TA551
IntrusionSet · ATTACK:enterprise:G0127
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0127",
"title": "TA551",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0127",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--94873029-f950-4268-9cfd-5032e15cb182",
"external_id": "G0127",
"domain": "enterprise",
"created": "2021-03-19T21:04:00.692Z",
"modified": "2026-07-31T18:48:09.361Z",
"version": "1.2",
"aliases": [
"TA551",
"GOLD CABIN",
"Shathak"
],
"tactics": [
],
"source_references": [
{
"source_name": "GOLD CABIN"
},
{
"source_name": "Shathak"
},
{
"source_name": "Unit 42 Valak July 2020",
"url": "https://unit42.paloaltonetworks.com/valak-evolution/"
},
{
"source_name": "Unit 42 TA551 Jan 2021",
"url": "https://unit42.paloaltonetworks.com/ta551-shathak-icedid/"
},
{
"source_name": "Secureworks GOLD CABIN",
"url": "https://www.secureworks.com/research/threat-profiles/gold-cabin"
}
]
}Explicit source assertions (19)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:T1218.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0af12d0f-ef9e-40e7-8b70-d811f412125d
Unit 42 Valak July 2020ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:S0650
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ce8fbfc-10cf-4fd4-8314-5a3f184a986d
ATT QakBot April 2021ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--297ca26b-2074-46ea-b81d-a0a5c6fe5ac0
Unit 42 TA551 Jan 2021ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--354551e4-c6aa-495a-aba5-b7437c485d34
Unit 42 TA551 Jan 2021ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:S0483
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--356cef7e-2994-4e52-8985-e046e8cc5513
Cybereason Valak May 2020 · Unit 42 Valak July 2020 · Unit 42 TA551 Jan 2021 · Secureworks GOLD CABINATTACK:enterprise:G0127 → uses → ATTACK:enterprise:S0476
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39a3fca6-cdf6-4053-b4fe-eb5d46fc729f
Cybereason Valak May 2020 · Unit 42 Valak July 2020 · Unit 42 TA551 Jan 2021 · Secureworks GOLD CABINATTACK:enterprise:G0127 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--58565141-69f5-45c4-a7a9-f3eec03f403b
Unit 42 TA551 Jan 2021ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:T1027.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--59ef906c-f395-427a-9cd5-30887a983516
Unit 42 TA551 Jan 2021ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d881746-44f9-4865-86de-97253fc197fb
Unit 42 Valak July 2020 · Unit 42 TA551 Jan 2021 · Secureworks GOLD CABINATTACK:enterprise:G0127 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a4eafba-a7fb-46d1-8c50-033e1e3d7409
Unit 42 Valak July 2020ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:S0633
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--919ed248-2736-4024-9f0b-001c23a85d82
Cybereason Sliver UndatedATTACK:enterprise:G0127 → uses → ATTACK:enterprise:T1568.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93656c66-acfc-43b4-af66-bf328256b7b8
Unit 42 TA551 Jan 2021 · Secureworks GOLD CABINATTACK:enterprise:G0127 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b222cfd-8b08-4843-8b08-32e2476aba36
Unit 42 Valak July 2020ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c1349223-f356-4e0d-8148-bda128354347
Unit 42 Valak July 2020ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4953a3b-d674-4582-b644-1339ec097aad
Unit 42 TA551 Jan 2021ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--df33a65c-1529-4f8d-a27b-0d00f540e6e6
Unit 42 TA551 Jan 2021ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e52a9525-9209-4cf5-8f8e-43057ef6c2b3
Unit 42 TA551 Jan 2021ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:S0386
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eca046f5-9175-4010-8297-07281f588934
Cybereason Valak May 2020 · Unit 42 Valak July 2020 · Unit 42 TA551 Jan 2021 · Secureworks GOLD CABINATTACK:enterprise:G0127 → uses → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f2e075b3-1125-4259-bf0b-1ff90c738354
Unit 42 TA551 Jan 2021