aol.pm

Remsec

Software · ATTACK:enterprise:S0125

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:S0125",
  "title": "Remsec",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0125",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--69d6f4a9-fcf0-4f51-bca7-597c51ad0bb8",
  "external_id": "S0125",
  "domain": "enterprise",
  "created": "2017-05-31T21:33:12.858Z",
  "modified": "2026-05-12T15:12:00.735Z",
  "version": "1.5",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Kaspersky ProjectSauron Blog",
      "url": "https://securelist.com/faq-the-projectsauron-apt/75533/"
    },
    {
      "source_name": "ProjectSauron"
    },
    {
      "source_name": "Symantec Strider Blog",
      "url": "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
    }
  ]
}

Explicit source assertions (31)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11247a95-272b-4ae2-8dae-2cd049328734

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--131fde9c-7a83-4603-9c1e-c41f815fb14c

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1052.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--137e1ddc-403b-49b5-a214-20b82bab446e

Kaspersky ProjectSauron Full Report

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--147e009d-48db-40bc-999c-70aa1e770a0c

Symantec Remsec IOCs · Kaspersky ProjectSauron Full Report · Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1686.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--190cd440-8b48-4b39-b9de-cb86c2f5a8ec

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ce50a6a-5f0b-40ca-9a71-41369ae3fdcd

Kaspersky ProjectSauron Full Report

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24bce281-7858-4a42-bfd6-601800fb63f7

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b4a8be2-8403-43d4-addd-79c504e3dec8

Symantec Remsec IOCs · Kaspersky ProjectSauron Full Report · Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f5f2d31-739e-4dc5-b137-840401985244

Symantec Remsec IOCs · Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3076f49e-0db2-4652-a07d-653027aeef1e

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43edea0b-efb8-41ab-bdda-f5aa62de439f

Kaspersky ProjectSauron Technical Analysis · Symantec Remsec IOCs

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1556.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--46f301cd-8ae3-431a-931b-df4bb4fee271

Kaspersky ProjectSauron Full Report

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48b75b8b-5bef-4f99-baa8-5fa978d371d2

Kaspersky ProjectSauron Full Report · ComputerWeekly Strider

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ee54acd-fc04-43c2-8cf6-2200a802d0b9

Symantec Remsec IOCs · Kaspersky ProjectSauron Full Report

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51742efe-5f0c-4fbf-9eb7-5e765a0a408f

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--560a7947-3823-4f2b-8b84-238f9a9a2552

Kaspersky ProjectSauron Full Report · Kaspersky ProjectSauron Technical Analysis · Threatpost Sauron · Symantec Remsec IOCs

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1059.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d5c5cd8-b063-46cd-8863-2c85c392012f

Kaspersky Lua

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--820c50f3-65e8-4a3a-a71a-e079ae8badad

Symantec Remsec IOCs · Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--852009ed-1b50-4b08-9e77-53f0271d995c

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e7ff07b-7a32-4ced-ac22-b523586dbde3

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--96126522-59b5-4b3a-acfb-0af940c5c43a

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b36e877-e637-46b8-bdf1-def74c977472

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e587add-08b7-4ecb-a40a-664b9cff1d0f

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd5b4264-1f10-4cd5-b7b0-a6a8b9dad7c3

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d1222ff7-b93c-40a7-99bd-217d795d8d58

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1652

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d77772ff-ead4-49a6-ba55-15b1ff794bd2

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d7e57ff2-f14b-44fa-97e3-8bc976cb9bd5

Symantec Remsec IOCs · Kaspersky ProjectSauron Full Report · Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e6b68811-113e-4f86-8096-9f506e34dda1

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ea61c268-d0d1-4cbe-8b26-16f70f515a04

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1071.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ec439835-0ccb-477e-8c58-1d8c4e8ed6ab

Symantec Remsec IOCs · Kaspersky ProjectSauron Full Report · Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:G0041 → uses → ATTACK:enterprise:S0125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--edea5971-fc27-4637-8de9-aabcd50784a7

Symantec Strider Blog · Kaspersky ProjectSauron Blog

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.