Skip to content

Vidar

Software · ATTACK:enterprise:S9050

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S9050",
  "title": "Vidar",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S9050",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--947119be-4875-49aa-8247-776c34233063",
  "external_id": "S9050",
  "domain": "enterprise",
  "created": "2026-09-11T19:05:30.171Z",
  "modified": "2026-09-23T18:54:28.219Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "CyberAus_Vidar_May2026",
      "url": "https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/clickfix-distributing-vidar-stealer-via-wordpress-targeting-australian-infrastructure"
    },
    {
      "source_name": "CISA Scattered Spider Advisory November 2023",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"
    },
    {
      "source_name": "Cyfirma_Vidar_June2024",
      "url": "https://www.cyfirma.com/research/vidar-stealer-an-in-depth-analysis-of-an-information-stealing-malware/"
    },
    {
      "source_name": "Intrinsec_Vidar_April2026",
      "url": "https://www.intrinsec.com/wp-content/uploads/2026/04/TLP_CLEAR-20260424-New_Vidar.pdf"
    },
    {
      "source_name": "LevelBlue_Vidar_May2026",
      "url": "https://www.levelblue.com/blogs/spiderlabs-blog/unmasking-a-multi-stage-loader-autoit-abuse-leading-to-vidar-stealer-command-and-control-communication"
    },
    {
      "source_name": "Logpoint_StealerMalwareFamilies_2024",
      "url": "https://web.archive.org/web/20240517205011/https://www.logpoint.com/wp-content/uploads/2024/03/logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families-1.pdf"
    },
    {
      "source_name": "Unit42_Vidar_July2026",
      "url": "https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/"
    },
    {
      "source_name": "QuorumCyber_Vidar_March2023",
      "url": "https://www.quorumcyber.com/wp-content/uploads/2023/01/Malware-Analysis-Vidar.pdf"
    }
  ]
}

Explicit source assertions (54)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01c3b4b5-a4db-415b-8628-98491f799a0a

Logpoint_StealerMalwareFamilies_2024

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--044701e4-2c5c-4574-8ac7-1d9034dff4d6

Cyfirma_Vidar_June2024

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--047f365d-28bd-4db5-96a2-408b97a42c32

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1204.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08271537-bd35-4141-a49e-c9c2efe09bed

CyberAus_Vidar_May2026

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b9a6189-858f-4f49-952a-21075b860dc6

Logpoint_StealerMalwareFamilies_2024

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--177888f1-a326-4642-98c3-66aa91ef18dd

Cyfirma_Vidar_June2024

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24b6a0ed-7c56-4dfa-be1b-97388f7a0bb1

Intrinsec_Vidar_April2026 · LevelBlue_Vidar_May2026

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1566.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36d41ebe-3a33-46f3-927b-42110fc2df1d

QuorumCyber_Vidar_March2023

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1622

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ab5dbba-b0a5-4973-95c0-2d8af10701c5

Cyfirma_Vidar_June2024

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1071.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d719505-cb0d-4dc4-8f23-fee0577a6359

LevelBlue_Vidar_May2026

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e6dde99-59d7-4ebe-81cc-db84596ec7a2

Logpoint_StealerMalwareFamilies_2024

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--455b15b7-bd32-48dd-a15f-3b9e4f8af928

QuorumCyber_Vidar_March2023

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4609386c-f8e8-44d8-828c-ce33cef129ba

Cyfirma_Vidar_June2024 · Logpoint_StealerMalwareFamilies_2024

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b1b5089-7ef9-41d3-bb2a-25dff50a369c

Cyfirma_Vidar_June2024 · Intrinsec_Vidar_April2026 · Unit42_Vidar_July2026 · QuorumCyber_Vidar_March2023

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f918e2b-d89f-4cf1-8180-ef83b2674f10

QuorumCyber_Vidar_March2023

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72895ca2-baea-4333-959c-0a0f9a97dbd5

Cyfirma_Vidar_June2024 · Unit42_Vidar_July2026

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:S9050

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7abbf832-9ec7-45b2-98c8-e3dff4e6993e

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1614

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d2f007d-a013-4637-b7f0-8d73c39361b4

Cyfirma_Vidar_June2024 · Unit42_Vidar_July2026

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1124

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80d83fb7-2511-43cc-833a-6be1825a41ed

Cyfirma_Vidar_June2024

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--831f94bf-0808-40c9-b00d-41ae29e832fd

CyberAus_Vidar_May2026 · LevelBlue_Vidar_May2026 · Logpoint_StealerMalwareFamilies_2024

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88f01e5a-26ce-4864-9402-bfaaf08dab61

LevelBlue_Vidar_May2026

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8bec8f38-d820-43f5-a86a-63f3bda0ab86

CyberAus_Vidar_May2026 · Cyfirma_Vidar_June2024 · Logpoint_StealerMalwareFamilies_2024

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e8730bf-a7cd-4c35-9c6a-ae34552fe59c

Logpoint_StealerMalwareFamilies_2024

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9021cef7-4b93-443c-a166-20a659fb6b56

Cyfirma_Vidar_June2024

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1055.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--902cdd3b-d69a-422f-b002-d7ab6bb2e89c

Cyfirma_Vidar_June2024

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90f5c230-407d-45ba-85db-44cd3ecea06d

Cyfirma_Vidar_June2024 · Logpoint_StealerMalwareFamilies_2024 · Unit42_Vidar_July2026

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a074c7b9-52f4-4fa4-b8df-74d0ed6ee430

Cyfirma_Vidar_June2024 · Intrinsec_Vidar_April2026 · LevelBlue_Vidar_May2026 · Unit42_Vidar_July2026

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4f5c455-7dd0-466d-8b58-b347bfadd09f

QuorumCyber_Vidar_March2023

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa99d075-7455-49bb-badb-6300ffe9265f

Cyfirma_Vidar_June2024 · Logpoint_StealerMalwareFamilies_2024

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b3e2d8aa-99f1-4e02-8547-769837edfbe1

QuorumCyber_Vidar_March2023

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b880fc5d-236d-44b5-90ec-46ce43c330ed

Cyfirma_Vidar_June2024 · Logpoint_StealerMalwareFamilies_2024 · Unit42_Vidar_July2026 · QuorumCyber_Vidar_March2023

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bbeb5b3a-3533-4252-9c81-3cc027ba8b20

Intrinsec_Vidar_April2026

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be16ecaf-46a6-4602-8d7e-0273c9983520

Cyfirma_Vidar_June2024 · Intrinsec_Vidar_April2026 · LevelBlue_Vidar_May2026 · Unit42_Vidar_July2026 · QuorumCyber_Vidar_March2023

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c0d5dbce-41bf-4b6a-ad07-a9c39b8ed6fa

QuorumCyber_Vidar_March2023

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1b5e582-0b85-430a-a7a5-310fff2b7bdf

CyberAus_Vidar_May2026 · Cyfirma_Vidar_June2024 · Intrinsec_Vidar_April2026 · LevelBlue_Vidar_May2026 · Logpoint_StealerMalwareFamilies_2024 · QuorumCyber_Vidar_March2023

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c2fce712-7e7e-428b-a17e-bd46a3f24f68

Cyfirma_Vidar_June2024

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1497.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c85195a1-97ac-4683-b9da-cbd273ec9cbe

LevelBlue_Vidar_May2026 · QuorumCyber_Vidar_March2023

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1222.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cae47584-546f-4d3a-9aef-18775b8c8064

QuorumCyber_Vidar_March2023

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc3e8998-6bb1-4e18-a2a4-f4ae1ccba3fe

Logpoint_StealerMalwareFamilies_2024 · Unit42_Vidar_July2026

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf17f2d1-c9f3-4087-9a9e-3a5268e6f5e8

Logpoint_StealerMalwareFamilies_2024

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d1323d9f-fcaa-4f41-84c2-ce0cac5cc13b

Logpoint_StealerMalwareFamilies_2024 · Unit42_Vidar_July2026 · QuorumCyber_Vidar_March2023

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d4d7bda4-83fa-4cff-8842-f1b058cafe25

Intrinsec_Vidar_April2026

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dc813360-db9a-4de2-883c-a9e0b5e959fa

Cyfirma_Vidar_June2024

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de740ec2-5915-42c6-81de-9b308ccdab84

Logpoint_StealerMalwareFamilies_2024 · QuorumCyber_Vidar_March2023

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e1034190-fc61-495d-9510-21ae85762173

Intrinsec_Vidar_April2026 · Logpoint_StealerMalwareFamilies_2024 · Unit42_Vidar_July2026 · QuorumCyber_Vidar_March2023

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1036.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eb103b5c-b65b-4214-8d2d-cd2fc066a146

Intrinsec_Vidar_April2026 · QuorumCyber_Vidar_March2023

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1c37a4a-bcfe-4626-94bb-749112023a44

QuorumCyber_Vidar_March2023

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f7d6b2a3-8f82-4c06-8be0-a7131ccac4bc

QuorumCyber_Vidar_March2023

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1543

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f83dbb6c-a680-427a-a425-d1310831f36a

Cyfirma_Vidar_June2024

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f8e92dfb-d6c2-42bc-a56c-19f690d9b957

Logpoint_StealerMalwareFamilies_2024

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc7fe40a-f60e-466c-81e8-7f85acfe31d7

Unit42_Vidar_July2026

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc9fa601-b91b-45fe-9872-9bdef13f6e7b

Cyfirma_Vidar_June2024 · Logpoint_StealerMalwareFamilies_2024

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1574.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd517b0b-fd57-4d9a-a4e1-47cd7d4f0d11

Intrinsec_Vidar_April2026

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff9ae60d-7d27-4fa9-9019-3f906307ec1d

Cyfirma_Vidar_June2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.