aol.pm

Non-Standard Port

Technique · ATTACK:enterprise:T1571

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1571",
  "title": "Non-Standard Port",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1571",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--b18eae87-b469-4e14-b454-b171b416bc18",
  "external_id": "T1571",
  "domain": "enterprise",
  "created": "2020-03-14T18:18:32.443Z",
  "modified": "2026-09-03T19:46:48.006Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [
    {
      "source_name": "University of Birmingham C2",
      "url": "https://arxiv.org/pdf/1408.1136"
    },
    {
      "source_name": "Symantec Elfin Mar 2019",
      "url": "https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"
    },
    {
      "source_name": "change_rdp_port_conti",
      "url": "https://x.com/TheDFIRReport/status/1498657772254240768"
    },
    {
      "source_name": "Fortinet Agent Tesla April 2018",
      "url": "https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html"
    }
  ]
}

Explicit source assertions (70)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0090 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0076c114-0e7a-45c3-a851-7a877a9eefd0

Kaspersky WIRTE November 2021

ATTACK:enterprise:S1211 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--015aa3fc-58b6-4ee0-afa2-7bb60d5b108f

Symantec Bilbug 2022

ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01c982c2-f610-443f-ae60-1b4a1f508f81

Group IB Silence Sept 2018

ATTACK:enterprise:S1031 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b2b567c-718c-485f-b187-2bf6c6bb0c76

Unit 42 PingPull Jun 2022

ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d44a3cb-f0f1-4b8a-a39d-536783735e8c

Socket Contagious Interview NPM April 2025

ATTACK:enterprise:G1042 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1080e9e7-df85-4f83-8b7f-5b5edd1e4aee

RecordedFuture RedEcho 2021

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12c14ace-db29-4b08-a052-ba867c9ba534

Binary Defense Emotes Wi-Fi Spreader · Talos Emotet Jan 2019

ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14787d55-5815-43ee-ae4b-a31334ceed97

Koi Glassworm InvisibleCode October 2025

ATTACK:enterprise:S0491 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18714758-e6ea-4f61-87c9-6340c0001b9c

Bitdefender StrongPity June 2020

ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--207f1084-a466-4e08-a157-886db373f09a

Talos PoetRAT April 2020

ATTACK:enterprise:S0493 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2243acac-6401-41df-b658-2a36f7977d15

Trustwave GoldenSpy June 2020

ATTACK:enterprise:S1155 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22fac24b-a5a4-45ef-b6c4-0247a877b23a

Github Covenant

ATTACK:enterprise:S1049 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2311b504-e0c3-4594-8174-f9ce86941bc3

Mandiant UNC3890 Aug 2022

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ab4296f-bc5c-4589-863f-e42f5f334ae2

CERT Polska · ESET DynoWiper Update JAN 2026

ATTACK:enterprise:S9023 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d50f9cb-8164-4cbe-bff9-d7ecfa55f123

JPCERT MirrorFace JUL 2024 · Trend Micro Earth Kasha NOV 2024

ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30cfec26-a5ff-460d-876c-ca7f9d1e639f

RedCanary RaspberryRobin 2022

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30f0fc1f-d2fb-4bc8-98b1-431324127f07

FoxIT Wocao December 2019

ATTACK:enterprise:S0515 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31b54e57-8a8c-4c0f-9170-b3694dd82005

CISA WellMail July 2020 · NCSC APT29 July 2020

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31e2a6f9-065f-44ca-82eb-5cf12f6fd07a

FalconFeeds_MuddyWaterPSRust_Mar2026

ATTACK:enterprise:S0376 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36983a10-4fdb-4bfc-83a0-78f4d11e83df

US-CERT HOPLIGHT Apr 2019

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a5c4e73-3657-470e-882b-563f3ca599e7

Talos ZxShell Oct 2014

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3cae7fc8-e671-486b-a431-791a32df92a7

CISA GRU29155 2024

ATTACK:enterprise:S0149 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ffac9f5-9a5e-41dd-aa7d-c981842015d7

Palo Alto MoonWind March 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4050ee68-3f26-49e6-beec-e2a62133a1c3

ESET OceanLotus Mar 2019

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42af62e7-3e38-46e7-ac70-c557f33d377d

Costa AvosLocker May 2022

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47e672a4-8646-420a-9847-ba801b0ff52a

Sygnia VelvetAnt 2024A

ATTACK:enterprise:S0246 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--53e123a8-0794-4bec-b71b-3c4b4a94057f

US-CERT HARDRAIN March 2018

ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--554b85dc-40d2-47ac-9ba5-90765feb4e8e

Mandiant UNC3886 Juniper Routers MAR 2025

ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--569abeb3-4d27-4157-a50f-0ec8fc4b3f92

Elastic Pikabot 2024

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a34e6af-f5e1-4191-aec0-06a92201f414

Unit42 OceanLotus 2017

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62bfecb7-7388-410a-afb3-fcd60fbc0af9

TrumanKroll_SYSTEMBCServer_Jan2024

ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6cc8e1ce-c007-4a26-bd3b-cac73bb98c73

FireEye Metamorfo Apr 2018

ATTACK:enterprise:C0032 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7098d4d8-3fac-406e-84e1-508771c89802

FireEye TRITON 2019

ATTACK:enterprise:S0574 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--730a735c-1008-490e-b0c8-6938b858b28a

Unit42 BendyBear Feb 2021

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--759af051-f194-4a68-98af-224f7d9916e8

ESET BlackEnergy Jan 2016

ATTACK:enterprise:S1246 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a61c895-add6-4631-aa2e-53efe5a85f44

ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023 · PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--800f3241-62f4-4eb4-b9a2-df62f67d27d6

Novetta Blockbuster RATs · Novetta Blockbuster

ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8131a5ed-f95f-406d-ae56-e5e10c8ced74

Trend Micro njRAT 2018

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82548a34-d074-4c8f-af32-c7c5851377a8

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:M1030 → mitigates → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--840fc319-2583-4a2b-8363-1a7e3fa33157

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--921b9a4d-091a-442b-981a-0b34daa2ed6a

BlackBerry_FIN7_April2024 · FireEye FIN7 Aug 2018

ATTACK:enterprise:C0055 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--946ccfa8-eef3-41f6-99ef-74d6caa817ce

Sekoia 7777 Botnet JUL 2024 · Microsoft Storm-0940

ATTACK:enterprise:S1085 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ee6eb40-881c-4928-a036-58a8df0e8f95

Bitdefender Sardonic Aug 2021

ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a06533f5-02f9-4246-9315-0fa8df3465e0

ESET DazzleSpy Jan 2022

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5bb3ddf-446a-42c4-b522-112ad643c678

Fidelis Turbo

ATTACK:enterprise:S1218 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--acb3d56b-d5bc-4be9-be1e-f1bda4c7771e

Google Cloud Threat Intelligence ESXi VIBs 2022

ATTACK:enterprise:S1078 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--af74a9b1-6c74-45b6-a21d-38686afb202c

netlab360 rotajakiro vs oceanlotus

ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b2848d62-76a1-465c-b12e-7dc3113e6bbe

ESET RTM Feb 2017

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b35cd29e-1439-4f7a-a81e-44d4db29cd8b

DFIR Phosphorus November 2021 · Unit 42 Magic Hound Feb 2017

ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b75e158b-3c2e-425d-a14e-84a974d86c8c

Trend Micro Totbrick Oct 2016 · Bitdefender Trickbot VNC module Whitepaper 2021 · Fidelis TrickBot Oct 2016 · S2 Grupo TrickBot June 2017

ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bfbabaff-1918-4a35-b5ab-8aa981e50027

CISA AR18-352A Quasar RAT December 2018

ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c0a3674d-ff9b-49e0-8a18-43ba8d795163

Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024 · JPCERT SPAWNCHIMERA Ivanti February 2025

ATTACK:enterprise:S0245 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c13bc6b0-a8fa-4c52-9774-3738a5f1ce90

US-CERT BADCALL

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c308ceda-6c7c-4f7f-847b-e64f992d0104

VenereCiscoTalos_Gamaredon_Mar2025

ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c5692c9d-8cac-4105-ae0b-f3b6c60a2253

Sygnia VelvetAnt 2024A

ATTACK:enterprise:S1245 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c57b65a3-294a-43fd-af9c-b764e9305190

Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024

ATTACK:enterprise:G0105 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca38f31f-3551-49e3-835b-588693a8b512

Securelist DarkVishnya Dec 2018

ATTACK:enterprise:C0043 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d00a3ec5-cdbf-4646-a12e-4269dce56774

RecordedFuture RedEcho 2021

ATTACK:enterprise:S0263 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d21527b8-a8c8-4c95-9061-21c49155232e

US-CERT TYPEFRAME June 2018

ATTACK:enterprise:S1217 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2fc5856-5010-41e7-9175-958e3029df47

Google Cloud Threat Intelligence ESXi VIBs 2022

ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d40daa58-ca17-400c-b488-4508775e55e7

Lumen KVBotnet 2023

ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db0f9f05-6f76-47c3-81bf-a59d85045188

QiAnXin APT-C-36 Feb2019

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e61e5dc3-b6ac-4909-b188-eaede02385df

Talos GravityRAT

ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e6b9c4c1-3b84-4957-8533-f96a92dcab2a

Symantec Elfin Mar 2019

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e9092e54-ff13-4180-9850-c50e45dc1b41

Microsoft Axios Compromise APR 2026 · Microsoft Sapphire Sleet APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e9b71895-a9d2-4023-930b-4204f6c2d325

US-CERT Bankshot Dec 2017

ATTACK:enterprise:S0153 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ec55cdc1-8ca2-42c9-a1d9-9755d24bc294

PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f07b76ab-6e72-4112-bc23-3b64b50131f0

ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f4a65903-0b28-4e52-ad3b-bb7c55772509

NCSC Cyclops Blink February 2022

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f7f947cd-6e0c-499c-8cdf-293e38657e31

Anomali Rocke March 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.