Malware
Subtechnique · ATTACK:enterprise:T1587.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1587.001",
"title": "Malware",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1587/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--212306d8-efa4-44c9-8c2d-ed3d2e224aa0",
"external_id": "T1587.001",
"domain": "enterprise",
"created": "2020-10-01T01:33:01.433Z",
"modified": "2026-05-12T15:12:00.622Z",
"version": "1.3",
"aliases": [
],
"tactics": [
"resource-development"
],
"source_references": [
{
"source_name": "Risky Bulletin Threat actor impersonates FSB APT",
"url": "https://news.risky.biz/risky-bulletin-threat-actor-impersonates-fsb-apt-for-months-to-target-russian-orgs/"
},
{
"source_name": "ActiveMalwareEnergy",
"url": "https://arstechnica.com/information-technology/2014/06/active-malware-operation-let-attackers-sabotage-us-energy-industry/"
},
{
"source_name": "FireEye APT29",
"url": "https://services.google.com/fh/files/misc/rpt-apt29-hammertoss-stealthy-tactics-define-en.pdf"
},
{
"source_name": "Kaspersky Sofacy",
"url": "https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/"
},
{
"source_name": "GamaCopy organization",
"url": "https://medium.com/@knownsec404team/love-and-hate-under-war-the-gamacopy-organization-which-imitates-the-russian-gamaredon-uses-560ba5e633fa"
},
{
"source_name": "Mandiant APT1",
"url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
},
{
"source_name": "Olympic Destroyer",
"url": "https://blog.talosintelligence.com/who-wasnt-responsible-for-olympic/"
},
{
"source_name": "FBI Flash FIN7 USB",
"url": "https://therecord.media/fbi-fin7-hackers-target-us-companies-with-badusb-devices-to-install-ransomware/"
}
]
}Explicit source assertions (45)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--062f7bee-8b54-4edd-aca9-11437b7cbc8b
Talos Kimsuky Nov 2021 · KISA Operation Muzabi · Mandiant APT43 March 2024ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--09e3c20a-eb8a-4731-9d9b-39f08cc2ecc7
Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ae6d331-80eb-4422-bb28-9145e389b377
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b5cb547-b027-4a30-84de-d9d1df2495d0
Crowdstrike Indrik November 2018ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--107d896b-a618-42fe-a453-76bc4b7d7330
FoxIT Wocao December 2019ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1754cf51-f712-4e7c-9108-fa276b9f1543
CISA AppleJeus Feb 2021 · Google TAG Lazarus Jan 2021ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--203b1d92-99d0-4ec7-98ae-e72d148e030d
Censys RedPenguin MAR 2025 · Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--22a3f284-c5b3-4e99-b278-0fdc33a8952b
ESET MirrorFace 2025ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--28327f48-fb30-4166-8273-f300879e8e99
ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e5fbe0a-9cdd-4df2-8061-617075b045fd
ESET OilRig Downloaders DEC 2023ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f45f81a-c4cf-4091-ac64-caaf5e925861
Mandiant Fortinet Zero DayATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e26385f-0aa0-44a3-8830-978610a1680d
Bitdefender LuminousMoth July 2021 · Kaspersky LuminousMoth July 2021ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e4011f8-05cc-422a-9daf-63f7c25fd772
ESET MirrorFace DEC 2022ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e925289-8c29-4e14-ac5e-dd4ab927b113
US District Court Indictment GRU Unit 74455 October 2020ATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f1ccf15-6249-4248-a919-00c34fa94eab
Wiz Trivy Compromise MAR 2026ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--490011ac-9105-4a35-bf4d-7fc3cd54a6a7
Cisco Salt Typhoon FEB 2025ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4e7404a5-2d19-48cc-b906-ab1aca4f4b08
Mandiant No Easy Breach · F-Secure The Dukes · Mandiant APT29 Eye Spy Email Nov 22 · MSTIC Nobelium Toolset May 2021ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--52e9a2ec-3999-4ec5-bdda-227fc2a79173
CISA Play Ransomware Advisory December 2023 · Trend Micro Ransomware Spotlight Play July 2023ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--580696cf-0816-4b7a-bfcf-ce61e59c6073
CERT Polska · ESET DynoWiper Update JAN 2026 · ESET DynoWiper JAN 2026ATTACK:enterprise:G1007 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65656d55-1f2f-43f9-b29f-084b9024841c
SentinelOne Aoqin Dragon June 2022ATTACK:enterprise:M1056 → mitigates → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6bf03275-b5bb-4c67-b3a6-5a4642d763e6
ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ce6e5d1-a9e1-43bb-a296-e6bd188081f4
CrowdStrike SUNSPOT Implant January 2021 · FireEye SUNBURST Backdoor December 2020 · Microsoft Deep Dive Solorigate January 2021ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7236a497-3b27-452c-ba91-d979251be07d
Kaspersky BlindEagle AUG 2024ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a054a81-bee9-4429-b00e-0c45c88f06d0
therecord_redcurlATTACK:enterprise:G0003 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7dbfb31d-8ac7-44c5-ad9b-f22e07e95d7e
Cylance CleaverATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--89009e94-5631-46f4-9760-460712d89491
FBI Salesforce Data Theft SEP 2025 · Google Salesforce JUN 2025ATTACK:enterprise:C0023 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8a6f7d54-3165-4fd2-a2f8-a6357d231192
ESET Dukes October 2019ATTACK:enterprise:G1009 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b9d30d9-7546-4fc0-87cb-1e432fe788e8
Checkpoint MosesStaff Nov 2021ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--97035de2-88de-4d7c-a8d2-655c5247e061
CheckPoint_NimbusManticoreEurope_Sept2025 · CheckPoint_NimbusManticore_May2026 · Mandiant_UNC1549TTPsTools_Nov2025 · Mandiant_UNC1549_Feb2024ATTACK:enterprise:C0030 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--97ca11ce-025d-4e46-93d7-deadd4bcd780
FireEye TRITON Dec 2017ATTACK:enterprise:C0046 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9a4bff6b-7db4-4520-9e99-b580a00f22d3
CCCS ArcaneDoor 2024 · Cisco ArcaneDoor 2024ATTACK:enterprise:C0010 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a36264d2-5bb2-4268-8ce1-3de9fbdf2862
Mandiant UNC3890 Aug 2022ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a8cfb738-65ac-4d5a-8ef7-d3a21eab02ea
Recorded Future Turla Infra 2020ATTACK:enterprise:C0044 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b7043937-a80f-4dfa-bb0c-1c05255cd096
ESET OilRig Campaigns Sep 2023ATTACK:enterprise:C0004 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b865d0be-c46c-4677-b66e-fe19e1fa9f31
BlackBerry CostaRicto November 2020ATTACK:enterprise:C0042 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bd416071-89a5-4d96-8978-d956491b1010
ESET OilRig Campaigns Sep 2023ATTACK:enterprise:C0013 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--caa820b8-5a7b-4704-88d9-380efff5a7a3
McAfee Sharpshooter December 2018ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cb727277-5491-422f-ab40-1bd1be973d1e
Microsoft NICKEL December 2021ATTACK:enterprise:C0039 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d11ccc61-70e8-4921-b760-59e4df84934c
Lumen Versa 2024ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d1bd6ce6-eb5f-41a1-b26f-4fe0d83e51ea
McAfee Lazarus Nov 2020 · ESET Lazarus Jun 2020 · McAfee Lazarus Jul 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--df1fb9fd-daf9-4820-a145-5b90ee144602
DOJ FBI Handala Hack March 2026ATTACK:enterprise:T1587.001 → subtechnique-of → ATTACK:enterprise:T1587
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ee74a23f-5981-4601-8321-a5db7af73f77
ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f2ca9a5f-9f4a-4575-8e28-341417a09dee
Eset PlugX Korplug Mustang Panda March 2022 · Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f2f8d56c-4a10-4be4-884d-7982931bd303
Unit 42 Hildegard MalwareATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fe8004eb-df5b-43c5-bf5a-1cbe028e8663
FBI Flash FIN7 USB · FireEye FIN7 Oct 2019