Tool
Subtechnique · ATTACK:enterprise:T1588.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1588.002",
"title": "Tool",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1588/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--a2fdce72-04b2-409a-ac10-cc1695f4fce0",
"external_id": "T1588.002",
"domain": "enterprise",
"created": "2020-10-01T02:08:33.977Z",
"modified": "2026-05-12T15:12:00.706Z",
"version": "1.2",
"aliases": [
],
"tactics": [
"resource-development"
],
"source_references": [
{
"source_name": "Sentinel Labs Top Tier Target 2025",
"url": "https://www.sentinelone.com/labs/top-tier-target-what-it-takes-to-defend-a-cybersecurity-company-from-todays-adversaries/"
},
{
"source_name": "Analyzing CS Dec 2020",
"url": "https://www.randhome.io/blog/2020/12/20/analyzing-cobalt-strike-for-fun-and-profit/"
},
{
"source_name": "Recorded Future Beacon 2019",
"url": "https://www.recordedfuture.com/blog/identifying-cobalt-strike-servers"
},
{
"source_name": "Forescout Conti Leaks 2022",
"url": "https://www.forescout.com/resources/analysis-of-conti-leaks/"
}
]
}Explicit source assertions (114)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0937991f-a349-4d87-96b4-856ed2c13f97
ESET MirrorFace 2025ATTACK:enterprise:G0105 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b3809c3-78a5-4121-9b51-64a9dfa60b11
Securelist DarkVishnya Dec 2018ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b512662-8eb8-424d-99c5-4f76d1d70276
Symantec Waterbug Jun 2019ATTACK:enterprise:C0032 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0dbf8a74-0b7d-4bb3-b20d-ab31a40d9163
FireEye TRITON 2019ATTACK:enterprise:G0100 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--108b7d74-30a7-40ec-997e-b47c62a5f6e7
Kaspersky Cloud Atlas August 2019ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1134f983-3ad3-4c79-baaa-f604ac9dc642
Check Point Rocket Kitten · Check Point APT35 CharmPower January 2022 · DFIR Phosphorus November 2021 · FireEye APT35 2018 · Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:C0005 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13a41ddf-24f2-4c73-a047-7093f94a2573
ESET Operation Spalax Jan 2021ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13b6f054-5771-43ef-84df-b05ec9001f23
Forcepoint BITTER Pakistan Oct 2016ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--164bf82a-10bf-4a6d-b43c-70ff11f60229
Talos Kimsuky Nov 2021 · Netscout Stolen Pencil Dec 2018 · Mandiant APT43 March 2024ATTACK:enterprise:G0098 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17738bdd-24b9-44d0-a897-d1b861fd2636
Symantec Palmerworm Sep 2020ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17c0d0d3-b57d-434d-9404-1e67414a4da5
ESET_MuddyWater_Dec2025 · Anomali Static Kitten February 2021 · NaumaanProofpoint_GlobalClickFix_April2025 · group-ib_muddywater_infraATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1aa34972-7bed-4e2d-bf72-b7352677de60
NCC Group LAPSUS Apr 2022 · MSTIC DEV-0537 Mar 2022ATTACK:enterprise:C0030 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e7a35d2-4fbf-4e9c-8ad4-c21634540cbb
FireEye TEMP.Veles 2018ATTACK:enterprise:G0077 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e902f51-efe0-4848-b47a-7e1a1664b101
Symantec Leafminer July 2018ATTACK:enterprise:M1056 → mitigates → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20a02fc6-3cce-4ce6-bf76-2f82c2a88232
ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2370fba0-1d66-4aad-ac01-fb63857b7732
Mandiant No Easy Breach · F-Secure The Dukes · Mandiant APT29 Eye Spy Email Nov 22ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--23aad43d-0475-407c-ac15-c654ca40273e
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--242de5f8-7944-4fdd-af87-a5da0050e7c3
Securelist Sofacy Feb 2018 · Palo Alto Sofacy 06-2018 · FireEye APT28 Hospitality Aug 2017ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--260a6771-1b29-49b6-ad42-6c43e68b11dc
FireEye KEGTAP SINGLEMALT October 2020 · Mandiant FIN12 Oct 2021ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2cb496c7-81ed-423b-8564-8db1c8a2078f
Microsoft Storm-1811 2024 · rapid7-email-bombingATTACK:enterprise:C0062 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--312f2cb6-8528-4404-857a-c8c685d7e179
Anthropic AI Orchestrated Campaign NOV 2025ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--321a0d18-11a6-4504-add5-8ee515a43170
Symantec Tick Apr 2016ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--34ff9bfb-0b3a-4b83-af85-60700ed052f4
PWC Cloud Hopper Technical Annex April 2017ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35f5f7b9-8b86-4390-9f99-1d56aa1ae32a
FireEye APT41 Aug 2019ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--37d9aa25-a250-45a2-913f-14bd906fb130
CrowdStrike Scattered Spider JUL 2025 · Check Point Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023 · Mandiant UNC3944 May 2025ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a20f6f1-0e1b-4d8e-8461-eb41e4c6b5da
Bitdefender Sardonic Aug 2021ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e6b6ed9-4c28-4dd0-903a-360f57864de4
NCC Group TA505ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e91f49c-5342-49d8-8105-7ab17c5ef9f4
IBM ITG07 June 2019 · BitDefender Chafer May 2020ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3faaf140-71cd-4cc2-91c9-f0980ca72079
Microsoft GALLIUM December 2019ATTACK:enterprise:G0003 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--406e78ba-fc34-4be9-9dcc-323aad40d709
Cylance CleaverATTACK:enterprise:G0135 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--41e2d922-5014-479d-85ba-da70ad6aa44b
ESET BackdoorDiplomacy Jun 2021ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--508c012e-c578-472d-8225-51bc8c0dff87
Sygnia Emperor Dragonfly October 2022 · SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--526837ff-672d-4afa-899e-3634b19bab14
Trend Micro Earth Simnavaz October 2024 · Symantec Crambus OCT 2023ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54aae76b-14fe-47e9-86c8-bd39317429c3
Cisco Operation Layover September 2021ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5614b582-eeed-4a52-a2e0-2f756f03e26c
Security Intelligence More Eggs Aug 2019 · FireEye FIN6 Apr 2019ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--59116a0e-f23b-43ec-8b25-fbad5043344a
Microsoft Prestige ransomware October 2022 · mandiant_apt44_unearthing_sandworm · US District Court Indictment GRU Unit 74455 October 2020ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5eba2b01-da0d-4340-816b-16a4f3cc8ba6
Volexity Patchwork June 2018ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5f0b2cd5-125e-4473-8623-5f5a7dc09caf
Mandiant FIN7 Apr 2022ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5f3f6350-5e69-4b50-a0c7-c1f04ae85976
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ff56332-1e9e-4853-baae-5918e41882ac
Bitdefender LuminousMoth July 2021ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--612d9ccc-07ab-44fd-b970-869e9a730b02
Hunt Sea Turtle 2024ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61ede1a5-e9e1-402b-8a64-11e9a3136675
ESET MirrorFace DEC 2022 · JPCERT MirrorFace JUL 2024 · Trend Micro Earth Kasha NOV 2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--643bfb16-2424-4ea6-b571-bac78c913c9a
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:C0002 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--644bfb9b-0555-45e9-a967-c6bedcc05e88
McAfee Night DragonATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c89f28c-963b-44ef-8dda-5916aa17b7e9
Check Point Blind Eagle MAR 2025 · QiAnXin APT-C-36 Feb2019ATTACK:enterprise:G0090 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e20b61f-bf7e-40a3-b7b9-98d79e5a3ecd
Lab52 WIRTE Apr 2019 · Palo Alto Ashen Lepus DEC 2025ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ef45519-7ca1-44a4-8421-152af4e85d68
ElecticIQ Buyukkaya_ShinyHunters_Sept2025 · Unit42KelleyVaya_BlingLibra_Aug2024 · Google_SHOracle_Jun2026ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--714e1860-5ce1-4d5a-b611-89fbcdb7fbb2
Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024 · ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · SecurityScorecard Contagious Interview October 2024 · PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023 · PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72b81f9e-8760-4d46-9ed3-4b91b12f6299
Sygnia Elephant Beetle Jan 2022ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72faebbd-f228-478b-a9aa-21e006acfc9c
Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7363ed1a-6f75-4ded-9179-2fdba17f6cf1
PTSecurity Cobalt Dec 2016ATTACK:enterprise:C0021 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--747f1dcd-7af4-4a38-983b-e2d6108af677
FireEye APT29 Nov 2018 · Microsoft Unidentified Dec 2018ATTACK:enterprise:T1588.002 → subtechnique-of → ATTACK:enterprise:T1588
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--757be841-a218-4d0e-bbe3-a138eea7692e
ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--77f919ce-1a18-4ee5-9979-1c9b818ca973
NCC Group APT15 Alive and StrongATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b050e9f-ab8e-4860-aae9-4a37e18efbe2
Dell TG-3390 · Unit42 Emissary Panda May 2019ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b2e912e-4561-4edc-87fe-11f9e259a5a9
Kaspersky ThreatNeedle Feb 2021ATTACK:enterprise:G0053 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7c240038-5599-418a-83e4-6d9962eee0bd
Mandiant FIN5 GrrCON Oct 2016ATTACK:enterprise:C0045 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e2a54af-5e8f-4431-810d-7fcaa4c1eca0
Oligo ShadowRay Campaign MAR 2024ATTACK:enterprise:G0076 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7eecb510-7937-40d2-b491-7d9165b5afc1
Symantec Thrip June 2018ATTACK:enterprise:G1009 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8019fbd7-b72e-42aa-8685-60e8138db932
Checkpoint MosesStaff Nov 2021ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8127487a-15fd-4802-8537-ddb2f72e72fd
FoxIT Wocao December 2019ATTACK:enterprise:C0004 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83b4190b-31aa-4f90-a397-624b89fb2f6f
BlackBerry CostaRicto November 2020ATTACK:enterprise:G1005 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--84a7d204-857f-43dd-8876-215b7a946ed1
Microsoft POLONIUM June 2022ATTACK:enterprise:G0011 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86169d65-b154-402d-918c-4b4602d71cd0
Bizeul 2014ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86a7e0a4-4fbd-4355-9428-f0b79249d225
Kaspersky Lyceum October 2021 · SecureWorks August 2019 · Zscaler Lyceum DnsSystem June 2022ATTACK:enterprise:C0048 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--887df999-b039-4056-b0cc-d89cb09deeb5
Volexity UPSTYLE 2024ATTACK:enterprise:G0107 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b65bc11-9b56-4eca-9fa2-efb7ffcbb94b
Symantec Whitefly March 2019ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8ff5abd9-8bbe-4fab-8001-23b2973c0764
Cisco LotusBlossom 2025ATTACK:enterprise:G0051 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9292d1e2-562f-4cda-a5f4-4ed6406e8b78
FireEye FIN10 June 2017ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93cd8b4b-1d7a-4eeb-8ade-b5b9aaf936ec
FBI Salesforce Data Theft SEP 2025 · Google Salesforce JUN 2025ATTACK:enterprise:G1032 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ab8569f-3b5a-455b-880f-10d29cbae970
Huntress INC Ransomware May 2024 · Cybereason INC Ransomware November 2023 · SentinelOne INC Ransomware · SOCRadar INC Ransom January 2024 · Huntress INC Ransom Group August 2023ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b363538-86e1-446a-a4f8-b3045a7e8f68
Secureworks IRON LIBERTY July 2019ATTACK:enterprise:G0136 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9bab41c7-1581-4c51-9119-6a5e29445979
Checkpoint IndigoZebra July 2021 · Securelist APT Trends Q2 2017ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e2b7623-69e9-4c03-a4da-df281e99f663
CrowdStrike AQUATIC PANDA December 2021ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a499a9d0-7508-4b1c-83cd-748d21c34682
BradyUnit42_TheGentlemen_July2026 · Intel471_TheGentlemen_Aug2026 · TrendAI_TheGentlemen_Sept2025 · Sophos_TheGentlemen_Sept2026 · SoučekESET_Gentlemen_Jun2026ATTACK:enterprise:G1007 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6ff725c-1c60-44dd-8f78-22f1b009bbb5
SentinelOne Aoqin Dragon June 2022ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a7213656-7166-4b88-8d32-f388a2ef1671
ESET Lazarus KillDisk April 2018ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a8fef3c0-796a-4995-81fe-c47336c3ddbd
TrendMicro EarthLusca 2022ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aa82f131-3eeb-4d1a-9f2e-bb2efcc7470b
FireEye APT33 Guardrail · Symantec Elfin Mar 2019ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b1a5dcb8-85f6-4788-a9c5-6f3525615891
Check Point VOID MANTICORE Handala Hack March 2026