USBStealer
Software · ATTACK:enterprise:S0136
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0136",
"title": "USBStealer",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0136",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--af2ad3b7-ab6a-4807-91fd-51bcaff9acbb",
"external_id": "S0136",
"domain": "enterprise",
"created": "2017-05-31T21:33:17.716Z",
"modified": "2024-04-10T22:17:40.838Z",
"version": "1.3",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "ESET Sednit USBStealer 2014",
"url": "http://www.welivesecurity.com/2014/11/11/sednit-espionage-group-attacking-air-gapped-networks/"
},
{
"source_name": "Kaspersky Sofacy",
"url": "https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/"
}
]
}Explicit source assertions (15)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0136 → uses → ATTACK:enterprise:T1025
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00ae99d1-db02-4007-8669-04d7fc4c1390
ESET Sednit USBStealer 2014 · Kaspersky SofacyATTACK:enterprise:S0136 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--016dc21c-ade9-43cc-9d88-a0c4c0891ccc
ESET Sednit USBStealer 2014ATTACK:enterprise:S0136 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03ab3120-4c6e-4de2-982a-fe22d466f748
ESET Sednit USBStealer 2014 · Kaspersky SofacyATTACK:enterprise:S0136 → uses → ATTACK:enterprise:T1052.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b97e16e-8c39-4e5e-ad90-15c10f15d923
ESET Sednit USBStealer 2014ATTACK:enterprise:S0136 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--553dbb57-1174-494c-9cfd-dbc83ecc74f6
ESET Sednit USBStealer 2014ATTACK:enterprise:S0136 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b686a7c-4fcd-44c2-9f57-1d88d6633ef4
ESET Sednit USBStealer 2014ATTACK:enterprise:S0136 → uses → ATTACK:enterprise:T1119
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a892ca0-f915-4dc1-817a-cdcfb6777f28
ESET Sednit USBStealer 2014ATTACK:enterprise:S0136 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a67d4b9b-0c8f-41d8-a7f2-6d4c61fcb1ea
ESET Sednit USBStealer 2014ATTACK:enterprise:S0136 → uses → ATTACK:enterprise:T1020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ae8a95fa-c0ad-40b4-a573-a9441ed94fab
ESET Sednit USBStealer 2014ATTACK:enterprise:S0136 → uses → ATTACK:enterprise:T1092
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c612eb88-d7e0-46cc-a9bc-d0da2977ff00
ESET Sednit USBStealer 2014ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:S0136
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d26b3aeb-972f-471e-ab59-dc1ee2aa532e
ESET Sednit Part 3ATTACK:enterprise:S0136 → uses → ATTACK:enterprise:T1091
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3e841fa-b806-4c22-9f98-a97950b68931
ESET Sednit USBStealer 2014ATTACK:enterprise:S0136 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e5efa7ca-3e2a-4f08-ac2c-f5f317c9caf7
ESET Sednit USBStealer 2014ATTACK:enterprise:S0136 → uses → ATTACK:enterprise:T1120
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f7740e3c-c143-40b7-a8da-e797f5d74b50
ESET Sednit USBStealer 2014ATTACK:enterprise:S0136 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fe229513-0cd9-4e9a-a333-2748ef03dfbc
ESET Sednit USBStealer 2014 · Kaspersky Sofacy