aol.pm

Malware

Subtechnique · ATTACK:enterprise:T1588.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1588.001",
  "title": "Malware",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1588/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--7807d3a4-a885-4639-a786-c1ed41484970",
  "external_id": "T1588.001",
  "domain": "enterprise",
  "created": "2020-10-01T02:06:11.499Z",
  "modified": "2026-09-02T17:55:52.445Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "resource-development"
  ],
  "source_references": [
    {
      "source_name": "BITSIGHT Malware Analysis",
      "url": "https://www.bitsight.com/blog/what-is-malware-as-a-service"
    }
  ]
}

Explicit source assertions (25)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05581e74-e78f-40e1-aa13-c990a99cbac3

Bitdefender LuminousMoth July 2021 · Kaspersky LuminousMoth July 2021

ATTACK:enterprise:C0002 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--113fbb20-8dd7-4ba6-b5a8-486e46d9abeb

McAfee Night Dragon

ATTACK:enterprise:C0005 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ae7391e-c622-45ee-8f8d-dca29b8bfea8

ESET Operation Spalax Jan 2021

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b3d9d74-02b4-4c4b-b5a7-12c0e7a9cad7

Huntio_IranInfra_Mar2026

ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c2faef1-3fa6-4942-be18-460a8e6ec815

Proofpoint TA2541 February 2022

ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ba6ae62-55e8-4ea2-a58c-75f15620e031

Check Point Blind Eagle MAR 2025 · Recorded Future TAG-144 AUG 2025 · LevelBlue Blind Eagle Proton66 JUN 2025

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a4abc29-8750-4fad-a7b8-c10bd8b1da8a

CISA GRU29155 2024

ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a86948b-4058-453a-aa8d-47cdc4346f41

MSTIC DEV-0537 Mar 2022

ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d1c440e-309c-457b-b36b-eb0103220a4f

Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

ATTACK:enterprise:G1013 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--67c23a08-47ef-4c09-8500-b1d7305ed6b7

SentinelLabs Metador Sept 2022

ATTACK:enterprise:C0050 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6cfe5ceb-c2c2-4745-8611-a3b9ebc4ad83

Lumen J-Magic JAN 2025

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b817a81-02a9-48f0-8166-9e25b6860a76

Mandiant APT1

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82697b12-31e0-4a9f-a394-d5555b0da05f

CrowdStrike AQUATIC PANDA December 2021

ATTACK:enterprise:G0140 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89446c0a-0f1b-4d04-92fb-a04c6b16e474

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:C0007 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b55c1b3-94fd-436f-8910-9d0519d3b5b4

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4bc3995-bd65-4a40-b7fc-088dcdddde0a

Google Cloud Mandiant UNC3886 2024

ATTACK:enterprise:G0138 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aaeef068-5853-45c9-922a-9ff779041cbe

FSI Andariel Campaign Rifle July 2017

ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b359d367-d52c-4835-b242-1073d8a55bc3

NCC Group TA505

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba6536dd-2c36-4057-bae9-e71e1076e69b

Recorded Future Turla Infra 2020 · NSA NCSC Turla OilRig

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bfb6dc5a-786f-47e8-ab9c-848a643df423

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:M1056 → mitigates → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6d22962-0e39-4339-a574-81e4891694a2

ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e607a77e-5c5c-4f3e-a62d-82124a434911

TrendMicro EarthLusca 2022

ATTACK:enterprise:G0135 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed5bd47a-cdc4-4962-b956-dd3ae7c00024

ESET BackdoorDiplomacy Jun 2021

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f93c2e91-ab53-454b-a54d-085a5a3c5e80

Check Point Scattered Spider JUL 2025 · Mandiant UNC3944 May 2025

ATTACK:enterprise:T1588.001 → subtechnique-of → ATTACK:enterprise:T1588

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--feccce31-b855-430b-a0f6-6e3a3eb41bf9

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.