Pandora
Software · ATTACK:enterprise:S0664
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0664",
"title": "Pandora",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0664",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--a545456a-f9a7-47ad-9ea6-8b017def38d1",
"external_id": "S0664",
"domain": "enterprise",
"created": "2021-11-29T19:53:06.360Z",
"modified": "2025-04-16T20:38:28.723Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Trend Micro Iron Tiger April 2021",
"url": "https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"
}
]
}Explicit source assertions (15)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0664 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0110e04e-5812-4b69-9700-037b52d3ebb4
Trend Micro Iron Tiger April 2021ATTACK:enterprise:S0664 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16d95f0d-fc05-4012-a1a0-35d7261b7f27
Trend Micro Iron Tiger April 2021ATTACK:enterprise:S0664 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b418159-e33b-407e-9849-1ebeddaa4074
Trend Micro Iron Tiger April 2021ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:S0664
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24baf6e9-5d36-4503-a1c5-99b91220ed5b
Sygnia Emperor Dragonfly October 2022 · SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022 · Microsoft Ransomware as a Service · Dell SecureWorks BRONZE STARLIGHT ProfileATTACK:enterprise:S0664 → uses → ATTACK:enterprise:T1068
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c60473c-6195-4aa1-ae10-394bb5f24cf1
Trend Micro Iron Tiger April 2021ATTACK:enterprise:S0664 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--60331850-dfc3-4769-9790-1be664aa63c2
Trend Micro Iron Tiger April 2021ATTACK:enterprise:S0664 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6eb2e346-3ac0-42a8-ad9a-d6e336eaf86a
Trend Micro Iron Tiger April 2021ATTACK:enterprise:S0664 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a78758b-9dce-4d13-9b8a-ddc9b31d4ff7
Trend Micro Iron Tiger April 2021ATTACK:enterprise:S0664 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f27fb1d-f888-4167-a08c-781dde29755d
Trend Micro Iron Tiger April 2021ATTACK:enterprise:S0664 → uses → ATTACK:enterprise:T1027.015
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93efb013-dab0-4b47-ac2c-0632ac2fea18
Trend Micro Iron Tiger April 2021ATTACK:enterprise:S0664 → uses → ATTACK:enterprise:T1569.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a55e0219-f440-4523-9bfa-00c562824005
Trend Micro Iron Tiger April 2021ATTACK:enterprise:S0664 → uses → ATTACK:enterprise:T1553.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d12d7d29-5616-4c87-9fd0-6375fc9c269d
Trend Micro Iron Tiger April 2021ATTACK:enterprise:S0664 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dbcbedb9-5527-4ab9-97e7-1ed65571aee9
Trend Micro Iron Tiger April 2021ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0664
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec9574b7-95ec-4d84-b468-164e918bbffd
Trend Micro Iron Tiger April 2021ATTACK:enterprise:S0664 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff495a54-08f1-4b0f-b44d-6bbeb5240225
Trend Micro Iron Tiger April 2021