PHASEJAM
Software · ATTACK:enterprise:S9014
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S9014",
"title": "PHASEJAM",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S9014",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--ca3f5123-b853-45ef-83cb-1d1bca22e03f",
"external_id": "S9014",
"domain": "enterprise",
"created": "2026-04-16T13:59:06.123Z",
"modified": "2026-05-12T15:12:00.739Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Dragos SYLVANITE MuddyWater Electrum March 2026",
"url": "https://hub.dragos.com/hubfs/2026_YIR_ExecutiveBriefing%20O_G.pdf?hsLang=en"
},
{
"source_name": "Google UNC5221 Ivanti January 2025",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day"
}
]
}Explicit source assertions (15)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S9014 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--08057a27-6711-4956-8a27-739ad26a2883
Google UNC5221 Ivanti January 2025ATTACK:enterprise:S9014 → uses → ATTACK:enterprise:T1489
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1bc748d4-6776-4bb4-a5ab-0bb8ac3dfab4
Google UNC5221 Ivanti January 2025ATTACK:enterprise:S9014 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--243b5790-ce5b-45cb-80d0-55944a7e3b53
Google UNC5221 Ivanti January 2025ATTACK:enterprise:S9014 → uses → ATTACK:enterprise:T1036.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--36eb9498-c6eb-4cdc-bbb0-274135fe03a1
Google UNC5221 Ivanti January 2025ATTACK:enterprise:S9014 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3eb12364-62c6-4b47-822b-079a939a6d83
Google UNC5221 Ivanti January 2025ATTACK:enterprise:S9014 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b6f9849-261f-4b4a-9455-d526da22fb8e
Google UNC5221 Ivanti January 2025ATTACK:enterprise:S9014 → uses → ATTACK:enterprise:T1565
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--554b31d4-2294-44aa-af5b-99a106a59cc9
Google UNC5221 Ivanti January 2025ATTACK:enterprise:S9014 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66bc82ff-8773-4ebb-97af-445fad41cd17
Google UNC5221 Ivanti January 2025ATTACK:enterprise:S9014 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--761a260b-5392-43a9-94fe-249ad77b75db
Google UNC5221 Ivanti January 2025ATTACK:enterprise:S9014 → uses → ATTACK:enterprise:T1505.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8241e670-5d1a-4091-9ad0-99792d1dfe5b
Google UNC5221 Ivanti January 2025ATTACK:enterprise:S9014 → uses → ATTACK:enterprise:T1685.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--af446864-1b82-4ea7-86af-16b983ce9005
Google UNC5221 Ivanti January 2025ATTACK:enterprise:S9014 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5e67d75-31f0-4cdd-a75d-17a32b455dde
Google UNC5221 Ivanti January 2025ATTACK:enterprise:S9014 → uses → ATTACK:enterprise:T1546.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e198f9cc-a750-4fb7-a49e-bf440af377e1
Google UNC5221 Ivanti January 2025ATTACK:enterprise:S9014 → uses → ATTACK:enterprise:T1059.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e47457bf-aa6a-414c-89df-78b442e116dc
Google UNC5221 Ivanti January 2025ATTACK:enterprise:S9014 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e8f8c497-9931-4b8d-ad46-31a1cf5e2c50
Google UNC5221 Ivanti January 2025