CharmPower
Software · ATTACK:enterprise:S0674
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0674",
"title": "CharmPower",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0674",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--7acb15b6-fe2c-4319-b136-6ab36ff0b2d4",
"external_id": "S0674",
"domain": "enterprise",
"created": "2022-01-24T16:56:36.108Z",
"modified": "2025-06-06T14:12:30.197Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Check Point APT35 CharmPower January 2022",
"url": "https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"
}
]
}Explicit source assertions (25)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0167fba6-d37d-46ba-bb07-5fc70b864b3f
Check Point APT35 CharmPower January 2022ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0586324a-680a-46a4-917b-8c00c7211065
Check Point APT35 CharmPower January 2022ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17317bb7-40a1-47a0-8200-c89df3a339b2
Check Point APT35 CharmPower January 2022ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1048.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--37d0c8b8-0b5e-4da5-bd35-5265b8f9d390
Check Point APT35 CharmPower January 2022ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39cf6431-f800-4911-8434-49ce1b2874f1
Check Point APT35 CharmPower January 2022ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--45f7f495-2de8-4f78-87ec-14201cfc1d46
Check Point APT35 CharmPower January 2022ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--48d24989-916a-46ba-b5ea-b3db838a3ae0
Check Point APT35 CharmPower January 2022ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:S0674
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--501cd276-7cb4-40a6-b8be-d6cc6d743edc
Check Point APT35 CharmPower January 2022ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1102.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--50bd8457-3c13-483d-a647-cee4f554d490
Check Point APT35 CharmPower January 2022ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--74754640-5989-43de-9fab-5a986d9fc8f5
Check Point APT35 CharmPower January 2022ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1016.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a6e6555-80e9-4721-b72c-8cebc2a53dab
Check Point APT35 CharmPower January 2022ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--872a8c48-765c-446e-a321-9a80116f8599
Check Point APT35 CharmPower January 2022ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--90fc37c2-19cc-450d-ba0b-5c4a3c9039b3
Check Point APT35 CharmPower January 2022ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93598e52-cf96-4f8a-b4e2-3dab9aa6ddee
Check Point APT35 CharmPower January 2022ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--94a1fe68-4c8f-48ca-b186-feca5f800f46
Check Point APT35 CharmPower January 2022ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6175b80-3f45-4d17-9e00-67f32b973ea4
Check Point APT35 CharmPower January 2022ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1102
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a99df039-f5ee-4060-b3ba-b1224acee970
Check Point APT35 CharmPower January 2022ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab1b59f1-8629-48f4-ae9f-a18042122cb8
Check Point APT35 CharmPower January 2022ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ac5925ff-04f9-416e-b83b-d70392ef9282
Check Point APT35 CharmPower January 2022ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c7ef866c-18f8-485e-99d2-78b7e48576d8
Check Point APT35 CharmPower January 2022ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dde11422-660a-42b1-b231-fb2fd98ed644
Check Point APT35 CharmPower January 2022ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e0a7e8ca-a199-4909-a4da-302bcc6216e6
Check Point APT35 CharmPower January 2022ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e550d34c-3828-416b-92ec-a7a6f9524823
Check Point APT35 CharmPower January 2022ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ef8154b8-b6d3-493f-9bf5-1d5c147108bc
Check Point APT35 CharmPower January 2022ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f1183695-42c7-4d17-81b3-18d3fdd8822a
Check Point APT35 CharmPower January 2022