AshTag
Software · ATTACK:enterprise:S9031
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S9031",
"title": "AshTag",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S9031",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--bb6f2a5c-dbc9-45b0-bd3f-a0b7849959c2",
"external_id": "S9031",
"domain": "enterprise",
"created": "2026-04-20T14:04:02.153Z",
"modified": "2026-05-12T15:12:00.739Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Palo Alto Ashen Lepus DEC 2025",
"url": "https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"
}
]
}Explicit source assertions (20)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00cd22e3-0291-45e8-9d05-e3243f5d9eee
Palo Alto Ashen Lepus DEC 2025ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--08a444cf-9159-4f35-aa4a-691a434940e5
Palo Alto Ashen Lepus DEC 2025ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1395dbee-5ed2-45d4-a807-19fb707e9dab
Palo Alto Ashen Lepus DEC 2025ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1fb7af43-604f-4ef7-9594-a61fa7f1d9bc
Palo Alto Ashen Lepus DEC 2025ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24edc813-1a52-47ae-9068-7423c0052a43
Palo Alto Ashen Lepus DEC 2025ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1102
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b39f6fb-691a-41ba-ae56-9c2ec45b70d0
Palo Alto Ashen Lepus DEC 2025ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--308a7f8c-dd36-4567-9cd9-1f8232c45750
Palo Alto Ashen Lepus DEC 2025ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--46bc2bac-2b9f-4550-bd2f-9d62ef05b887
Palo Alto Ashen Lepus DEC 2025ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4ac9f066-58e8-4e8d-bfaa-12520294885c
Palo Alto Ashen Lepus DEC 2025ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--679cc96f-ac4f-46c9-8948-307b8f9f6110
Palo Alto Ashen Lepus DEC 2025ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--715f0217-bc9b-4403-90f3-dbe00e558164
Palo Alto Ashen Lepus DEC 2025ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b695677-86d7-4de6-bce7-970ac2207d77
Palo Alto Ashen Lepus DEC 2025ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a5db1eaf-094d-498f-b7bd-3701025a2987
Palo Alto Ashen Lepus DEC 2025ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b2cbfcbd-5200-41ef-9338-ac9b0b0eb9df
Palo Alto Ashen Lepus DEC 2025ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b73877db-8456-4a79-85c0-1a02d74a0300
Palo Alto Ashen Lepus DEC 2025ATTACK:enterprise:G0090 → uses → ATTACK:enterprise:S9031
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf5a0f65-6c48-4e94-beed-ce4bcccac38a
Palo Alto Ashen Lepus DEC 2025ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dd78a0f9-98c4-4074-8fce-4bef68d53f14
Palo Alto Ashen Lepus DEC 2025ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e92df95b-ac85-4926-9b6a-957b342d47ec
Palo Alto Ashen Lepus DEC 2025ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f1c35f20-cd82-4ecb-b958-c6abc86d9dc4
Palo Alto Ashen Lepus DEC 2025ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fdf235f6-3ecc-4b78-bc6b-90dc0e922efd
Palo Alto Ashen Lepus DEC 2025