Skip to content

Spearphishing Attachment

Subtechnique · ATTACK:enterprise:T1566.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1566.001",
  "title": "Spearphishing Attachment",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1566/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--2e34237d-8574-43f6-aace-ae2915de8597",
  "external_id": "T1566.001",
  "domain": "enterprise",
  "created": "2020-03-02T19:05:18.137Z",
  "modified": "2026-09-11T19:55:20.273Z",
  "version": "2.2",
  "aliases": [

  ],
  "tactics": [
    "initial-access"
  ],
  "source_references": [
    {
      "source_name": "ACSC Email Spoofing",
      "url": "https://web.archive.org/web/20210708014107/https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf"
    },
    {
      "source_name": "Unit 42 DarkHydrus July 2018",
      "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
    },
    {
      "source_name": "Microsoft Anti Spoofing",
      "url": "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide"
    },
    {
      "source_name": "Elastic - Koadiac Detection with EQL",
      "url": "https://www.elastic.co/security-labs/embracing-offensive-tooling-building-detections-against-koadic-using-eql"
    }
  ]
}

Explicit source assertions (159)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--029bdc73-5054-45eb-b9d0-e4281f69d85a

TrendMicro Cobalt Group Nov 2017 · RiskIQ Cobalt Nov 2017 · Group IB Cobalt Aug 2017 · Proofpoint Cobalt June 2017 · PTSecurity Cobalt Dec 2016 · PTSecurity Cobalt Group Aug 2017 · Talos Cobalt Group July 2018 · Unit 42 Cobalt Gang Oct 2018

ATTACK:enterprise:S0669 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02a8db04-60e6-437c-8f1a-12aff6a13c63

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:C0028 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--04427a61-cef7-4197-9ff4-cb36c6a1895e

Ukraine15 - EISAC - 201603

ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--060894ab-c1ec-488c-8d66-25924c82ad58

Talos Lokibot Jan 2021

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--061841f1-5814-41e3-94b5-536b8a52d062

Qualys LolZarus · Lazarus APT January 2022 · McAfee Bankshot · Kaspersky ThreatNeedle Feb 2021

ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06957b67-183f-4320-94ca-15a138382323

Palo Alto Unit 42 OutSteel SaintBot February 2022

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06f7f9cd-4e6b-4abe-bff0-c9c0fcaf920e

Bitdefender Agent Tesla April 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0be962d8-6281-4554-ad1f-4cba04c547de

CitizenLab Tropic Trooper Aug 2018 · TrendMicro TropicTrooper 2015 · TrendMicro Tropic Trooper May 2020 · Anomali Pirate Panda April 2020 · Unit 42 Tropic Trooper Nov 2016

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e1bf920-fd5a-4859-bf55-62e5f9817289

Visa FIN6 Feb 2019

ATTACK:enterprise:S1064 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1401717f-8315-430c-aae6-045602619d52

HP SVCReady Jun 2022

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15bbd8e5-60ad-4906-8231-f92c231bb1ec

Accenture SNAKEMACKEREL Nov 2018 · Sofacy DealersChoice · TrendMicro Pawn Storm Dec 2020 · Securelist Sofacy Feb 2018 · Unit 42 Sofacy Feb 2018 · Palo Alto Sofacy 06-2018 · DOJ GRU Indictment Jul 2018 · Secureworks IRON TWILIGHT Active Measures March 2017 · Cato LAMEHUG JUL 2025

ATTACK:enterprise:S1066 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1813df9f-2bd9-4451-b4dd-aa80716ce151

Secureworks DarkTortilla Aug 2022

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a7f1f1e-511a-44bf-8d9e-fd3260febfc8

FireEye admin@338

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ab045b8-35b4-4920-8223-d1a6b8c6ae1e

SANS Windshift August 2018

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ad674bb-c8e1-4f19-b96e-f56bfa10797c

Symantec Tick Apr 2016 · Trend Micro Tick November 2019

ATTACK:enterprise:G0090 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1aeb4dce-ac27-43ae-a0f4-1afcf84fc1a9

Kaspersky WIRTE November 2021

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2305a634-b226-4da2-a766-bec5458f9447

CloudSEK_RustyWater_Jan2026 · ClearSky MuddyWater June 2019 · ESET_MuddyWater_Dec2025 · DHS CISA AA22-055A MuddyWater February 2022 · Securelist MuddyWater Oct 2018 · Unit 42 MuddyWater Nov 2017 · Anomali Static Kitten February 2021 · Proofpoint TA450 Phishing March 2024 · Trend Micro Muddy Water March 2021 · FireEye MuddyWater Mar 2018 · SOCRadar_MuddyWaterDindoor_Mar2026

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--239d98a7-f134-4270-8333-c2df2feaa9ca

FireEye APT10 April 2017 · FireEye APT10 Sept 2018 · PWC Cloud Hopper Technical Annex April 2017 · District Court of NY APT10 Indictment December 2018

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26d24472-ae04-46e7-9166-5d8a8f6f16f7

ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29686ce0-db1e-4d77-a21c-7b1e97ee51ac

Talos PoetRAT April 2020

ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b948c49-f65d-4e60-969f-229030b4d311

Unit42 Redaman January 2019

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30b93042-d56e-4ecf-82d8-8b287bd9c00c

Trend Micro DRBControl February 2020

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35624bc2-caf0-4124-88e8-6f60ae52ed9c

ESET Gamaredon June 2020 · CERT-EE Gamaredon January 2021 · TrendMicro Gamaredon April 2020 · Microsoft Actinium February 2022 · ESET Gamaredon Sept2024 · Secureworks IRON TILDEN Profile · SilentPush_GamaredonFastFlux_Sept2023 · unit42_gamaredon_dec2022 · Unit 42 Gamaredon February 2022 · VenereCiscoTalos_Gamaredon_Mar2025

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3577cdd8-c9fd-4b97-94a5-6332f9cad77a

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3890dead-331f-498d-b99d-2191150ae2ac

Antiy CERT Ramsay April 2020

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a8d8063-3f4d-420d-8c72-2b99077aa487

ESET OceanLotus · Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017 · ESET OceanLotus Mar 2019 · FireEye APT32 April 2020 · Amnesty Intl. Ocean Lotus February 2021

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b9a3c69-a667-4bba-b920-ee04e729800b

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3cce0cb1-051f-48da-8712-e9d2eba871a0

Securelist Darkhotel Aug 2015 · Microsoft DUBNIUM July 2016

ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3efa9831-8d67-4bd1-92d4-ef252747b701

Forcepoint BITTER Pakistan Oct 2016 · Cisco Talos Bitter Bangladesh May 2022

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--410f6714-cd02-4253-b324-a8ac15e70bca

ESET T3 Threat Report 2021 · F-Secure The Dukes · MSTIC NOBELIUM May 2021 · Secureworks IRON HEMLOCK Profile

ATTACK:enterprise:S0011 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--416fd781-438e-4130-bfac-8ac653e85c2c

TrendMicro Taidoor

ATTACK:enterprise:S0585 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4224c436-0960-4cea-b135-166008a1c087

Amnesty Intl. Ocean Lotus February 2021

ATTACK:enterprise:G0100 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42580e44-781d-467d-b131-45f7d4651d0a

Kaspersky Cloud Atlas December 2014 · Symantec Inception Framework March 2018 · Unit 42 Inception November 2018 · Kaspersky Cloud Atlas August 2019

ATTACK:enterprise:C0001 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45f64e39-c3f8-4665-8433-af9503852e53

Talos Frankenstein June 2019

ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4852a801-3cd3-4a97-90ef-8cb5974c80d9

FireEye Metamorfo Apr 2018 · ESET Casbaneiro Oct 2019

ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ae86603-3199-4692-b37c-f26a7c7e3fc2

Proofpoint Bumblebee April 2022 · Google EXOTIC LILY March 2022

ATTACK:enterprise:G0130 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b98c580-7907-487c-a5b1-202663762c47

Check Point Rocket Kitten

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4bd4de17-4aa2-4924-a1fd-d82a68209cf0

ATTACK:enterprise:S0631 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4cfed6dd-68ac-4b0a-acd1-b888c0c69c4f

Cybereason Chaes Nov 2020

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--509eddb7-b86f-4831-953f-15017b5d987e

Gigamon Berserk Bear October 2021

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5259c2ae-964d-49b6-a7e7-6246e748369f

ESET Telebots Dec 2016 · Google_WinRAR_vuln_2023 · mandiant_apt44_unearthing_sandworm · US District Court Indictment GRU Unit 74455 October 2020 · US-CERT Ukraine Feb 2016 · iSight Sandworm Oct 2014

ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--537d027b-0559-4d1a-8f28-a918d3d23e63

CSM Elderwood Sept 2012 · Symantec Elderwood Sept 2012

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--538eb3a4-466e-42d0-9f12-bd9b6de0abe4

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54fd87c2-7d29-422f-bf92-96e7d603563f

Microsoft Holmium June 2020

ATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--550096e6-6ed2-41de-8cfc-3a59da54bf68

Bleeping Computer Latrodectus April 2024

ATTACK:enterprise:S0499 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--554fbee8-58a9-4557-bf49-f1df2c5da442

FireEye Hancitor

ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55b42570-f8fe-472f-ae12-e3dd0b6de9c6

Fortinet Remcos Campaign NOV 2024

ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a9f2571-e611-4f7f-b0c9-6fc2d306b2f6

Kaspersky MoleRATs April 2019 · Unit42 Molerat Mar 2020 · Cybereason Molerats Dec 2020

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b63f8fd-efc7-454f-b466-d5e0a525f64f

Cymmetria Patchwork · Securelist Dropping Elephant · TrendMicro Patchwork Dec 2017 · Volexity Patchwork June 2018

ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d881746-44f9-4865-86de-97253fc197fb

Unit 42 Valak July 2020 · Unit 42 TA551 Jan 2021 · Secureworks GOLD CABIN

ATTACK:enterprise:G0048 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5f1493e8-65d8-474a-b6b7-c1311fc24d98

Group IB RTM August 2019

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5f338678-212e-4940-b0f1-79b14d8c8c96

group-ib_redcurl1 · trendmicro_redcurl

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6160a359-35cc-4bbe-ac29-500f2751ed4b

FireEye APT41 Aug 2019

ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61853db1-63fa-464a-8ac0-a2e6996850e1

Recorded Future TAG-144 AUG 2025

ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63065346-29bd-40de-9826-04646cc5a9a6

CERT-UA WinterVivern 2023 · DomainTools WinterVivern 2021 · SentinelOne WinterVivern 2023

ATTACK:enterprise:S9044 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64153f57-7a26-4254-86ff-29e87ead133c

Artic Wolf Labs Kali365 Device Code April 2026

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--645949a0-21a3-4c31-846d-33c2055d8bfd

Malwarebytes Higaisa 2020 · Zscaler Higaisa 2020

ATTACK:enterprise:S0660 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--67f3f607-8c27-4a90-b1bf-e84f75815a42

Trend Micro DRBControl February 2020

ATTACK:enterprise:S0634 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6813e94f-a123-4898-80c8-59e74c390fe3

MSTIC Nobelium Toolset May 2021

ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--69684ccb-b9c0-4284-b2e5-09f15a691f80

Netskope Squirrelwaffle Oct 2021

ATTACK:enterprise:G0142 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c4c4e5d-0641-4441-a5aa-d27f3362811f

Uptycs Confucius APT Jan 2021

ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d1cd674-0466-4209-b9b5-7ce45ed359d1

Securelist Brazilian Banking Malware July 2020

ATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--713c3a5e-931b-4c43-a945-c26f031b0183

Cylance Dust Storm

ATTACK:enterprise:S1014 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--721320d4-36f0-4449-8331-8fbe40b1dba5

SecureWorks August 2019

ATTACK:enterprise:C0037 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--725648c5-1938-4c61-86f7-34fbb66cacfc

TrendMicro Pikabot 2024

ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72edd078-766e-4ae1-80de-f2c5248fb9bf

DCSO StrelaStealer 2022

ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73e00ae6-71f1-4ad7-861a-f0643b42c2ac

Check Point Warzone Feb 2020 · Uptycs Confucius APT Jan 2021

ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--748d3716-e476-4677-979b-cb4c51c598c1

ESET MirrorFace DEC 2022 · Kaspersky LODEINFO OCT 2022 · ITOCHU LODEINFO JAN 2024

ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75122837-7638-4ff2-8cb4-fbb8001e96f2

ATTACK:enterprise:G0062 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76021528-7cb6-461a-870a-f681cac19285

Proofpoint TA459 April 2017

ATTACK:enterprise:G0098 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--795b9ebc-6bf1-47f9-b236-117c2216c5d4

TrendMicro BlackTech June 2017 · NTT Security Flagpro new December 2021

ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a2f70b7-7b6e-4c05-8f71-42a494b055ce

Unit 42 Gorgon Group Aug 2018

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a64af0b-aebe-47d1-9f96-ef0ecad52df9

Proofpoint Leviathan Oct 2017 · CISA AA21-200A APT40 July 2021

ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a75d200-29f5-4f8a-b052-bcbe4e5ca236

ATTACK:enterprise:G0103 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b4af425-27a6-4330-85e2-d8d03911d923

FOX-IT May 2016 Mofang

ATTACK:enterprise:S1086 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d1c227c-25b9-4e8b-ad88-618d9f382420

Telefonica Snip3 December 2021

ATTACK:enterprise:S0433 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d93f85e-52a1-4771-8378-0fabfd707ece

Carbon Black HotCroissant April 2020

ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e9f9565-d9c5-47e5-a962-8dfa3dc77fc6

Unit 42 Valak July 2020

ATTACK:enterprise:G0019 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80fb05e9-68b8-4e3f-bc9a-2a5f828c397c

CheckPoint Naikon May 2020

ATTACK:enterprise:G0005 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8126e72d-1be0-4237-b9c9-33045be072c3

Moran 2014 · Trend Micro IXESHE 2012

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.