USBferry
Software · ATTACK:enterprise:S0452
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0452",
"title": "USBferry",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0452",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--75bba379-4ba1-467e-8c60-ec2b269ee984",
"external_id": "S0452",
"domain": "enterprise",
"created": "2020-05-20T19:54:06.476Z",
"modified": "2025-04-25T14:43:47.313Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "TrendMicro Tropic Trooper May 2020",
"url": "https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"
}
]
}Explicit source assertions (12)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0452 → uses → ATTACK:enterprise:T1087.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0bbf5be7-e1de-419e-85ee-afaa431f60be
TrendMicro Tropic Trooper May 2020ATTACK:enterprise:S0452 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--15a571d1-652c-4148-9dee-12d3b1cbff62
TrendMicro Tropic Trooper May 2020ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:S0452
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b5dbd72-abeb-4d61-9a7f-917a17f272d1
TrendMicro Tropic Trooper May 2020ATTACK:enterprise:S0452 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--416c98b4-221d-4e2f-aed4-43b844a89ad0
TrendMicro Tropic Trooper May 2020ATTACK:enterprise:S0452 → uses → ATTACK:enterprise:T1120
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57e57dc4-b813-4e5c-882a-0021c7e0ff22
TrendMicro Tropic Trooper May 2020ATTACK:enterprise:S0452 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--74ade1b3-d2d8-4537-87da-41f54346a149
TrendMicro Tropic Trooper May 2020ATTACK:enterprise:S0452 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8e1c15c8-ba96-47b8-9feb-fade45d7fcf9
TrendMicro Tropic Trooper May 2020ATTACK:enterprise:S0452 → uses → ATTACK:enterprise:T1091
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93bea600-6a8d-4f58-acf3-e7d604eeb451
TrendMicro Tropic Trooper May 2020ATTACK:enterprise:S0452 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95f2f687-4a70-4611-a420-2b8b53e2ee26
TrendMicro Tropic Trooper May 2020ATTACK:enterprise:S0452 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b45e744d-f9c3-4469-a410-137f1802536f
TrendMicro Tropic Trooper May 2020ATTACK:enterprise:S0452 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bfad86a1-f8bb-45eb-b7b9-5919ca4ef886
TrendMicro Tropic Trooper May 2020ATTACK:enterprise:S0452 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e6cd4568-3c15-4d1d-ab2c-c799141cf34b
TrendMicro Tropic Trooper May 2020