SUGARDUMP
Software · ATTACK:enterprise:S1042
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1042",
"title": "SUGARDUMP",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1042",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--9c10cede-c0bb-4c5c-91c0-8baec30abaf6",
"external_id": "S1042",
"domain": "enterprise",
"created": "2022-09-21T21:02:02.388Z",
"modified": "2025-04-16T20:38:26.373Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Mandiant UNC3890 Aug 2022",
"url": "https://www.mandiant.com/resources/blog/suspected-iranian-actor-targeting-israeli-shipping"
}
]
}Explicit source assertions (14)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0010 → uses → ATTACK:enterprise:S1042
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--078ceddf-b534-4e33-acf8-8181adb249f2
Mandiant UNC3890 Aug 2022ATTACK:enterprise:S1042 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--12e62986-c406-4767-9cc5-49d05c5c34b7
Mandiant UNC3890 Aug 2022ATTACK:enterprise:S1042 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1f552cc5-66fe-44a6-8881-8e127fc5c0f0
Mandiant UNC3890 Aug 2022ATTACK:enterprise:S1042 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2211dd80-6ab2-4d3b-90fd-3ae19e75b64f
Mandiant UNC3890 Aug 2022ATTACK:enterprise:S1042 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2913137b-33ce-4488-a274-25fc9198d693
Mandiant UNC3890 Aug 2022ATTACK:enterprise:S1042 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f8394e6-2cf2-473a-b60a-6de2e69c39c8
Mandiant UNC3890 Aug 2022ATTACK:enterprise:S1042 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--59e2e811-8f23-40bc-ae20-040feb1fa1fe
Mandiant UNC3890 Aug 2022ATTACK:enterprise:S1042 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b4d7467-8418-42c8-bb6f-ad275fc7fb40
Mandiant UNC3890 Aug 2022ATTACK:enterprise:S1042 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--89bcfd5b-376a-4191-9b49-553001df844f
Mandiant UNC3890 Aug 2022ATTACK:enterprise:S1042 → uses → ATTACK:enterprise:T1217
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a0020049-7688-4c0a-8844-dece3bed614c
Mandiant UNC3890 Aug 2022ATTACK:enterprise:S1042 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d3d7c2a6-33ae-460d-a759-e3f755264d0e
Mandiant UNC3890 Aug 2022ATTACK:enterprise:S1042 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--da62e1f0-d49d-40ed-b983-fcfaaacb42f5
Mandiant UNC3890 Aug 2022ATTACK:enterprise:S1042 → uses → ATTACK:enterprise:T1071.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db937076-3d30-471f-ad39-9565d61b614f
Mandiant UNC3890 Aug 2022ATTACK:enterprise:S1042 → uses → ATTACK:enterprise:T1560.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e7c29485-c988-4313-8081-60241abe1178
Mandiant UNC3890 Aug 2022