SideCopy
IntrusionSet · ATTACK:enterprise:G1008
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1008",
"title": "SideCopy",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1008",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--03be849d-b5a2-4766-9dda-48976bae5710",
"external_id": "G1008",
"domain": "enterprise",
"created": "2022-08-07T13:52:07.791Z",
"modified": "2026-07-31T18:47:36.181Z",
"version": "1.0",
"aliases": [
"SideCopy"
],
"tactics": [
],
"source_references": [
{
"source_name": "MalwareBytes SideCopy Dec 2021",
"url": "https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"
}
]
}Explicit source assertions (18)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--139cce0b-726b-406a-ad38-1fdfc779cf57
MalwareBytes SideCopy Dec 2021ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--15c71de6-bc1d-451f-8c61-a982516bb18b
MalwareBytes SideCopy Dec 2021ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1584.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--171a96b6-1680-408b-b90d-356b393a3dea
MalwareBytes SideCopy Dec 2021ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d2111ce-5034-472a-89a7-1818d11280fb
MalwareBytes SideCopy Dec 2021ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4e3b39db-d29f-450b-b3ec-074c91af282a
MalwareBytes SideCopy Dec 2021ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1608.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c5d1d00-1a0a-4315-9da4-2beb5f00793b
MalwareBytes SideCopy Dec 2021ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--612cdeba-0ca3-426f-93d3-2dd3ccca7a54
MalwareBytes SideCopy Dec 2021ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:S1029
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8528d601-e1a2-4c59-965e-fb0b65dece43
ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86bfc0ee-73e0-4f1b-a4f9-f8e44eae2dc3
MalwareBytes SideCopy Dec 2021ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93d35fd7-3a55-4de1-a568-0fa50f81d594
MalwareBytes SideCopy Dec 2021ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--943577e6-928e-43dd-a175-60e6046c4499
MalwareBytes SideCopy Dec 2021ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b277ffdd-55fc-42fc-96c0-3bf395f04831
MalwareBytes SideCopy Dec 2021ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b784a456-decb-4d3a-a789-9dd67afb6e66
MalwareBytes SideCopy Dec 2021ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c1c32fe3-7aba-4d58-94df-89ce60a76810
MalwareBytes SideCopy Dec 2021ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1598.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cfdd9ee1-119f-4071-8498-02bb568fc778
MalwareBytes SideCopy Dec 2021ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:S1028
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc80f7b4-ea52-47ed-a6a3-7fd3fc96d319
ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9b4a99d-6ddb-40bb-918a-363ddbdac448
MalwareBytes SideCopy Dec 2021ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ebfa4596-86bb-4a7f-a6f5-11a5642b31fd
MalwareBytes SideCopy Dec 2021