aol.pm

Reflective Code Loading

Technique · ATTACK:enterprise:T1620

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1620",
  "title": "Reflective Code Loading",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1620",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--4933e63b-9b77-476e-ab29-761bc5b7d15a",
  "external_id": "T1620",
  "domain": "enterprise",
  "created": "2021-10-05T01:15:06.293Z",
  "modified": "2026-05-12T15:12:00.630Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "00sec Droppers",
      "url": "https://0x00sec.org/t/super-stealthy-droppers/3715"
    },
    {
      "source_name": "S1 Custom Shellcode Tool",
      "url": "https://www.sentinelone.com/blog/building-a-custom-tool-for-shellcode-analysis/"
    },
    {
      "source_name": "Mandiant BYOL",
      "url": "https://www.mandiant.com/resources/bring-your-own-land-novel-red-teaming-technique"
    },
    {
      "source_name": "S1 Old Rat New Tricks",
      "url": "https://www.sentinelone.com/blog/teaching-an-old-rat-new-tricks/"
    },
    {
      "source_name": "Microsoft AssemblyLoad",
      "url": "https://learn.microsoft.com/dotnet/api/system.reflection.assembly.load"
    },
    {
      "source_name": "Intezer ACBackdoor",
      "url": "https://intezer.com/acbackdoor-analysis-of-a-new-multiplatform-backdoor/"
    },
    {
      "source_name": "Stuart ELF Memory",
      "url": "https://magisterquis.github.io/2018/03/31/in-memory-only-elf-execution.html"
    },
    {
      "source_name": "Introducing Donut",
      "url": "https://thewover.github.io/Introducing-Donut/"
    }
  ]
}

Explicit source assertions (33)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--04a55a4d-7888-4e52-8d6f-6befbc82f6f2

Gigamon BADHATCH Jul 2019

ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a2872da-8858-45d4-bd78-8ac41fc376eb

RecordedFuture WhisperGate Jan 2022

ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1040d9b9-96a4-4bea-9e8a-543befd50ebd

Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13763af4-357d-4bb4-b0eb-64f8808792e6

Github_SILENTTRINITY

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1da7a099-122d-4c26-b27f-f8acabdd7b44

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--203e48b0-5175-4cc9-9e49-8cae08f26f52

Talos Lokibot Jan 2021

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28e6612e-5f92-42b0-b722-a49a43a75908

ESET Gelsemium June 2021

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c01b9a0-b53f-45f1-a277-f1c0e5d088ed

Gemini_FIN7_Jan2022

ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a5302f7-b953-4d4b-b080-6f3d5d4da00e

Eset PlugX Korplug Mustang Panda March 2022 · EclecticIQ Mustang Panda PlugX · Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025 · Sophos PlugX September 2022 · Sophos Mustang Panda PLUGX

ATTACK:enterprise:S1059 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--507d0a52-450a-4bb9-8667-e787f8c589f2

SentinelLabs Metador Sept 2022

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--510616c2-f124-49b2-83a2-cac81d2d4155

Lazarus APT January 2022 · Qualys LolZarus

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56fcac64-0f74-4670-8984-2a3fbc1b6685

Securonix Kimsuky February 2025 · Mandiant APT43 March 2024

ATTACK:enterprise:S0625 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--586b8b1d-109f-4f35-bcf8-589993d18681

McAfee Cuba April 2021

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--605484fa-0a3e-48df-b5bb-9ff0a35593fc

SymantecCarbonBlack_ShuckwormUSB_Apr2025

ATTACK:enterprise:S9033 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7550da21-7a51-4c8c-91d3-aacb7c2db10e

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79c5870a-c93f-47c5-a382-e26a23666209

Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8befb9c9-cff9-472c-8fbb-561466a13944

TrumanKroll_SYSTEMBCServer_Jan2024

ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b7f7aab-6ee4-4205-bd25-39cd63216777

MDSec Brute Ratel August 2022

ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d67040f-625a-49bd-aacb-48024fc7c4b2

CrowdStrike IceApple May 2022

ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a01a5841-8c3a-4cd4-b747-f4333e083924

Elastic Pikabot 2024

ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a20f619e-7d6d-48c1-a492-151152470f18

ESET_MuddyWater_Dec2025

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2c7da9a-b2fc-41be-bbd5-911bcf3d0eaf

Mandiant 3cx UNC4736 2023 · Daveshell sRDI GitHub shell code loader

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7cba2fb-a90f-4dd1-ae33-3747d5a9c873

Donut Github

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b92542f4-97bc-4e75-9f92-328c25a007ef

Binary Defense Emotes Wi-Fi Spreader

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba710d0b-3d43-4bd9-8bdb-00c5cf6d569c

Microsoft Sapphire Sleet APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bda15177-2409-49d9-9233-4d52fec364c0

Fortinet LummaStealer 2024 · Netskope LummaStealer 2025

ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cce28b98-698e-4c0b-b625-78b125cf8837

SekoiaBourhis_DiceLoader_Feb2024

ATTACK:enterprise:S1085 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd85bffe-6371-4fd9-b327-469647ebb420

Bitdefender Sardonic Aug 2021 · Symantec FIN8 Jul 2023

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d11da8db-b528-4d1f-a7f4-ba8bafb80a3d

wardle evilquest partii

ATTACK:enterprise:S0661 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dbeb509e-58a9-41f9-bd08-95b3b1075edf

MSTIC FoggyWeb September 2021

ATTACK:enterprise:S9011 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dde0aa47-9f16-45fd-af10-92d76a0d502b

Google UNC5221 Ivanti April 2025 · Picus Security UNC5221 Ivanti May 2025

ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e54aad60-0f67-4eef-b269-5c783dc98748

Trend Micro SharePoint Attacks JUL 2025 · Eye Research ToolShell JUL 2025 · SentinelOne ToolShell JUL 2025 · Microsoft SharePoint Exploit JUL 2025 · Palo Alto SharePoint Vulnerabilities JUL 2025

ATTACK:enterprise:S1143 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd7d0ecd-7d16-424f-8d5c-9af1604290fa

ESET Turla Lunar toolset May 2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.