Rancor
IntrusionSet · ATTACK:enterprise:G0075
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0075",
"title": "Rancor",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0075",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--f40eb8ce-2a74-4e56-89a1-227021410142",
"external_id": "G0075",
"domain": "enterprise",
"created": "2018-10-17T00:14:20.652Z",
"modified": "2026-07-31T18:48:26.231Z",
"version": "1.3",
"aliases": [
"Rancor"
],
"tactics": [
],
"source_references": [
{
"source_name": "Rancor"
},
{
"source_name": "Rancor Unit42 June 2018",
"url": "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
}
]
}Explicit source assertions (13)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0075 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0a975ec6-5754-4a42-aa0f-f468d67a2c91
Rancor Unit42 June 2018ATTACK:enterprise:G0075 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2466dc21-d32d-4a62-a815-8f1d5d09d88d
Rancor Unit42 June 2018ATTACK:enterprise:G0075 → uses → ATTACK:enterprise:S0075
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27a1b804-f54c-4e9f-ad89-fd565a66c180
Rancor Unit42 June 2018ATTACK:enterprise:G0075 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--503c4b74-7ca5-45e3-bb11-85a99ca1810f
Rancor Unit42 June 2018ATTACK:enterprise:G0075 → uses → ATTACK:enterprise:S0255
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5986609f-f047-4f71-8918-e0d7d33416f0
Rancor Unit42 June 2018ATTACK:enterprise:G0075 → uses → ATTACK:enterprise:S0254
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6287195f-bb8e-45e2-8701-76ec2c5e7a60
Rancor Unit42 June 2018ATTACK:enterprise:G0075 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7121357f-cc91-4e6b-a2a6-d8bb51bf4a01
Rancor Unit42 June 2018ATTACK:enterprise:G0075 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--74a15877-d310-4be1-813d-4ee9cbd603b7
Rancor Unit42 June 2018ATTACK:enterprise:G0075 → uses → ATTACK:enterprise:S0160
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be7a1288-68fd-4125-969b-bd123865c6b1
Rancor Unit42 June 2018ATTACK:enterprise:G0075 → uses → ATTACK:enterprise:T1218.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c551c942-a191-4fe9-81a3-cc795d7dea38
Rancor Unit42 June 2018ATTACK:enterprise:G0075 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9bf4d9d-b83b-49f4-b35a-5fb24f522bc7
Rancor WMIATTACK:enterprise:G0075 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9d48406-947c-4d50-9539-b30c4566403b
Rancor Unit42 June 2018ATTACK:enterprise:G0075 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ebed8156-bce1-4710-bd99-7cdcfa887d28
Rancor Unit42 June 2018