Skip to content

Epic

Software · ATTACK:enterprise:S0091

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0091",
  "title": "Epic",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0091",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--6b62e336-176f-417b-856a-8552dd8c44e1",
  "external_id": "S0091",
  "domain": "enterprise",
  "created": "2017-05-31T21:32:58.738Z",
  "modified": "2025-10-22T02:34:29.842Z",
  "version": "1.4",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Epic"
    },
    {
      "source_name": "Tavdig"
    },
    {
      "source_name": "Wipbot"
    },
    {
      "source_name": "WorldCupSec"
    },
    {
      "source_name": "TadjMakhal"
    },
    {
      "source_name": "Kaspersky Turla",
      "url": "https://securelist.com/the-epic-turla-operation/65545/"
    }
  ]
}

Explicit source assertions (23)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--014010a2-7bb8-4b11-bef9-c85609b2d94b

Kaspersky Turla

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01f98d14-77b9-439f-8b44-920fcaca2b2b

Kaspersky Turla · Kaspersky Turla Aug 2014

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--062b1f19-2afb-4bdc-908e-99594ff114cf

Kaspersky Turla · Kaspersky Turla Aug 2014

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1547f28f-d6b7-43cc-8b89-0eaa524648b8

Kaspersky Turla Aug 2014

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1124

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16f64842-8ba8-4827-a47f-e7d665f942ae

Kaspersky Turla

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--291e908e-1d2e-4b29-a564-5a33149d1dbb

Kaspersky Turla · Kaspersky Turla Aug 2014

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3464b769-7884-4721-8384-1771472f668d

Kaspersky Turla Aug 2014

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66b026b6-af1e-47a6-9c3d-b853e2130b68

Kaspersky Turla Aug 2014

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6cfd90ab-8e17-4b78-9bfb-7792b8f51143

Kaspersky Turla · Kaspersky Turla Aug 2014

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e576576-bcd8-42ca-aa0a-8e3e24aaeafc

Kaspersky Turla

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1560.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--762f22f8-5f47-4c1f-b41b-86984c3e2550

Kaspersky Turla Aug 2014

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1055.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a1a5bda-170c-44fd-8094-7f78b7f803c9

ESET Recon Snake Nest

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88ad4d2e-745e-4712-8901-e772dfaf3298

Kaspersky Turla

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e876e40-06b7-4830-a281-85c070b6f854

Kaspersky Turla Aug 2014

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9076865a-8215-4536-bb31-60ab7fa20af6

Kaspersky Turla · Kaspersky Turla Aug 2014

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc5b2681-d0e9-4ef5-9a90-56358ea34d96

Kaspersky Turla Aug 2014

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bcc48bba-95a6-465b-ad37-90e2faee5707

Kaspersky Turla

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ce560fcf-cd2d-45c6-9331-f5f0594e5bf5

Kaspersky Turla

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d012dd66-fef4-4714-bb00-55d9dd2861a1

Kaspersky Turla

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2f6e1bf-49ae-48cb-a919-b556f8cd0553

Kaspersky Turla

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de99649c-2d3a-4cbc-be0c-003e399e3963

Kaspersky Turla Aug 2014

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e02d1cb4-1bb7-49b5-a918-5e0d194974aa

Kaspersky Turla · Secureworks IRON HUNTER Profile

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e600fe60-36d1-4053-af2f-13830d95bd14

Kaspersky Turla

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.