Winnti for Windows
Software · ATTACK:enterprise:S0141
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0141",
"title": "Winnti for Windows",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0141",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--d3afa961-a80c-4043-9509-282cdf69ab21",
"external_id": "S0141",
"domain": "enterprise",
"created": "2017-05-31T21:33:21.027Z",
"modified": "2024-04-10T20:35:29.262Z",
"version": "3.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Microsoft Winnti Jan 2017",
"url": "https://blogs.technet.microsoft.com/mmpc/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/"
},
{
"source_name": "Chronicle Winnti for Linux May 2019",
"url": "https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a"
},
{
"source_name": "401 TRG Winnti Umbrella May 2018",
"url": "https://401trg.github.io/pages/burning-umbrella.html"
},
{
"source_name": "Kaspersky Winnti April 2013",
"url": "https://securelist.com/winnti-more-than-just-a-game/37029/"
},
{
"source_name": "Novetta Winnti April 2015",
"url": "https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf"
}
]
}Explicit source assertions (24)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--019e35b8-cec3-45e0-b297-19dca59b3190
Novetta Winnti April 2015ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0a65c303-52a6-4624-a8fb-fc7448429139
Microsoft Winnti Jan 2017ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a20c3db-a33c-4129-9fad-3f5605c0cbcb
Novetta Winnti April 2015ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a4f5197-ec9f-4607-984c-4a09978acd8e
Novetta Winnti April 2015ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1090.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2fadf189-bdcf-44b8-933a-ca6188485058
Novetta Winnti April 2015ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:S0141
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--419d2655-2c6e-4fbe-ad2d-e2e84aec61e0
Crowdstrike HuntReport 2022ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4fb5c14c-5a08-4116-bbb7-d6822649dfa0
Novetta Winnti April 2015ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--563e67ee-9cc8-4f44-9d3a-3611e19a1a3c
Novetta Winnti April 2015ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5bd58ef1-ad36-47ac-91e5-4e7df618dd87
Novetta Winnti April 2015ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1090.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--62f3aaef-917b-42fa-9fe9-e21f674caa90
Novetta Winnti April 2015ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b11697f-be6c-4cd7-b445-4d277a8d7346
Microsoft Winnti Jan 2017 · Novetta Winnti April 2015ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--745d3440-ecdb-4e3f-b9e6-b4484bb6c465
Novetta Winnti April 2015ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--905c6670-b81e-40c1-b84d-8359ffc2dcc1
Novetta Winnti April 2015ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1027.015
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--90a36ef9-cee8-4f4d-b81e-7cd6d2cca174
Novetta Winnti April 2015ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1569.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9aebe474-f443-4007-bb8d-dc7c9f22d5f9
Novetta Winnti April 2015ATTACK:enterprise:G0044 → uses → ATTACK:enterprise:S0141
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a70d06e8-63dd-4cb3-83a5-f7bd8f2a8132
Kaspersky Winnti April 2013 · Kaspersky Winnti June 2015ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ace0d0ba-7ee5-46cd-be08-2b33d217a13d
Novetta Winnti April 2015ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b18c763f-7e8a-43bd-bf67-6c0cc5ac4ab3
Novetta Winnti April 2015ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf833c53-a60f-4e92-92b4-9987334e7f85
Novetta Winnti April 2015ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7f5c7fe-5d4a-4f1e-a5a3-adf02f8699ec
Novetta Winnti April 2015ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d99ad754-c9fa-4244-b4fa-69a0b2191e24
Novetta Winnti April 2015ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc40e665-d4fd-4e44-a101-efe4c1d950e0
Novetta Winnti April 2015ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e7b5511a-3528-48d1-9224-6c5ff88b3825
Microsoft Winnti Jan 2017ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1480.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f74ed982-fc1d-4c6b-945c-52c5e8f13fce
Novetta Winnti April 2015