Skip to content

TeamTNT

IntrusionSet · ATTACK:enterprise:G0139

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:G0139",
  "title": "TeamTNT",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0139",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--35d1b3be-49d4-42f1-aaa6-ef159c880bca",
  "external_id": "G0139",
  "domain": "enterprise",
  "created": "2021-10-01T01:57:31.229Z",
  "modified": "2026-07-31T18:47:48.259Z",
  "version": "1.4",
  "aliases": [
    "TeamTNT"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "ATT TeamTNT Chimaera September 2020",
      "url": "https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera"
    },
    {
      "source_name": "Cado Security TeamTNT Worm August 2020",
      "url": "https://www.cadosecurity.com/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials/"
    },
    {
      "source_name": "Unit 42 Hildegard Malware",
      "url": "https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"
    },
    {
      "source_name": "Trend Micro TeamTNT",
      "url": "https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"
    },
    {
      "source_name": "Intezer TeamTNT September 2020",
      "url": "https://www.intezer.com/blog/cloud-security/attackers-abusing-legitimate-cloud-monitoring-tools-to-conduct-cyber-attacks/"
    },
    {
      "source_name": "Intezer TeamTNT Explosion September 2021",
      "url": "https://www.intezer.com/wp-content/uploads/2021/09/TeamTNT-Cryptomining-Explosion.pdf"
    },
    {
      "source_name": "Aqua TeamTNT August 2020",
      "url": "https://blog.aquasec.com/container-security-tnt-container-attack"
    },
    {
      "source_name": "Palo Alto Black-T October 2020",
      "url": "https://unit42.paloaltonetworks.com/black-t-cryptojacking-variant/"
    },
    {
      "source_name": "Lacework TeamTNT May 2021",
      "url": "https://www.lacework.com/blog/taking-teamtnt-docker-images-offline"
    }
  ]
}

Explicit source assertions (60)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01183e54-1494-4fad-ab62-60834746cc32

ATT TeamTNT Chimaera September 2020 · Cisco Talos Intelligence Group

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--015f32b7-d24e-4562-851a-c7b829e2b128

Aqua TeamTNT August 2020

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01bebfd2-6c8c-4671-8754-34ca03c44299

Unit 42 Hildegard Malware · Cisco Talos Intelligence Group · Intezer TeamTNT September 2020

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1219

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03527dc8-25a6-479d-b00f-90b543944da1

Unit 42 Hildegard Malware · Cisco Talos Intelligence Group

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1569.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0559aa0e-31c2-478b-afce-00d0939066c3

Cisco Talos Intelligence Group

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--069f77c1-aafd-4883-aecd-707802442427

Cisco Talos Intelligence Group

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1222.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08c69567-a511-4a07-ab5d-a5bf77594129

Cisco Talos Intelligence Group · Trend Micro TeamTNT

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b46eb26-ebc0-4fa7-8925-9b775571f793

ATT TeamTNT Chimaera September 2020 · Cisco Talos Intelligence Group

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1609

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12ea5ead-f19a-488e-8b47-ceb9d45593fd

Unit 42 Hildegard Malware

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14ba8b29-133b-456d-b85d-139de4510bb1

Cisco Talos Intelligence Group · Trend Micro TeamTNT

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19bede58-549b-4e7d-b206-6045370b9995

ATT TeamTNT Chimaera September 2020

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1543.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f75578e-22d5-4f91-9de5-3309ffe107d5

Cisco Talos Intelligence Group · Trend Micro TeamTNT

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25e9205c-3f27-4f93-81ea-b4bc1e3325ac

Intezer TeamTNT September 2020

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26d1ecff-471e-420d-a1f0-d7b6cf9a07e6

Cisco Talos Intelligence Group

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a562acd-e85c-42ce-89fc-b10174863980

ATT TeamTNT Chimaera September 2020 · Trend Micro TeamTNT

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--331da7a8-d1ad-4feb-892a-c440aa5eb810

ATT TeamTNT Chimaera September 2020

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35ca3779-c632-4a7e-a931-7472128fb10d

Lacework TeamTNT May 2021

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36897d4a-1443-4061-b065-ae6d5d8c18b2

ATT TeamTNT Chimaera September 2020

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1610

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e62e520-0104-4be7-b4e2-d68fa88d7067

Cisco Talos Intelligence Group · Trend Micro TeamTNT · Intezer TeamTNT September 2020

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1613

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40383884-c607-48ac-9522-b5b1c8e256a9

Cisco Talos Intelligence Group · Trend Micro TeamTNT

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1048

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e73a249-94d5-4a52-9da4-a89da10d1c30

Cisco Talos Intelligence Group

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f85e333-375b-4a5b-8a15-a3bd061678a4

Cisco Talos Intelligence Group · Trend Micro TeamTNT

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4fcdf0b6-23c7-406c-95ba-b335b05642e5

ATT TeamTNT Chimaera September 2020

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1552.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51551fb5-48df-4143-9163-9b7ffe35bf8f

Cisco Talos Intelligence Group · Trend Micro TeamTNT

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1070.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--52068869-8ef9-4c84-913c-0c171ba9c30f

Cisco Talos Intelligence Group · Trend Micro TeamTNT

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--52ae918a-8afe-4e67-801f-d4fabbecef77

Cisco Talos Intelligence Group

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1595.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--52c980ba-459b-4d3e-a0a8-f0ba3d2b6e3a

Trend Micro TeamTNT

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1059.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--53154caa-b3a9-406e-81b7-23690452feda

Cisco Talos Blog

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60db2ece-4f5e-4c47-a7eb-fd8bcf7ddc49

Trend Micro TeamTNT

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1204.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6674eb2b-8295-4af4-b4d2-0659c15d3c71

Lacework TeamTNT May 2021

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1014

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b8a8055-5b1c-4e06-a6ef-4a42e23e2e11

Cisco Talos Intelligence Group · Trend Micro TeamTNT

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6bbd0299-4e8b-4d31-83c4-c690e43294c0

Cado Security TeamTNT Worm August 2020 · Trend Micro TeamTNT

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:S0683

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d887394-6007-451e-beb9-0ce76b58ebc3

TeamTNT Cloud Enumeration

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1611

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f5b07b1-6848-48ce-9a33-f5418e2195be

Intezer TeamTNT September 2020 · Aqua TeamTNT August 2020

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1595.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b212643-e625-436c-943f-911be8e87c3a

Trend Micro TeamTNT

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8bb0a7b0-a032-4278-abae-5730f574ff00

Cisco Talos Intelligence Group · Intezer TeamTNT September 2020

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e1a4560-f9da-4729-a364-dade6bb2cdc2

ATT TeamTNT Chimaera September 2020 · Cisco Talos Intelligence Group

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1496.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f4e363a-ce2b-4a36-92fb-791d8ffc30d5

Cado Security TeamTNT Worm August 2020 · Cisco Talos Intelligence Group · Lacework TeamTNT May 2021

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90cb412d-399d-4009-8aa0-63f411eb34ff

Cisco Talos Intelligence Group

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1021.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9420a4b5-d246-4b9e-81d0-3f0551a73a15

Cisco Talos Intelligence Group · Intezer TeamTNT September 2020

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--970e9eb2-51d7-4986-9480-d8a3b59c3006

Cisco Talos Intelligence Group

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9a74aca4-4a5e-4a12-bd98-6a4d2df1b1a1

Cisco Talos Intelligence Group

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:S0179

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c68c07e-bb35-416b-83ec-c8c8530eccc9

Palo Alto Black-T October 2020

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:S0349

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a38bce09-385d-44b0-91a4-307ee5d328c3

ATT TeamTNT Chimaera September 2020

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a641447f-995a-4f06-93d2-637e265c7638

ATT TeamTNT Chimaera September 2020 · Cisco Talos Intelligence Group

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a68a4d37-e2dd-4981-893d-20c43d056539

Trend Micro TeamTNT · Aqua TeamTNT August 2020

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7018df5-2a56-4731-ba57-5fe4ac73bac6

Trend Micro TeamTNT

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:S0601

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a822d946-b839-469a-90bf-fbe699faf160

Unit 42 Hildegard Malware

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b84414c0-18e9-4483-83db-555bd2880740

Cado Security TeamTNT Worm August 2020 · Unit 42 Hildegard Malware · Cisco Talos Intelligence Group · Palo Alto Black-T October 2020

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be8f7d93-1de8-4376-bec9-4db0a15f7542

Cisco Talos Intelligence Group

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca720b2b-b8f2-471e-a5a5-b786bb084d83

ATT TeamTNT Chimaera September 2020 · Cisco Talos Intelligence Group

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d0e68e5d-66a1-4f7d-ace6-8ad5d028fa20

Trend Micro TeamTNT

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1098.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d6e1026a-a33e-46a3-832e-ff9b36d52c07

Cisco Talos Intelligence Group · Aqua TeamTNT August 2020

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1583.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d9e61755-27f6-4a94-a6f7-22cb150546ca

Palo Alto Black-T October 2020

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1059.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--da4059ab-c858-4df1-94e0-25db2d6ea136

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e75ded50-50cc-46fe-b83b-2de8e5f7d7a6

Cado Security TeamTNT Worm August 2020 · Cisco Talos Intelligence Group · Trend Micro TeamTNT · Intezer TeamTNT September 2020

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e830611d-a7c5-446c-a5a7-ec1062bb3f53

Cado Security TeamTNT Worm August 2020 · Cisco Talos Intelligence Group · Trend Micro TeamTNT

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1685.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e9e1ba6c-10ed-4b1f-8c82-4102ccbbe394

Aqua TeamTNT August 2020

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1587.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2f8d56c-4a10-4be4-884d-7982931bd303

Unit 42 Hildegard Malware

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff500c79-fa27-4fe3-a3c2-8c5d20031824

Cisco Talos Intelligence Group · Aqua TeamTNT August 2020

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.