40-4bce-96bd-460df4cb2124
Talos Kimsuky Nov 2021 · Securonix Kimsuky February 2025 · Aryaka Kimsuky July 2025ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf75bbf8-f88c-4277-b486-3bab9901c0c2
Eset PlugX Korplug Mustang Panda March 2022ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d771e7cf-1f8d-434c-a630-144f66466617
Microsoft Axios Compromise APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--da940fad-4778-4d61-b030-9618512c3537
Zscaler BlindEagle DEC 2025ATTACK:enterprise:S9019 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db065297-130b-4aba-b083-b301a1cc6ca6
Check Point Blind Eagle MAR 2025ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db8530c2-ce41-4943-8a17-91502187fd06
FireEye APT32 May 2017 · Cybereason Cobalt Kitty 2017ATTACK:enterprise:S0441 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dca41ced-2af1-4cec-8ed2-a1c77bc535ed
Unit 42 Inception November 2018ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e5bd61a9-44d3-4d69-b0b5-a05c8c0d3cac
SecureListUbiedo_Tsundere_Nov2025ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e60f4fce-425c-45f5-a6f3-ee6c3f808fb9
Unit 42 Magic Hound Feb 2017ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e83a16d0-70b7-415c-8b3f-bdbb89f10455
Emotet Deploys TrickBotATTACK:enterprise:S1086 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e8ab5495-dbc7-470a-b3e7-cbbfbf29094e
Morphisec Snip3 May 2021ATTACK:enterprise:S0466 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec5259f2-5a6c-4d42-bf21-f91c2df64f61
objective-see windtail1 dec 2018ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eeeb81ca-b5df-4477-918b-a70b8097da28
Fortinet LummaStealer 2024ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ef934eda-a3ad-40fb-8923-fc2f72fb8f6e
Medium Metamorfo Apr 2020ATTACK:enterprise:S0625 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fa0705b0-8006-4e73-9a7c-aa051320f8b4
McAfee Cuba April 2021ATTACK:enterprise:S1237 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fa871b4b-c3a6-4797-9e70-4dda6fc6a0cc
Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fbc96b86-2c57-40b6-89f7-d7a755275a45
Carbon Black HotCroissant April 2020ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fcd9b8a1-60c0-4d6b-9742-77f9104f8e56
Bromium Ursnif Mar 2017