JHUHUGIT
Software · ATTACK:enterprise:S0044
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0044",
"title": "JHUHUGIT",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0044",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--8ae43c46-57ef-47d5-a77a-eebb35628db2",
"external_id": "S0044",
"domain": "enterprise",
"created": "2017-05-31T21:32:34.199Z",
"modified": "2024-11-17T14:43:38.591Z",
"version": "2.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "JHUHUGIT"
},
{
"source_name": "JKEYSKW"
},
{
"source_name": "GAMEFISH"
},
{
"source_name": "Seduploader"
},
{
"source_name": "SofacyCarberp"
},
{
"source_name": "ESET Sednit Part 1",
"url": "http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part1.pdf"
},
{
"source_name": "F-Secure Sofacy 2015",
"url": "https://labsblog.f-secure.com/2015/09/08/sofacy-recycles-carberp-and-metasploit-code/"
},
{
"source_name": "FireEye APT28 January 2017",
"url": "https://www.mandiant.com/sites/default/files/2021-09/APT28-Center-of-Storm-2017.pdf"
},
{
"source_name": "Kaspersky Sofacy",
"url": "https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/"
},
{
"source_name": "Unit 42 Sofacy Feb 2018",
"url": "https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/"
},
{
"source_name": "Talos Seduploader Oct 2017",
"url": "https://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
},
{
"source_name": "Symantec APT28 Oct 2018",
"url": "https://www.symantec.com/blogs/election-security/apt28-espionage-military-government"
},
{
"source_name": "Sednit"
},
{
"source_name": "Trojan.Sofacy"
}
]
}Explicit source assertions (21)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--073215cd-bc1e-48e8-8f3a-7d24f18b32c6
Talos Seduploader Oct 2017 · Unit 42 Playbook Dec 2017ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d43f3a7-70ed-4d04-857e-3a9fbce86cfb
ESET Sednit Part 1ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1923a47b-5a48-44e6-883f-ca23a96fea46
ESET Sednit Part 1 · Unit 42 Sofacy Feb 2018ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1993ee53-26a0-4cd1-8a93-5fd578c941fc
Unit 42 Playbook Dec 2017ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1aa10371-6473-416a-8b8b-17c36f700233
ESET Sednit Part 1 · ESET Sednit July 2015ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27e7969b-a0bf-4db6-90bf-1f17c5e0c853
Unit 42 Playbook Dec 2017ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4a4a5d60-ec17-49a2-b651-ea8918410fc2
ESET Sednit Part 1 · Unit 42 Sofacy Feb 2018 · Unit 42 Playbook Dec 2017ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d0263d9-ddd3-4195-96ae-e340caef9e0e
ESET Sednit Part 1ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1037.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--70d5a73c-cc14-410a-a430-5948cd21532f
ESET Sednit Part 1 · Talos Seduploader Oct 2017ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:S0044
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--75d04175-c43d-46cd-be08-5f4c91f767ed
US District Court Indictment GRU Oct 2018 · FireEye APT28 January 2017 · Securelist Sofacy Feb 2018 · Kaspersky Sofacy · Secureworks IRON TWILIGHT Active Measures March 2017ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1115
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83aac36d-6dfa-4c27-b1b1-c200c9240eb9
Unit 42 Playbook Dec 2017ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d788563-901e-4002-a599-826840b00d39
Talos Seduploader Oct 2017ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1068
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--976202db-cdfa-4c4e-bc09-9b3cad90e6fb
ESET Sednit Part 1 · ESET Sednit July 2015ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1546.015
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--988cb889-b385-4e8f-be06-7d41c4da0dd7
ESET Sednit Part 1 · Talos Seduploader Oct 2017ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ae1ee1dc-6017-4177-b34c-70db166a939e
ESET Sednit Part 1 · F-Secure Sofacy 2015 · Talos Seduploader Oct 2017ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0099b28-bcb8-4214-8166-d9caed1b6491
ESET Sednit Part 1ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--da44c85c-914b-41e0-aef7-68cd3c1faea1
F-Secure Sofacy 2015 · Unit 42 Sofacy Feb 2018ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dd9c1644-259d-4980-8058-fdc3c72fac7b
F-Secure Sofacy 2015 · Talos Seduploader Oct 2017ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e11d4f32-842a-4684-8974-f368e52b8632
ESET Sednit Part 1 · Unit 42 Sofacy Feb 2018ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--edaa004e-8239-40d8-a4f0-8849c4f0e87f
ESET Sednit Part 1 · Unit 42 Sofacy Feb 2018ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f39d9e4d-b4f9-4c12-aa8e-a44f8550b57f
ESET Sednit Part 1 · Unit 42 Sofacy Feb 2018 · Talos Seduploader Oct 2017