HexEval Loader
Software · ATTACK:enterprise:S1249
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1249",
"title": "HexEval Loader",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1249",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--3d7048f1-012e-468c-a18b-1bf98037d62c",
"external_id": "S1249",
"domain": "enterprise",
"created": "2025-10-22T20:27:28.937Z",
"modified": "2025-10-24T02:56:50.170Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Socket Contagious Interview NPM April 2025",
"url": "https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket"
},
{
"source_name": "Socket BeaverTail XORIndex HexEval Contagious Interview July 2025",
"url": "https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"
},
{
"source_name": "Socket HexEval BeaverTail Contagious Interview June 2025",
"url": "https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"
}
]
}Explicit source assertions (13)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1249 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01933b06-956c-4f09-9dcc-e7c6b672dc94
Socket HexEval BeaverTail Contagious Interview June 2025ATTACK:enterprise:S1249 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--28636e59-9685-4b10-8364-11d8f38d6945
Socket HexEval BeaverTail Contagious Interview June 2025ATTACK:enterprise:S1249 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2dc59875-4281-45f2-acfb-5e36428e812d
Socket Contagious Interview NPM April 2025 · Socket BeaverTail XORIndex HexEval Contagious Interview July 2025 · Socket HexEval BeaverTail Contagious Interview June 2025ATTACK:enterprise:S1249 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65dfb984-a7b3-4da0-90d0-20d61eb0e828
Socket Contagious Interview NPM April 2025 · Socket HexEval BeaverTail Contagious Interview June 2025ATTACK:enterprise:S1249 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78f97a32-3e52-4929-8017-3503642d452c
Socket Contagious Interview NPM April 2025 · Socket HexEval BeaverTail Contagious Interview June 2025ATTACK:enterprise:S1249 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8c489325-6180-4c45-8658-00ef76443459
Socket HexEval BeaverTail Contagious Interview June 2025ATTACK:enterprise:S1249 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a5e4292c-10a8-4932-86ec-1b98b96660f1
Socket Contagious Interview NPM April 2025 · Socket HexEval BeaverTail Contagious Interview June 2025ATTACK:enterprise:S1249 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a7149564-023f-4746-925d-fd10bb1069a9
Socket Contagious Interview NPM April 2025 · Socket HexEval BeaverTail Contagious Interview June 2025ATTACK:enterprise:S1249 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--adba082d-7e17-44a4-82fb-c2d35997724b
Socket HexEval BeaverTail Contagious Interview June 2025ATTACK:enterprise:S1249 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ae152041-a294-499e-8f7b-4bc2b3722aba
Socket HexEval BeaverTail Contagious Interview June 2025ATTACK:enterprise:S1249 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bbd36013-56f4-45fc-a46b-4721c06e8454
Socket Contagious Interview NPM April 2025 · Socket BeaverTail XORIndex HexEval Contagious Interview July 2025 · Socket HexEval BeaverTail Contagious Interview June 2025ATTACK:enterprise:S1249 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c0b37fb2-6a19-40cf-bb18-a7289e235398
Socket Contagious Interview NPM April 2025 · Socket BeaverTail XORIndex HexEval Contagious Interview July 2025 · Socket HexEval BeaverTail Contagious Interview June 2025ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:S1249
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fd85679a-eee9-4795-b841-59b203740610
Socket Contagious Interview NPM April 2025 · Socket BeaverTail XORIndex HexEval Contagious Interview July 2025 · Socket HexEval BeaverTail Contagious Interview June 2025