Skip to content

C0015

Campaign · ATTACK:enterprise:C0015

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:C0015",
  "title": "C0015",
  "type": "Campaign",
  "source_url": "https://attack.mitre.org/campaigns/C0015",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "campaign--78068e68-4124-4243-b6f4-76e4e5be8a06",
  "external_id": "C0015",
  "domain": "enterprise",
  "created": "2022-09-29T16:42:29.364Z",
  "modified": "2026-07-31T18:47:24.571Z",
  "version": "1.0",
  "aliases": [
    "C0015"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "DFIR Conti Bazar Nov 2021",
      "url": "https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/"
    }
  ]
}

Explicit source assertions (39)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05c33a7a-bfd0-4374-a617-f2c407461acb

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a764574-6288-4f66-b4af-b485424b32d2

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--135fb6c4-1f42-42ce-b323-22e57ae4fbc6

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2077bc66-a671-4cc3-87cf-9efff8e969dc

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:S0552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25f63329-0c2e-47cf-ad32-d89ef439f4f7

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--356744ba-4a64-4ada-9c95-6cdc4e539614

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d4490e3-d3fe-4c2e-8c41-69ebbf8d060e

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a98aeee-5b53-43ca-a75a-5839792756d7

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4dcb70d9-017b-44b8-a13c-fab275c5bc56

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1218.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--511ed53b-8445-4da7-8890-49d1b4e98077

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--538eb3a4-466e-42d0-9f12-bd9b6de0abe4

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--576f0fb4-4cd7-467b-9208-3977321705e4

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5968f7a6-a300-4a1b-9a4e-655e9300392b

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b0329a9-aebd-4216-94d8-a39021139b80

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1069.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6317e636-4766-4968-ac4b-66b1a7199250

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:S0575

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68b29908-fcbc-464a-b9ed-63ef522bfe81

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--69bfbe2b-2a2a-4013-9fba-7a551ec75836

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74afa3c9-bfa3-48a3-85bf-b28e5ecd00b7

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d2c1704-b190-4b47-854c-5c1e122fa5ce

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89bd9b10-f1cb-4569-977c-784cbfbb23e1

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:S1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--931ed644-db21-4c15-a26d-dcbd958aeec8

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a81df141-ff2a-4be9-a6ea-c5b19d29bc0e

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b6129b4d-09bd-46f6-b7c4-1500b0e61535

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1218.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bcbf0e6a-3566-4704-986f-caf0af38741d

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bfb6dc5a-786f-47e8-ab9c-848a643df423

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4275eb1-4651-4c47-bc14-82a4b7ceec2b

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1124

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c5e582d2-aea4-4828-8b9c-5bfe1ca72504

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1030

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca476de5-e17e-4011-9e5b-b438299c385c

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1219.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d35f97c3-2776-4f7a-9dfa-be39009ea5c0

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1039

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d3720380-6d0d-41a9-a2b5-e0fcc311f486

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:S0534

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e508222c-c080-46bd-940d-2ed392382546

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e7187197-205f-496f-b41c-34d57c52a997

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e79f7f56-3a5e-4957-8070-360f630f3c2e

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e8312c6b-a855-48c4-b5cc-8e369bcfd475

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1588.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e9ff50dd-6367-43b1-9f75-1dee4028df84

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1059.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eb2b318e-2968-485e-8459-1b40c74baf83

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2a58ddd-c9d8-4769-a93b-2e876e304105

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc3d0026-20b2-4d38-b276-64d7290c1994

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1218.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff9fad0d-7481-4804-a4e8-800265a5c17d

DFIR Conti Bazar Nov 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.