Skip to content

C0018

Campaign · ATTACK:enterprise:C0018

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:C0018",
  "title": "C0018",
  "type": "Campaign",
  "source_url": "https://attack.mitre.org/campaigns/C0018",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "campaign--519ee082-8ab6-439b-988f-a8a3f02c8d30",
  "external_id": "C0018",
  "domain": "enterprise",
  "created": "2023-01-17T21:42:34.998Z",
  "modified": "2026-07-31T18:47:22.530Z",
  "version": "1.0",
  "aliases": [
    "C0018"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Costa AvosLocker May 2022",
      "url": "https://www.linkedin.com/pulse/raas-avoslocker-incident-response-analysis-fl%C3%A1vio-costa?trk=articles_directory"
    },
    {
      "source_name": "Cisco Talos Avos Jun 2022",
      "url": "https://blog.talosintelligence.com/avoslocker-new-arsenal/"
    }
  ]
}

Explicit source assertions (25)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:S0633

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--044a6e2a-df26-49aa-a485-304740fadd49

Cisco Talos Avos Jun 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:S0108

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10e7df4a-c95d-4b85-b044-84649fe3a6d1

Costa AvosLocker May 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--194b2a3c-ce1f-4326-a26f-fd998c94b947

Costa AvosLocker May 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1190

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--237d7c2e-503a-420c-bf94-047f5c42a646

Cisco Talos Avos Jun 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3564dc8e-09d0-4855-8a90-d4c28a9488e5

Cisco Talos Avos Jun 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42af62e7-3e38-46e7-ac70-c557f33d377d

Costa AvosLocker May 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4bc4f37e-5cdd-4def-a997-1cbb37975a8f

Costa AvosLocker May 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1219.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e341596-3bc3-4d9e-a9a3-2aceccfebe35

Costa AvosLocker May 2022 · Cisco Talos Avos Jun 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--578433f2-d3d3-4434-8b6c-986c14204b92

Costa AvosLocker May 2022 · Cisco Talos Avos Jun 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5cab522f-3469-4f57-97c5-f333c63691c0

Costa AvosLocker May 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:S1053

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ccac8cb-9e5f-4031-bf27-4ced4a1672d2

Costa AvosLocker May 2022 · Cisco Talos Avos Jun 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6cfee0a9-4f55-42e9-8670-86a0fa3e6280

Costa AvosLocker May 2022 · Cisco Talos Avos Jun 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73d4dcf0-5c97-4b60-af21-b68182237e15

Cisco Talos Avos Jun 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76c260cd-7cc8-4333-a253-e19b953c8291

Costa AvosLocker May 2022 · Cisco Talos Avos Jun 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a117c20-6bb1-40b7-90c7-f8a01a987921

Costa AvosLocker May 2022 · Cisco Talos Avos Jun 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--905e27bb-8d9b-4185-b5e6-4febc5d17333

Costa AvosLocker May 2022 · Cisco Talos Avos Jun 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aea03b1a-38b1-423c-8dc0-442bb4d6c316

Cisco Talos Avos Jun 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bcf2759f-2e3b-4caf-bfcb-2e7d8b533b2d

Costa AvosLocker May 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1588.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c0c1a394-23db-44cf-a922-89e10ba13ec6

Costa AvosLocker May 2022 · Cisco Talos Avos Jun 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9a5f585-541d-4785-9cb4-de9710311176

Costa AvosLocker May 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1072

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2ac0292-0de5-4805-9ff8-f56881331295

Cisco Talos Avos Jun 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e5421609-48cf-4e8e-8843-de6043e920f4

Costa AvosLocker May 2022 · Cisco Talos Avos Jun 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed149b2f-6743-4d06-b869-158c0f96746e

Cisco Talos Avos Jun 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f95453f6-4b23-4ec4-bd76-7f44bca126b4

Costa AvosLocker May 2022 · Cisco Talos Avos Jun 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1218.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fe26276a-d93c-400b-8907-1fcc9415ee38

Costa AvosLocker May 2022

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.