Amadey
Software · ATTACK:enterprise:S1025
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1025",
"title": "Amadey",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1025",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--05318127-5962-444b-b900-a9dcfe0ff6e9",
"external_id": "S1025",
"domain": "enterprise",
"created": "2022-07-14T17:30:54.927Z",
"modified": "2026-05-12T15:12:00.732Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Korean FSI TA505 2020",
"url": "https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="
},
{
"source_name": "BlackBerry Amadey 2020",
"url": "https://blogs.blackberry.com/en/2020/01/threat-spotlight-amadey-bot"
}
]
}Explicit source assertions (19)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--062059e8-21cb-4030-8244-ce7f6643e3c9
Korean FSI TA505 2020ATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1793516c-a4dd-4726-9bb3-c3b2bbecc605
BlackBerry Amadey 2020ATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1568.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d91840d-b419-4d9f-9bba-8a9f18728854
Korean FSI TA505 2020ATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--240b044f-89b4-4009-bbf6-04b1f0bb6385
Korean FSI TA505 2020 · BlackBerry Amadey 2020ATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26818c78-7042-4493-a94b-eec0d7b9972a
BlackBerry Amadey 2020ATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3685caad-4ab6-42e8-888d-e7619006dd04
BlackBerry Amadey 2020ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:S1025
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3801ca96-eb84-4edf-b51f-fa324d7c338c
Mandiant APT43 March 2024ATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--52fb33e7-e53c-4d1f-b052-d3e373a64672
BlackBerry Amadey 2020ATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1553.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a402933-faba-4de0-a7a5-3b44761cc062
Korean FSI TA505 2020ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S1025
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f533903-39c5-4463-a0f6-8017fc6b10ab
Korean FSI TA505 2020 · BlackBerry Amadey 2020ATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2b97730-39f9-4ba6-b481-d27f883ff26f
BlackBerry Amadey 2020ATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6904fd0-d121-4b26-b05c-1615e3baf599
Korean FSI TA505 2020 · BlackBerry Amadey 2020ATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c2c31b26-7e42-43b6-964b-c959cabc53a4
BlackBerry Amadey 2020ATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf58d726-7674-4cdc-9ce1-9d7364aa4a0d
Korean FSI TA505 2020 · BlackBerry Amadey 2020ATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d850589b-a36f-446e-9864-ae4d4a62b724
Korean FSI TA505 2020ATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9a670e7-9076-4a4f-8861-981bb04b946f
BlackBerry Amadey 2020ATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2c08481-c9ad-4929-b470-afd2df7233ed
BlackBerry Amadey 2020ATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e601ccd0-3b36-4ef9-b2de-9784539ecb75
BlackBerry Amadey 2020ATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff0d8483-0568-48c5-b380-22ed06ac01ed
BlackBerry Amadey 2020