BBSRAT
Software · ATTACK:enterprise:S0127
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0127",
"title": "BBSRAT",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0127",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--64d76fa5-cf8f-469c-b78c-1a4f7c5bad80",
"external_id": "S0127",
"domain": "enterprise",
"created": "2017-05-31T21:33:13.664Z",
"modified": "2025-04-25T14:43:36.304Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Palo Alto Networks BBSRAT",
"url": "http://researchcenter.paloaltonetworks.com/2015/12/bbsrat-attacks-targeting-russian-organizations-linked-to-roaming-tiger/"
}
]
}Explicit source assertions (14)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0127 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--128e8365-7645-41fa-832e-5ff4d8639035
Palo Alto Networks BBSRATATTACK:enterprise:S0127 → uses → ATTACK:enterprise:T1560.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35373a50-d85d-4ac5-94bc-5896b48ac5c6
Palo Alto Networks BBSRATATTACK:enterprise:S0127 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4af1ec66-5007-49df-8a10-df2c8ed7edc8
ATTACK:enterprise:S0127 → uses → ATTACK:enterprise:T1007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54e99ba2-143f-43be-8d7f-79de5551d1ac
Palo Alto Networks BBSRATATTACK:enterprise:S0127 → uses → ATTACK:enterprise:T1569.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--59b39f06-a71c-42f7-92f2-244a183113d6
Palo Alto Networks BBSRATATTACK:enterprise:S0127 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b19a5ae-3f6a-4950-94da-22d94477d5d2
Palo Alto Networks BBSRATATTACK:enterprise:S0127 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7fd6c479-00ae-478d-a29b-fc40619eea97
Palo Alto Networks BBSRATATTACK:enterprise:S0127 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--805f7ba3-a904-410c-b9fd-20356c595b19
Palo Alto Networks BBSRATATTACK:enterprise:S0127 → uses → ATTACK:enterprise:T1546.015
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8793b289-4b74-4119-8561-a9ad27dacdff
Palo Alto Networks BBSRATATTACK:enterprise:S0127 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8beb37e3-5cf0-4229-ae27-186a37133521
Palo Alto Networks BBSRATATTACK:enterprise:S0127 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93812c9c-39f1-4bf6-adda-601d0ffd88bf
Palo Alto Networks BBSRATATTACK:enterprise:S0127 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96077086-d811-47a1-a805-decbf6f249b7
Palo Alto Networks BBSRATATTACK:enterprise:S0127 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b82f51f9-74a0-43e1-b3c6-63df3a90c9eb
Palo Alto Networks BBSRATATTACK:enterprise:S0127 → uses → ATTACK:enterprise:T1055.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec6074e4-4137-42a4-86c8-1ea95ce54df6
Palo Alto Networks BBSRAT