AdFind
Software · ATTACK:enterprise:S0552
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0552",
"title": "AdFind",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0552",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "tool--f59508a6-3615-47c3-b493-6676e1a39a87",
"external_id": "S0552",
"domain": "enterprise",
"created": "2020-12-28T18:35:50.244Z",
"modified": "2024-09-25T15:21:53.462Z",
"version": "1.5",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Red Canary Hospital Thwarted Ryuk October 2020",
"url": "https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/"
},
{
"source_name": "FireEye Ryuk and Trickbot January 2019",
"url": "https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html"
},
{
"source_name": "FireEye FIN6 Apr 2019",
"url": "https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"
}
]
}Explicit source assertions (19)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01253fc1-ee00-438a-ba98-fc8db655b7d3
NCC Group TA505ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:S0552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1539a3a4-389a-4be2-a14f-db916a47020f
Symantec Bilbug 2022ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1dd1bd5b-8639-48bd-81bd-c34c61fd464a
Red Canary Hospital Thwarted Ryuk October 2020 · FireEye Ryuk and Trickbot January 2019 · Mandiant FIN12 Oct 2021 · DFIR Ryuk 2 Hour Speed Run November 2020 · DFIR Ryuk's Return October 2020ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--210b5693-f039-4853-a0ea-70b4fa3abed9
CrowdStrike Carbon Spider August 2021ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:S0552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25f63329-0c2e-47cf-ad32-d89ef439f4f7
DFIR Conti Bazar Nov 2021ATTACK:enterprise:S0552 → uses → ATTACK:enterprise:T1482
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31025044-b0de-4dcd-bd26-fe467b803000
Red Canary Hospital Thwarted Ryuk October 2020 · FireEye Ryuk and Trickbot January 2019 · Symantec Bumblebee June 2022 · FireEye FIN6 Apr 2019ATTACK:enterprise:S0552 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4358ef19-eef7-48bb-9941-39d70bf235af
Red Canary Hospital Thwarted Ryuk October 2020 · FireEye Ryuk and Trickbot January 2019 · Symantec Bumblebee June 2022 · FireEye FIN6 Apr 2019ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:S0552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--53c7b735-ba51-43ed-b363-3cf388c97ca0
CISA Play Ransomware Advisory December 2023 · Trend Micro Ransomware Spotlight Play July 2023ATTACK:enterprise:S0552 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54f36f78-5046-48f5-9ec8-0348ae057fff
Red Canary Hospital Thwarted Ryuk October 2020 · FireEye Ryuk and Trickbot January 2019 · FireEye FIN6 Apr 2019ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:S0552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64f429bb-7ddd-473a-8408-7fa0ba9282e3
Microsoft BlackByte 2023 · Symantec BlackByte 2022ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:S0552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b7410ad-f09f-49e1-8077-9ffac9d77fcc
FireEye FIN6 Apr 2019ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:S0552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9092578b-593b-4a4b-ba3f-2bfeed172567
Arctic Wolf Akira 2023ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:S0552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95cabb2e-3d68-40c9-8e84-14667ef9ef6a
Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023ATTACK:enterprise:G1032 → uses → ATTACK:enterprise:S0552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d2bfb09-9cc8-4b4b-a555-3bac7999d236
Secureworks GOLD IONIC April 2024ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:S0552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b1643345-ab99-4648-ab15-0af7219978f1
CrowdStrike StellarParticle January 2022 · Microsoft Analyzing Solorigate Dec 2020ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:S0552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b22b0a6c-5960-4232-9fb6-bae84fcc07ca
Microsoft Analyzing Solorigate Dec 2020 · CrowdStrike StellarParticle January 2022 · ESET T3 Threat Report 2021ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:S0552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b593a75c-245f-449c-861b-b283c47357f0
Symantec Cicada November 2020ATTACK:enterprise:S0552 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dfe9acb4-48fe-4241-8b17-d76534f75b62
Red Canary Hospital Thwarted Ryuk October 2020 · Cybereason Bumblebee August 2022 · FireEye Ryuk and Trickbot January 2019 · FireEye FIN6 Apr 2019ATTACK:enterprise:S0552 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fb21ff9d-1cd5-4908-a3a4-5f0d22cb8c10
Red Canary Hospital Thwarted Ryuk October 2020 · Cybereason Bumblebee August 2022 · FireEye Ryuk and Trickbot January 2019 · Symantec Bumblebee June 2022 · FireEye FIN6 Apr 2019