Skip to content

GravityRAT

Software · ATTACK:enterprise:S0237

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0237",
  "title": "GravityRAT",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0237",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--1d1fce2f-0db5-402b-9843-4278a0694637",
  "external_id": "S0237",
  "domain": "enterprise",
  "created": "2018-10-17T00:14:20.652Z",
  "modified": "2024-04-11T02:25:20.119Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "GravityRAT"
    },
    {
      "source_name": "Talos GravityRAT",
      "url": "https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html"
    }
  ]
}

Explicit source assertions (19)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03e6e755-12a2-4261-b95d-caea6b2bf051

Talos GravityRAT

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--041e8f9b-6cdb-44b3-aa37-a274a4de9a0b

Talos GravityRAT

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18f3619c-c1e1-4b2c-b582-2cb5691f02e9

Talos GravityRAT

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27a36f9c-2292-4bf0-8c08-9ccfc1effffe

Talos GravityRAT

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1124

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33e3573b-0f18-417c-be17-727863fc21ec

Talos GravityRAT

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--394d53b3-da1c-44b4-8abf-e1092f34c8be

Talos GravityRAT

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42aa16be-5b53-4645-998b-9eb5de8c0429

Talos GravityRAT

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54ea458f-665e-42a3-b181-8d783e9589ad

Talos GravityRAT

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--565da748-a5c8-417c-8c55-828c6e9f2c35

Talos GravityRAT

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59a6a413-1f3f-44bd-8b66-5685a1e8e6df

Talos GravityRAT

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60349cdb-6f9a-4962-92aa-105eea1d112a

Talos GravityRAT

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79d23451-095d-445d-a61e-3351b55eafde

Talos GravityRAT

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--948f8c8b-18e1-4652-86af-bad1dc0ec090

Talos GravityRAT

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--afcc4ac4-b088-4795-b159-c6245223178b

Talos GravityRAT

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b533e55c-77c7-48f8-baa7-c8724f90e483

Talos GravityRAT

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bfb687f5-0c7d-4ac3-a295-26f1b96dc360

Talos GravityRAT

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1559.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c49b5147-f60f-43d7-b119-52b1761002af

Talos GravityRAT

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e61e5dc3-b6ac-4909-b188-eaede02385df

Talos GravityRAT

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fe4c0535-7491-4345-a524-11f8434e3678

Talos GravityRAT

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.