Brute Ratel C4
Software · ATTACK:enterprise:S1063
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1063",
"title": "Brute Ratel C4",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1063",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "tool--75d8b521-6b6a-42ff-8af3-d97e20ce12a5",
"external_id": "S1063",
"domain": "enterprise",
"created": "2023-02-07T20:26:58.792Z",
"modified": "2024-09-19T15:46:58.008Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "BRc4"
},
{
"source_name": "MDSec Brute Ratel August 2022",
"url": "https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/"
},
{
"source_name": "Dark Vortex Brute Ratel C4",
"url": "https://bruteratel.com/"
},
{
"source_name": "Palo Alto Brute Ratel July 2022",
"url": "https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"
},
{
"source_name": "Trend Micro Black Basta October 2022",
"url": "https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html"
},
{
"source_name": "SANS Brute Ratel October 2022",
"url": "https://www.sans.org/blog/cracked-brute-ratel-c4-framework-proliferates-across-the-cybercriminal-underground/"
}
]
}Explicit source assertions (33)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1055.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06e74d66-012f-4615-9597-50c5fff9b036
Rapid7 Fake W2 July 2024ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1569.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21c271aa-7bdd-44ea-afd0-ca3f542ee425
Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--275a2606-3eee-4c11-8a97-300b58f49d60
Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1021.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c40e9a1-72fd-4c7d-8a69-df574c54441e
Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f8e76b5-603e-4557-8635-465d988a4072
Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--58be00f9-baaf-40d7-973f-3f38bc7322b9
Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--58d4910f-9d51-4961-84eb-9ef0ee2e8bc3
MDSec Brute Ratel August 2022 · Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d5077b6-4490-4762-8b8f-ba4e0655ec67
Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67e631d1-439f-4630-9662-8ea74ab10234
Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1021.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ecd51f2-d57d-4daa-a98f-764b9b3ddac1
MDSec Brute Ratel August 2022 · Dark Vortex Brute Ratel C4 · Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--767e6737-fcf8-48ae-a6a3-045c9a03b0e2
Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ee1407c-ee33-47bc-824a-6f0dcd385462
Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80cbc348-7246-418a-8b25-e112408a498b
Trend Micro Black Basta October 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8121e11c-6bd7-4b4a-8072-bb9622e6627c
Palo Alto Brute Ratel July 2022 · Trend Micro Black Basta October 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--81e6eb4d-4a94-4416-8a45-b54e9cafda9d
Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--84adaf9e-12f6-4c68-9ef6-a860715d0aaf
MDSec Brute Ratel August 2022 · Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1036.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93ae2467-4192-4e69-a63a-00ca8cb055c2
Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--959c7695-01a5-4be1-9951-799749796cf4
Palo Alto Brute Ratel July 2022 · Trend Micro Black Basta October 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9a340fa8-70c5-4bf6-a8c2-6e28e3fc8b59
Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1620
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b7f7aab-6ee4-4205-bd25-39cd63216777
MDSec Brute Ratel August 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1046
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ee893d7-f87e-4d2e-a440-4ba9cb3a3561
Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1482
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4e9aaf6-2c02-45cf-9603-090d65cd8c37
Palo Alto Brute Ratel July 2022 · Trend Micro Black Basta October 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b323db77-6bbf-4020-ac48-bee625dd44f2
MDSec Brute Ratel August 2022 · Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1102
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c1b5996f-e0f9-4986-9ee1-c5c9dc85d8e5
Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4014fde-9d6e-4605-a143-36556a280249
Palo Alto Brute Ratel July 2022 · Trend Micro Black Basta October 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d661c7eb-11bb-4ef4-804e-665cc361789c
Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d723027c-349b-48f8-af77-808ee2f7d92f
Rapid7 Fake W2 July 2024 · Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1027.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db7db901-6b19-4cd2-9d22-17b5703bbf7f
Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dec02920-c2d1-4340-a503-f6a38ae0b0f7
MDSec Brute Ratel August 2022 · Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f318a490-68df-41ee-864e-8611be36c442
Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1558.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fb20c1f3-aa1e-49f3-9793-e07e0d430f5d
Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fef97c89-06fe-4def-b58b-5dafd9ff925d
Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff274d3e-584d-4c50-8262-185630017502
Palo Alto Brute Ratel July 2022 · Trend Micro Black Basta October 2022