aol.pm

CHOPSTICK

Software · ATTACK:enterprise:S0023

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:S0023",
  "title": "CHOPSTICK",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0023",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--ccd61dfc-b03f-4689-8c18-7c97eab08472",
  "external_id": "S0023",
  "domain": "enterprise",
  "created": "2017-05-31T21:32:19.389Z",
  "modified": "2024-11-17T14:43:38.592Z",
  "version": "2.3",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "SPLM"
    },
    {
      "source_name": "Xagent"
    },
    {
      "source_name": "X-Agent"
    },
    {
      "source_name": "webhp"
    },
    {
      "source_name": "CHOPSTICK"
    },
    {
      "source_name": "Backdoor.SofacyX"
    },
    {
      "source_name": "ESET Sednit Part 2",
      "url": "http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"
    },
    {
      "source_name": "FireEye APT28 January 2017",
      "url": "https://www.mandiant.com/sites/default/files/2021-09/APT28-Center-of-Storm-2017.pdf"
    },
    {
      "source_name": "FireEye APT28",
      "url": "https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"
    },
    {
      "source_name": "DOJ GRU Indictment Jul 2018",
      "url": "https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"
    },
    {
      "source_name": "Symantec APT28 Oct 2018",
      "url": "https://www.symantec.com/blogs/election-security/apt28-espionage-military-government"
    }
  ]
}

Explicit source assertions (20)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--101867a2-149c-4088-a90f-7af4b86e5013

ESET Sednit Part 2

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1092

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--167d7b11-01f3-42d5-bb8a-78306dc80243

Microsoft SIR Vol 19 · ESET Sednit Part 2 · FireEye APT28

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:S0023

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24013fde-5ce7-4995-9d9f-d2ced31b9d9a

FireEye APT28 · Securelist Sofacy Feb 2018 · Kaspersky Sofacy · Secureworks IRON TWILIGHT Active Measures March 2017

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--252c0e02-0da6-4812-b147-81d9cfb3c998

ESET Sednit Part 2

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1059

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2fa20fad-4ede-42f4-8ce5-7f5a6ce83ed8

Crowdstrike DNC June 2016 · ESET Sednit Part 2

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31462755-d050-4875-9d0b-0a7eeb276326

ESET Sednit Part 2

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a9abcd5-52ba-44f1-96a5-1593f816b9f0

ESET Sednit Part 2

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40a8f80d-5497-4218-849c-3c0b63796641

FireEye APT28

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1497

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5edc2d20-2e9a-4587-9656-dfe38eb1d66d

FireEye APT28

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7201204c-d21f-4560-a3d1-c75fabacb4c4

DOJ GRU Indictment Jul 2018

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--731710ae-a6b9-47b7-b8b2-8526ce60be2f

Crowdstrike DNC June 2016

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--765e3b13-60f4-4b34-b03f-0d8e738b0add

FireEye APT28

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--838b4a52-1360-4ca7-ab25-1b549508e687

ESET Sednit Part 2

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1027.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a6bfa36-adff-402d-9913-be2e45bc22aa

FireEye APT28

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--954961e4-0bf5-496e-b200-e63d99c006de

Crowdstrike DNC June 2016 · ESET Sednit Part 2 · DOJ GRU Indictment Jul 2018

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9aeda7e2-e452-4cd3-837f-e258cba1fc96

Microsoft SIR Vol 19 · FireEye APT28 · Secureworks IRON TWILIGHT Active Measures March 2017

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1568.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a72ce53b-311d-43f2-b145-784c322306c1

ESET Sednit 2017 Activity

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f29a3a93-e697-4d6f-8087-eec72856bae5

ESET Sednit Part 2

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f3b8a97f-4e9c-4190-be08-467d136fc943

ESET Sednit Part 2

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f55d54fe-27ed-41f9-81db-11ccbe2d2125

FireEye APT28

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.