Skip to content

StarProxy

Software · ATTACK:enterprise:S1227

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S1227",
  "title": "StarProxy",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S1227",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--e91d3543-ca5d-474b-8b20-5a753ebc6e49",
  "external_id": "S1227",
  "domain": "enterprise",
  "created": "2025-07-21T20:08:20.983Z",
  "modified": "2025-10-21T22:47:13.304Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Zscaler",
      "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"
    }
  ]
}

Explicit source assertions (10)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1227 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0618bd56-0ca0-4750-ac4e-ab6fa475298c

ATTACK:enterprise:S1227 → uses → ATTACK:enterprise:T1574.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29912e12-89f8-4e82-9ebd-2cbb276ed995

ATTACK:enterprise:S1227 → uses → ATTACK:enterprise:T1059

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29ff7a09-f6d2-4a3a-a851-c9054e5fe9f8

ATTACK:enterprise:S1227 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--354a4208-0d17-47ab-bf0d-8611c5ad23e5

ATTACK:enterprise:S1227 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62c26c33-a177-4ab6-b070-6157c3528b9e

ATTACK:enterprise:S1227 → uses → ATTACK:enterprise:T1124

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e9690c6-f3d0-476a-969e-9d56e12c8b95

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:S1227

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bf522329-9ecb-4674-aa88-9ca94f26dda9

ATTACK:enterprise:S1227 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db355151-5333-430e-8cb9-421bc688f874

ATTACK:enterprise:S1227 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e98a8ed8-24eb-4390-b528-5e023eafe69e

ATTACK:enterprise:S1227 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc61d659-2c80-4148-92ff-b689093a49b2

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.