Skip to content

ZxShell

Software · ATTACK:enterprise:S0412

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0412",
  "title": "ZxShell",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0412",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--cfc75b0d-e579-40ae-ad07-a1ce00d49a6c",
  "external_id": "S0412",
  "domain": "enterprise",
  "created": "2019-09-24T12:59:57.991Z",
  "modified": "2025-04-16T20:38:36.169Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "ZxShell"
    },
    {
      "source_name": "Sensocode"
    },
    {
      "source_name": "Talos ZxShell Oct 2014",
      "url": "https://blogs.cisco.com/security/talos/opening-zxshell"
    },
    {
      "source_name": "FireEye APT41 Aug 2019",
      "url": "https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"
    }
  ]
}

Explicit source assertions (37)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:S0412

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1aee1049-89be-45b8-ae2f-83bf4e35d5a3

Talos ZxShell Oct 2014 · Cisco Group 72

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1021.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fa0c726-0f55-4f10-8a31-184d760239c5

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20f422e8-6244-46e3-8842-f5dc3e37568c

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2bd05bbf-886e-4211-8aab-63cd8581a695

Talos ZxShell Oct 2014 · FireEye APT41 Aug 2019

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--334ab5f1-75dc-425b-9659-10d2b62b9cbc

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a5c4e73-3657-470e-882b-563f3ca599e7

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1056.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--405f7aa3-2ce8-455f-9718-c2525658c595

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49dbde7a-a8ac-4d86-8216-1055f7536467

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b3274fe-1960-4d1e-91d1-2091e467c45b

FireEye APT41 Aug 2019

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:S0412

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d1d7045-4492-492c-9522-2885d6bd96f6

FireEye APT41 Aug 2019

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5acaf47e-4608-4548-81e8-368a2687844e

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5db19a58-c7ff-4de0-b9bd-9e3b247b2ff3

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6635f23e-99e9-4978-9924-ccf6c199f84f

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1190

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66fe07f5-fe08-4ad1-98b6-cb300007fe42

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68d151ea-6dd8-4e6b-acd5-c998ebffc357

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--704355c5-4743-4fe1-bd64-b7012fe7c1d2

Talos ZxShell Oct 2014 · FireEye APT41 Aug 2019

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--713495d9-e481-4f48-af72-e3bfd474016b

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e7d5934-0e0d-4d9e-89d8-279bc05a6f77

Talos ZxShell Oct 2014 · FireEye APT41 Aug 2019

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9373e1b7-3164-4879-9b92-f3a629029eb2

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--972c54cf-a25e-4f25-adbe-28f367327098

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a18f1ae0-dbc8-4f6d-9c88-ab284ce2bf0c

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a275b407-099a-4f2c-954c-528cf61349f8

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a322b9a0-57f8-4eda-a6f4-2adbc1376bfb

Talos ZxShell Oct 2014 · Secureworks BRONZEUNION Feb 2019 · FireEye APT41 Aug 2019

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a49751ab-abbb-414f-926e-97c7fa3da30c

Talos ZxShell Oct 2014

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0412

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7b07cff-8743-4fe9-9999-8ad32995fa95

Secureworks BRONZEUNION Feb 2019

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7ee1099-9380-4743-ba98-6590b65420b2

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1134.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa3e7625-07e1-474f-967a-15e26e1a193c

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa9b33a5-81b2-4126-b8f5-0182ec365fc8

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1218.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abc5f1e1-82b7-4d5d-b623-ce0f3e91b9d3

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9ad232a-2276-40b2-bf56-490fc6357cca

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1499

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dda297c6-2edc-47c5-b32b-0d4ef0f85be4

Talos ZxShell Oct 2014 · FireEye APT41 Aug 2019

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eb7db180-08e0-4240-a1d4-b520fbe4dc8c

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed40dd97-0ad0-4501-8f1e-a4bd4625432d

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ef66842b-7f2f-411d-810e-c67d4372fbb9

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f0a91093-3827-49b0-82c4-a1c882f074cf

Talos ZxShell Oct 2014 · FireEye APT41 Aug 2019

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd44d6f1-25c5-4365-8a68-323bfc0b3f22

Talos ZxShell Oct 2014

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ffffed15-5695-44b9-b85b-89ba8187415d

Talos ZxShell Oct 2014

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.