China Chopper
Software · ATTACK:enterprise:S0020
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0020",
"title": "China Chopper",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0020",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--5a3a31fe-5a8f-48e1-bff0-a753e5b1be70",
"external_id": "S0020",
"domain": "enterprise",
"created": "2017-05-31T21:32:18.315Z",
"modified": "2024-01-03T21:37:14.516Z",
"version": "2.5",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "China Chopper"
},
{
"source_name": "CISA AA21-200A APT40 July 2021",
"url": "https://us-cert.cisa.gov/ncas/alerts/aa21-200a"
},
{
"source_name": "Dell TG-3390",
"url": "https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"
},
{
"source_name": "Rapid7 HAFNIUM Mar 2021",
"url": "https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"
},
{
"source_name": "FireEye Periscope March 2018",
"url": "https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"
},
{
"source_name": "Lee 2013",
"url": "https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html"
}
]
}Explicit source assertions (19)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0020 → uses → ATTACK:enterprise:T1110.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--046d418d-ffcc-4939-87ce-09cfc2885a5a
FireEye Periscope March 2018ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--109c7cc7-fec6-4d86-ae27-087cddb2670c
Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019ATTACK:enterprise:S0020 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14cc9d67-85e2-4aae-8f3b-4201a66b918f
Rapid7 HAFNIUM Mar 2021 · FireEye Periscope March 2018 · Lee 2013 · NCSC Joint Report Public ToolsATTACK:enterprise:S0020 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1820202b-0994-452a-93e7-ce21496d2ab4
Lee 2013ATTACK:enterprise:S0020 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19be6ce1-8eea-47ff-b87c-3358d390454d
SecureWorks BRONZE UNION June 2017 · Lee 2013 · NCSC Joint Report Public ToolsATTACK:enterprise:S0020 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27561720-48cb-427c-892f-b31ce4d61d9e
FireEye Periscope March 2018ATTACK:enterprise:S0020 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30da0c3d-8767-4828-b50d-181d9a89b9a8
Kaspersky ToddyCat June 2022 · Rapid7 HAFNIUM Mar 2021 · FireEye Periscope March 2018 · Lee 2013 · NCSC Joint Report Public ToolsATTACK:enterprise:G0135 → uses → ATTACK:enterprise:S0020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--368ed1d6-0ce4-457c-b0b8-aad079d7a28e
ESET BackdoorDiplomacy Jun 2021ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:S0020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68efc544-05be-454e-86e9-18d55c7d0f2b
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71daf1fe-a979-4cbc-bb0d-4e2d6c79274a
Dell TG-3390 · SecureWorks BRONZE UNION June 2017 · Nccgroup Emissary Panda May 2018 · Unit42 Emissary Panda May 2019ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:S0020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--734251a0-1a99-48f5-8b37-192a657a430e
apt41_dcsocytec_dec2022 · FireEye APT41 Aug 2019ATTACK:enterprise:S0020 → uses → ATTACK:enterprise:T1046
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73ce71e3-938e-4f5e-b588-32426e874577
FireEye Periscope March 2018ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:S0020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--85932e53-5211-4998-a497-955254c1281c
Kaspersky ToddyCat June 2022ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:S0020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--951774ce-173c-4aaf-a6e3-515ba497d523
FireEye Exchange Zero Days March 2021 · Rapid7 HAFNIUM Mar 2021 · Volexity Exchange Marauder March 2021ATTACK:enterprise:S0020 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6350331-0c0d-4d0d-90a3-d5cc3e420875
FireEye Periscope March 2018 · Lee 2013 · NCSC Joint Report Public ToolsATTACK:enterprise:S0020 → uses → ATTACK:enterprise:T1505.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bea7bd3c-1251-4858-8957-a6dc3bb840d2
Lee 2013ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:S0020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb3a34dd-c516-44a6-9268-6464016bd14a
Accenture MUDCARP March 2019 · CISA AA21-200A APT40 July 2021 · FireEye Periscope March 2018ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:S0020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ee8e443c-44a7-4480-9d51-b722a311dbab
Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023ATTACK:enterprise:S0020 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fbfa0807-ce03-4448-a50d-f0337d2446f2
Rapid7 HAFNIUM Mar 2021 · FireEye Periscope March 2018