Delay Execution
Technique · ATTACK:enterprise:T1678
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1678",
"title": "Delay Execution",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1678",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--a1df809c-7d0e-459f-8fe5-25474bab770b",
"external_id": "T1678",
"domain": "enterprise",
"created": "2025-09-24T18:03:15.021Z",
"modified": "2026-09-11T19:52:38.458Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"stealth"
],
"source_references": [
{
"source_name": "Joe Sec Nymaim",
"url": "https://www.joesecurity.org/blog/3660886847485093803"
},
{
"source_name": "Joe Sec Trickbot",
"url": "https://www.joesecurity.org/blog/498839998833561473"
},
{
"source_name": "Revil Independence Day",
"url": "https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/"
},
{
"source_name": "Netskope Nitol",
"url": "https://www.netskope.com/blog/nitol-botnet-makes-resurgence-evasive-sandbox-analysis-technique"
}
]
}Explicit source assertions (25)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01354b67-5cc4-4701-9dbf-e750076c5d5d
Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--016d4e5d-6b8c-45cc-a50b-a79f0a68ddaf
Gen Digital Kimsuky HTTPTroy October 2025 · Aryaka Kimsuky July 2025ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--105235ae-d06d-47ed-8eea-8237bd1d7397
ESET_MuddyWater_Dec2025ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--15fed5d5-3e2b-43c6-808d-5198af11f1e6
ZscalerATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21a662a2-7eb9-4cc3-b2d1-984239f8c9a1
CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026 · TrendAI_TheGentlemen_Sept2025ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21f43802-8abd-459f-83e3-d9fd3fdd5bfa
CISA SPAWNCHIMERA RESURGE February 2026ATTACK:enterprise:S9008 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24ccb55f-1e6a-48be-a222-aa0faf1272c3
Palo Alto Unit 42 Shai-Hulud November 2025ATTACK:enterprise:S9063 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--253ab349-abb6-48de-8679-c7a9a702c58a
Mandiant_UNC1549_Nov2025ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--28c7f7cf-1490-4f78-9d5b-a26fd86198a1
MIcrosoft Mastra npm Compromise JUN 2026ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3426458d-9dcc-48b3-8bfc-24cf82377656
Eset PlugX Korplug Mustang Panda March 2022 · Sophos PlugX September 2022ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e6dde99-59d7-4ebe-81cc-db84596ec7a2
Logpoint_StealerMalwareFamilies_2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f715d2b-8353-408f-9e2b-d68bbd8b50f0
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--416a4073-3236-461c-ab0f-6c1e50d0a9f9
Koi Glassworm New Tricks December 2025ATTACK:enterprise:S9014 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b6f9849-261f-4b4a-9455-d526da22fb8e
Google UNC5221 Ivanti January 2025ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--681e2011-de1d-45ab-8168-329a3095338f
CloudSEK_RustyWater_Jan2026ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--69e9e6bb-df32-4261-a8fc-4b81fca67990
Unit42 3cx supply chain 2023ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95c85b70-64f6-410f-82fd-c9dc1c154a4f
SophosGnGal_SystemBC_Dec2020ATTACK:enterprise:S1230 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a23252dd-d807-4247-b9c7-539e6f30c2ec
2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024ATTACK:enterprise:S9015 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ac12a059-4777-4f73-933d-832605de696e
Picus Security BRICKSTORM UNC5221 October 2025 · NVISO BRICKSTORM April 2025 · Google BRICKSTORM September 2025ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ba59907a-1a0c-4150-93a6-53581bffd08d
Trend Micro Agenda Ransomware OCT 2025ATTACK:enterprise:S9033 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cbb83538-3a5b-4dcc-a2df-b960dde3d36e
ESET_MuddyWater_Dec2025ATTACK:enterprise:S9038 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dd737a22-2390-4ffd-9ab7-4c9574fedfd7
CERT Polska · ESET DynoWiper Update JAN 2026ATTACK:enterprise:S0275 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ed3cec58-c1b7-4222-9b0d-609793f86d1e
Trend Micro Earth Kasha Anel NOV 2024 · Trend Micro Earth Kasha Updates APR 2025ATTACK:enterprise:S9019 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5039faf-3fa9-4d37-8dae-db7a081ecf56
Zscaler PureCrypter JUN 2022ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fdf235f6-3ecc-4b78-bc6b-90dc0e922efd
Palo Alto Ashen Lepus DEC 2025