aol.pm

Donut

Software · ATTACK:enterprise:S0695

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:S0695",
  "title": "Donut",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0695",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "tool--a7b5df47-73bb-4d47-b701-869f185633a6",
  "external_id": "S0695",
  "domain": "enterprise",
  "created": "2022-03-25T13:35:46.781Z",
  "modified": "2025-04-16T20:38:54.932Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "NCC Group WastedLocker June 2020",
      "url": "https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/"
    },
    {
      "source_name": "Introducing Donut",
      "url": "https://thewover.github.io/Introducing-Donut/"
    },
    {
      "source_name": "Donut Github",
      "url": "https://github.com/TheWover/donut"
    }
  ]
}

Explicit source assertions (17)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07f86f87-71bf-4f6b-b902-e6e4d912e2d6

Donut Github

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15b1bc2a-4cd1-4b82-90b0-2aa6e69637c7

Donut Github

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c6c5572-9b89-40cd-8faa-6317945cf939

Donut Github

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1059

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34351a4f-ea7c-4420-9063-1d8644073ea7

Donut Github

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--415b6755-70d1-433c-b076-3598dcaa9c7d

Donut Github

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44b10433-b9b4-46d1-825b-6fe4183dc9c0

Donut Github

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59945377-5b77-4267-ae36-9feebccc42f3

Donut Github

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60d3d7d8-408e-4663-b081-69fe66303983

Donut Github

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--717079c0-7f34-42f6-927f-9ee321447c13

Donut Github

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:S0695

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e2dcce1-8fde-4f88-9e48-13a736c694e3

NCC Group WastedLocker June 2020

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1059.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8be670ce-f8bd-4f67-9f84-3e278235325a

Donut Github

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a107acee-85a7-475c-bb99-c12a379ef2dc

Donut Github

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7cba2fb-a90f-4dd1-ae33-3747d5a9c873

Donut Github

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad52caca-b930-49ad-948c-4ffba6a70e1e

Donut Github

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bdc8d4d8-c0be-4de3-853b-512c6ccb2dcb

Donut Github

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bec1b07a-6a67-469e-8b87-246e950d86b2

Donut Github

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c720f9ab-106c-47ce-b327-83727be6d35a

Donut Github

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.