Skip to content

SysUpdate

Software · ATTACK:enterprise:S0663

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0663",
  "title": "SysUpdate",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0663",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--c009560a-f097-45a3-8f9f-78ec1440a783",
  "external_id": "S0663",
  "domain": "enterprise",
  "created": "2021-11-29T18:37:40.308Z",
  "modified": "2025-10-21T23:26:56.446Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "HyperSSL"
    },
    {
      "source_name": "Soldier"
    },
    {
      "source_name": "FOCUSFJORD"
    },
    {
      "source_name": "Trend Micro Iron Tiger April 2021",
      "url": "https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"
    }
  ]
}

Explicit source assertions (32)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1071.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--04ff77bc-6232-4950-8e9c-6f4dcc83ca9d

Lunghi Iron Tiger Linux

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--089ad94f-daa3-437d-931a-9fc2b782595c

Lunghi Iron Tiger Linux

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10bb2d06-6158-4cf2-bd35-0840a8e0a129

Lunghi Iron Tiger Linux

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1387ec64-ba36-42cd-b659-c29e708d8281

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19dccc7d-03eb-45a4-88c1-1ed4ddcee7a3

Lunghi Iron Tiger Linux · Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b1a7abf-72bc-44fa-8f90-4321003f0553

Lunghi Iron Tiger Linux

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25b8811b-3e73-40c7-b1fc-132eeb5a6f5e

Lunghi Iron Tiger Linux

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29d1fe5a-4ea4-4fb2-8b64-afcceee45d10

Lunghi Iron Tiger Linux

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c6fad21-d9e4-4e58-b8d1-ba573b2ec6d8

Lunghi Iron Tiger Linux

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48d34942-8001-41d2-ba53-0457c3852541

Lunghi Iron Tiger Linux

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1027.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--596099b1-11a9-43c3-ae21-d5a31233e5c2

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c0bb793-ced9-4b3c-80c2-af33e1fa6213

Lunghi Iron Tiger Linux · Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1016.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63106a66-1408-4a15-b945-072f5e3ae2ff

Lunghi Iron Tiger Linux

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--759ce6e8-da01-4cd6-9d03-9b0a1edde9be

Lunghi Iron Tiger Linux · Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--829794bf-ad71-4f31-8e78-df712d751419

Lunghi Iron Tiger Linux

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--853e7b95-9edb-4260-b08d-3dd3b922cb73

Lunghi Iron Tiger Linux

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8690ef38-ee7a-49ec-b723-0f7dceced233

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89d37095-2f31-42e9-b8f7-3abdd76d5f57

Lunghi Iron Tiger Linux · Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9069440f-f2d0-4548-94a8-6759a31b1425

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1543.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9a0137e5-82d0-4419-961a-9b0eb47b2d79

Lunghi Iron Tiger Linux

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0663

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a036174e-7bd3-4604-ba4c-c26cceb5fe67

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2ecfb8e-b12f-42be-af49-9df0dbf66c81

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b01341a2-dacf-4780-acf9-3325f8597409

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b4b6fec9-3f56-4571-9555-344cea28e667

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1574.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8434ee2-f60f-48c4-a2d5-2576257a8387

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9768a3e-1556-488e-8a9e-55389fd1752e

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--da8b2bcf-c952-4076-8e45-b18572f49ae9

Lunghi Iron Tiger Linux

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dd2ef18a-1072-4f5b-a360-a01017b421e2

Lunghi Iron Tiger Linux · Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e28c174a-33d6-4fef-989f-7c58d0fb770d

Lunghi Iron Tiger Linux

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e7fd3986-ae47-4301-9299-a3f8be437d03

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ef41cf60-c60d-4c1f-aa2c-ee9cc73641f4

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f837c70e-984e-4681-ab3a-0ad4ad1a512f

Trend Micro Iron Tiger April 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.