Skip to content

BADNEWS

Software · ATTACK:enterprise:S0128

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0128",
  "title": "BADNEWS",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0128",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--e9595678-d269-469e-ae6b-75e49259de63",
  "external_id": "S0128",
  "domain": "enterprise",
  "created": "2017-05-31T21:33:14.118Z",
  "modified": "2025-04-25T14:44:59.677Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "BADNEWS"
    },
    {
      "source_name": "Forcepoint Monsoon",
      "url": "https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"
    },
    {
      "source_name": "TrendMicro Patchwork Dec 2017",
      "url": "https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"
    }
  ]
}

Explicit source assertions (25)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c870326-6b8a-4279-bbd3-2c1ae23ba54a

Forcepoint Monsoon · PaloAlto Patchwork Mar 2018 · TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f76d408-be8a-478e-8a5a-aab1d1f96572

PaloAlto Patchwork Mar 2018

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11010986-1b4d-4158-b47d-bbff34306c98

Forcepoint Monsoon · PaloAlto Patchwork Mar 2018

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11a7431f-416f-48de-a3c0-8782abdede63

Forcepoint Monsoon · PaloAlto Patchwork Mar 2018

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ba38510-0489-4305-944f-451e6869b30f

Forcepoint Monsoon · TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1574.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--283e242a-72d4-4b40-8905-888595c34919

PaloAlto Patchwork Mar 2018 · Forcepoint Monsoon

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1132

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3884be12-f73f-4f9b-875e-68d40798faf6

Forcepoint Monsoon

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e09a5ce-a6a0-4f03-8c23-a7ebb4dfd74c

Forcepoint Monsoon · PaloAlto Patchwork Mar 2018 · TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f37a188-b994-4191-aee1-56d0c60101e1

Forcepoint Monsoon · PaloAlto Patchwork Mar 2018 · TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1036.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--469585eb-231d-4ecb-8fc5-fb4f538c3875

TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5027a119-ff43-4ca6-a862-3efe39b29b3e

TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--521278a2-0924-4ff8-b5a6-03f5f69426b6

PaloAlto Patchwork Mar 2018

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1039

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c9649b7-00c6-4503-a911-9e8b9086eac4

Forcepoint Monsoon

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79f0712b-2cb1-47df-8ea1-26fb1502a831

Forcepoint Monsoon · PaloAlto Patchwork Mar 2018 · TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c359d18-06fc-4db1-9b58-6e85fa563066

Forcepoint Monsoon

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--93fc3086-d2c0-4b4d-8a69-278f15176739

TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2a31eb7-0b22-416c-b12d-e52e5f37f8b8

Forcepoint Monsoon · TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5b4d08c-963a-48fe-8f22-ba344835d00e

Forcepoint Monsoon · TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b3f53743-4bd9-47a6-bf41-6f7786bbdc87

Forcepoint Monsoon · PaloAlto Patchwork Mar 2018 · TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bfa9ae5f-0e45-4a43-9d37-00c9574a1528

PaloAlto Patchwork Mar 2018

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d15cda3e-7ed6-4914-a0a8-ff1f4fe668ec

Forcepoint Monsoon · TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db8f1355-57f0-446d-a261-b168497b20c6

Forcepoint Monsoon · TrendMicro Patchwork Dec 2017

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:S0128

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1456e13-5f3f-4dac-a002-2bd78c36348a

Forcepoint Monsoon · TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f761e63a-5c5a-47e3-8256-08bd299f329e

TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9c7d0e1-135f-4e21-8251-3049bc24c18d

Forcepoint Monsoon · TrendMicro Patchwork Dec 2017

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.