Skip to content

Symmetric Cryptography

Subtechnique · ATTACK:enterprise:T1573.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1573.001",
  "title": "Symmetric Cryptography",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1573/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--24bfaeba-cb0d-4525-b3dc-507c77ecec41",
  "external_id": "T1573.001",
  "domain": "enterprise",
  "created": "2020-03-16T15:45:17.032Z",
  "modified": "2026-09-02T20:07:39.622Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [
    {
      "source_name": "Destination Certification",
      "url": "https://destcert.com/resources/symmetric-cryptography/"
    },
    {
      "source_name": "Symmetric vs Asymmetric Cryptography",
      "url": "https://www.keyfactor.com/blog/symmetric-vs-asymmetric-cryptography-whats-the-difference-and-when-to-use-each/"
    }
  ]
}

Explicit source assertions (187)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0245022b-05ac-4d66-ae9f-e4c2f604c07a

Kaspersky Dridex May 2017

ATTACK:enterprise:S0649 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0335dd7e-1f5e-4068-b680-197de6c0af68

FireEye SMOKEDHAM June 2021

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03927dc7-2ef0-43e4-ad71-94243e29bca4

ESET InvisiMole June 2018

ATTACK:enterprise:S1227 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0618bd56-0ca0-4750-ac4e-ab6fa475298c

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--089ad94f-daa3-437d-931a-9fc2b782595c

Lunghi Iron Tiger Linux

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--095a259d-79c7-42b0-b65a-e423f110d187

Trend Micro Emotet Jan 2019

ATTACK:enterprise:S0113 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d3e115b-ff08-4bff-8802-be3d21cec68f

ESET Operation Groundbait

ATTACK:enterprise:S0066 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e630f6b-8662-4ffe-b666-709e17aad69f

CrowdStrike Putter Panda

ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ef68afe-92bf-48f6-800c-f20431abdd7e

Joint Cybersecurity Advisory LockBit 3.0 MAR 2023

ATTACK:enterprise:S0034 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--122e6f20-ab3b-4bf0-bef1-0372399bee7c

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--140046d6-8cb6-4a09-bd74-fd7696ac4247

ESET Machete July 2019

ATTACK:enterprise:S0344 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14568d94-858d-4b8a-af94-88cd17f6ab10

Unit42 Azorult Nov 2018 · Proofpoint Azorult July 2018

ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--180f0c7c-c7bb-4131-b831-f406ee0516e2

Unit 42 Bisonal July 2018 · Talos Bisonal Mar 2020 · Kaspersky CactusPete Aug 2020

ATTACK:enterprise:S0060 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19c33297-1efd-4489-b09c-a4230ce194f4

Baumgartner Naikon 2015

ATTACK:enterprise:S0081 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a028242-1896-4867-a691-c97867f1663d

Lotus Blossom Jun 2015

ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a20c3db-a33c-4129-9fad-3f5605c0cbcb

Novetta Winnti April 2015

ATTACK:enterprise:S0664 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b418159-e33b-407e-9849-1ebeddaa4074

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ba38510-0489-4305-944f-451e6869b30f

Forcepoint Monsoon · TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0272 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1bc5328a-e079-4478-9d04-d840626d4976

TrendMicro Patchwork Dec 2017

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ca66056-792e-4e19-8742-a782d87806e4

Eset PlugX Korplug Mustang Panda March 2022 · Recorded Future REDDELTA July 2020 · Unit42 Bookworm Nov2015

ATTACK:enterprise:S1076 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ccef9f1-9fb4-460d-81a9-e0353e9440bd

Mandiant Suspected Turla Campaign February 2023

ATTACK:enterprise:S1085 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1de3d895-7bf9-4b60-b819-d49b31a26b38

Bitdefender Sardonic Aug 2021

ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e05bf60-ac1b-4497-a9bc-55eff65cf927

Microsoft DUBNIUM July 2016

ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e3a1ea2-55fb-4abc-970a-e384b4c7d314

ESET Attor Oct 2019

ATTACK:enterprise:S0010 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21717b6b-1fc6-4619-9877-bb36237a8efd

Villeneuve 2011

ATTACK:enterprise:S1034 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2315fa7f-2161-45c1-9f23-d47a96488465

Cybereason StrifeWater Feb 2022

ATTACK:enterprise:S0220 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25d4fa6d-4f88-4604-8b9f-cce6f3b5ae4d

Chaos Stolen Backdoor

ATTACK:enterprise:S0371 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2624fd3f-9282-4080-bace-6a673fd31b9f

FireEye APT33 Guardrail

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27ebfbf5-7d18-457d-899a-9a1213d01729

Zscaler Havoc FEB 2023 · Fortinet Havoc MAR 2025

ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28b3fb26-c7f8-481d-8424-895953bfb492

FireEye SUNBURST Backdoor December 2020

ATTACK:enterprise:S0284 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b454322-5ad5-449f-86c9-092867acd51c

Security Intelligence More Eggs Aug 2019

ATTACK:enterprise:S0009 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c29e6cf-a177-4578-bf1f-fd73ae254edd

ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c339e33-c290-42bc-9f2c-056aa0a321d8

Red Canary NETWIRE January 2020

ATTACK:enterprise:S0170 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d8cdbf3-1be2-4e64-ba18-f8b65fcbae8f

Palo Alto OilRig May 2016

ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f3ff7c9-ea14-45ad-b295-6f2f3c40cff7

CISA AR18-352A Quasar RAT December 2018 · GitHub QuasarRAT · Volexity Patchwork June 2018

ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30a4c248-9477-4eba-8925-f559682b0a1f

Kaspersky LODEINFO Part II OCT 2022

ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30da2329-c7ee-4ac9-a38d-af79e6c1389c

Carbon Black HotCroissant April 2020 · US-CERT HOTCROISSANT February 2020

ATTACK:enterprise:S1218 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31912c9b-b79c-45f4-bef0-9beafe1ccedd

Google Cloud Mandiant UNC3886 2024 · Google Cloud Threat Intelligence ESXi VIBs 2022

ATTACK:enterprise:S9007 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--327f0f36-bcc5-42fa-9b17-024ebee99466

Gen Digital Kimsuky HTTPTroy October 2025

ATTACK:enterprise:S0486 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--336e0a87-8ee2-420d-8fb8-10ea2c015723

ESET ForSSHe December 2018

ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--339746da-8c6e-4273-8e17-895d3b50fe4d

Unit 42 Lucifer June 2020

ATTACK:enterprise:S0011 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34e75ef5-b2de-41dc-96d3-2c5388c570be

TrendMicro Taidoor · CISA MAR-10292089-1.v2 TAIDOOR August 2021

ATTACK:enterprise:S0087 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34e9fc0a-75b9-4100-91ef-30ca3225958a

ATTACK:enterprise:S0181 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35f02c40-d46f-44fa-8ba2-5106357494b4

US-CERT FALLCHILL Nov 2017 · CISA AppleJeus Feb 2021

ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3658d2f3-25f5-404a-bf0b-7c5fce9978f6

McAfee Lazarus Jul 2020

ATTACK:enterprise:S0256 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3671c28f-927b-40e0-ba75-079c0aafea5b

ESET Turla Mosquito Jan 2018

ATTACK:enterprise:S0200 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36b2817e-5f07-4f70-927c-8e04b955d5a3

Microsoft PLATINUM April 2016

ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38848a62-c389-4344-8bed-094292cef803

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39cf6431-f800-4911-8434-49ce1b2874f1

Check Point APT35 CharmPower January 2022

ATTACK:enterprise:S0245 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a11eb81-545a-4153-8c3b-feb47db1f288

US-CERT BADCALL

ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3db5259f-5426-4c47-8fc3-44118f63f985

Check Point Warzone Feb 2020

ATTACK:enterprise:S0037 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ebc8829-f260-4d75-817a-cd23a4ebb194

ATTACK:enterprise:S1169 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f4442d9-b61e-4f78-a364-e62f6ab364b1

ESET OilRig Campaigns Sep 2023

ATTACK:enterprise:S1141 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f86f383-8536-4d0b-913a-458ac9d414b8

ESET Turla Lunar toolset May 2024

ATTACK:enterprise:S1222 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40364e9d-b579-440e-9528-0edb6c790c25

Google Cloud Mandiant UNC3886 2024

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4114a4a5-c9e7-4f61-90f3-4a13789a6b37

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4153632f-9ac5-4f8b-af83-b4b089ce5429

Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

ATTACK:enterprise:S0610 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4256a056-d15a-4323-8e04-92e623d5e899

Check Point APT34 April 2021

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47b5c142-c0e5-4754-ae7f-b95bf01d3a5b

Unit42 OceanLotus 2017

ATTACK:enterprise:S0082 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b5540e5-eac1-40f4-93d0-155f60e9395a

Lotus Blossom Dec 2015

ATTACK:enterprise:S0076 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b6bee9b-469e-48ce-84fa-5322de03470a

Scarlet Mimic Jan 2016

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b70ec83-7488-4b4e-bd0b-58fb45da3a15

Kaspersky QakBot September 2021

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4c06e313-2cde-494c-a8dc-449649a1afa6

Novetta Blockbuster Destructive Malware · Novetta Blockbuster · McAfee Lazarus Resurfaces Feb 2018 · McAfee GhostSecret

ATTACK:enterprise:S1026 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4c131eaa-c7c1-4c17-bcab-25cdf35e743c

SentinelOne Aoqin Dragon June 2022

ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d6a3a5b-58c2-4dab-8710-fe7e6b893f98

PaloAlto CardinalRat Apr 2017

ATTACK:enterprise:S0074 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e5dff55-c686-4fa6-bad1-caa8507083d9

ATTACK:enterprise:G0128 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--53da7e18-3812-47d5-a8de-af49e84f796a

Zscaler APT31 Covid-19 October 2020

ATTACK:enterprise:S1193 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56160c7f-03d1-48e7-ad66-f959b13115bb

Mandiant APT42-untangling

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a347320-15ce-40b9-8b9f-05f7c0c3ff9c

Secureworks BRONZE SILHOUETTE May 2023

ATTACK:enterprise:S0180 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ac475f9-f253-44db-861e-c7303961aa6c

US-CERT Volgmer 2 Nov 2017

ATTACK:enterprise:S0068 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b3d2b2f-73f4-4fef-9cb9-b11db3eb4c4f

CrowdStrike Putter Panda

ATTACK:enterprise:S1119 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5bef15c2-1aa4-4f94-b594-0b5e03c26a41

Mandiant Cutting Edge Part 2 January 2024

ATTACK:enterprise:S0394 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--603d13cd-f6f7-4321-99db-3d3326878de4

Intezer HiddenWasp Map 2019

ATTACK:enterprise:S0149 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--609d3d8c-1995-43ef-a102-a39d668a774d

Palo Alto MoonWind March 2017

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60ef22cb-b7e7-4426-ab3a-11254fe63154

Kaspersky ToddyCat June 2022

ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63113486-c2a1-4a83-8d49-2065f972f83f

Zscaler Pikabot 2023 · Elastic Pikabot 2024

ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--639a960d-8cc1-4f6f-aca1-cf3c6445d056

Group IB GrimAgent July 2021

ATTACK:enterprise:S0275 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64eefbfb-5241-4325-919d-4739504644c2

Trend Micro Earth Kasha Anel NOV 2024 · Trend Micro Earth Kasha Updates APR 2025 · FireEye APT10 Sept 2018

ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64fa019e-5eb1-404c-9488-d4083ccc8b65

ATTACK:enterprise:S0065 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6613ed52-5c6c-43f2-bd0c-9809769cb022

CrowdStrike Putter Panda

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.