Skip to content

C0027

Campaign · ATTACK:enterprise:C0027

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:C0027",
  "title": "C0027",
  "type": "Campaign",
  "source_url": "https://attack.mitre.org/campaigns/C0027",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "campaign--df74f7ad-b10d-431c-9f1d-a2bc18dadefa",
  "external_id": "C0027",
  "domain": "enterprise",
  "created": "2023-06-30T19:28:30.616Z",
  "modified": "2026-07-31T18:47:32.962Z",
  "version": "1.0",
  "aliases": [
    "C0027"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Crowdstrike TELCO BPO Campaign December 2022",
      "url": "https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/"
    }
  ]
}

Explicit source assertions (30)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1684.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0029bcd7-f5f2-410e-84d4-39302d4d1b1f

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1572

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--002e561a-5500-4293-a876-01e8205a67c8

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1190

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--04e866d0-5d9d-435d-b37c-311bb0bbdb1e

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1087.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--050f4038-bed5-4353-970c-d32be292a037

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08f2da07-4e03-46bd-a3d9-c79ef7dd9a45

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1069.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11f6bf91-2330-4490-831d-3c84982a2280

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1598.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1769fb21-c686-4af1-ba8f-8bfa48ecf585

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1003.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a080d89-1319-4b5d-8e62-d185172559da

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f785f1f-04f8-42f0-8082-a03fed3c3a94

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49cc1b92-9460-4cdf-9b68-ebade6122990

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1098.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e23f18f-9418-462d-9f59-a527cb15ba9d

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1578.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--593d77c0-bcd3-4331-a75b-66cfa103e31d

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5dd2c2dd-dcc3-44f5-9c9a-3055cda6c5fa

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1021.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--603bfd74-0585-40f7-ba65-1a72d87f0775

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1213.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b2f6151-c019-4910-91a7-9dd6744c4ffb

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1078.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86c9276e-1144-42b9-971f-8ba4eefec3be

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1087.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a03f60e-bb09-4f4d-815e-88d86192042f

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1598.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--91df24f7-6089-4f42-a63e-6ecaa5d4af8e

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1621

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--952ee3df-24da-4537-9e36-583e8f178f50

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1098.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7392d5f-d653-4b74-bf08-d95beb5fabcc

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1219.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa308c15-3c8d-4df7-a6b2-0a4f61ef8d03

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab4d5c44-b402-4b17-8c23-719e74076dce

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1098.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b546ebe4-90cb-4e2f-92fe-2d1c019f44c4

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bbb92214-8772-4e46-916b-2d9c0cdec83e

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db315985-f1c1-4d7f-a154-c65351602680

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1588.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dbcd9d76-b527-472f-8d3f-944cee432479

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1589.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e0d494d7-f081-4195-92c6-95aae2f2cadc

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → attributed-to → ATTACK:enterprise:G1015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e662ff77-e38c-4a8b-ac49-cfb98ad01b47

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f38960c1-2f2a-42d4-96f0-661d91062af3

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1566.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f417c73d-20a3-447c-8839-5897e01d2a90

Crowdstrike TELCO BPO Campaign December 2022

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.