Skip to content

Data from Local System

Technique · ATTACK:enterprise:T1005

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1005",
  "title": "Data from Local System",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1005",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
  "external_id": "T1005",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:20.537Z",
  "modified": "2026-09-11T19:59:22.966Z",
  "version": "1.8",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "show_run_config_cmd_cisco",
      "url": "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/show_protocols_through_showmon.html#wp2760878733"
    },
    {
      "source_name": "Mandiant APT41 Global Intrusion ",
      "url": "https://www.mandiant.com/resources/apt41-initiates-global-intrusion-campaign-using-multiple-exploits"
    },
    {
      "source_name": "US-CERT-TA18-106A",
      "url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
    }
  ]
}

Explicit source assertions (237)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1196 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02d10890-fd0d-4196-bb45-16f353085f79

S2W Troll Stealer 2024 · Symantec Troll Stealer 2024

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--035525fc-4549-4282-b85b-c7c07359124c

Talos Kimsuky Nov 2021 · Securelist Kimsuky Sept 2013 · Aryaka Kimsuky July 2025

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05e9e12f-be5e-46f4-9f42-6f7fb7e9fb4a

Secureworks BRONZE BUTLER Oct 2017

ATTACK:enterprise:S0238 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--066d9d0e-0298-420b-ba84-a4af07211a35

McAfee GhostSecret

ATTACK:enterprise:S0502 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08a74c86-5a98-4634-a93c-9c192d3e4fc9

NSA/FBI Drovorub August 2020

ATTACK:enterprise:S0498 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0994d9a9-b94e-4235-b762-18c2f7b2ed57

SentinelOne Lazarus macOS July 2020

ATTACK:enterprise:S0653 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a558f22-0139-43d9-869b-ee0e71ac237d

Checkpoint IndigoZebra July 2021

ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b33093f-14c3-485e-8d82-f04ebcbe6d01

MSTIC DEV-0537 Mar 2022

ATTACK:enterprise:C0048 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d2542de-be40-4c65-9fe8-04652388b080

Volexity UPSTYLE 2024

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e4c55fc-a923-4c05-89ce-3102620a41d7

Symantec Chafer February 2018 · FBI FLASH APT39 September 2020

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e90a4cd-b6b3-49c1-ae6d-b338ef7f9c3b

Red Canary Qbot · Kaspersky QakBot September 2021

ATTACK:enterprise:S1043 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f19052c-5734-4521-91f4-1389e53d11ee

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1029fab5-5714-42d0-ac04-78f4c76c3c02

CyberBit Dtrack

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--119cfc44-4018-4ce0-b223-b0f353d1c113

McAfee Bankshot

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11a7431f-416f-48de-a3c0-8782abdede63

Forcepoint Monsoon · PaloAlto Patchwork Mar 2018

ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12cfc154-5240-47ce-ba54-ec40f8a6d13d

Rapid7 HAFNIUM Mar 2021 · Microsoft Silk Typhoon MAR 2025

ATTACK:enterprise:S1064 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--134a44d5-19f9-4052-9dc2-b1f5af870e28

HP SVCReady Jun 2022

ATTACK:enterprise:S0448 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--138f4287-ff95-45cd-bd65-d08708a2cbf5

McAfee Sharpshooter December 2018

ATTACK:enterprise:S0197 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--145ffef4-5a63-41d7-ac74-e034e9b9622d

FireEye Know Your Enemy FIN8 Aug 2016 · FireEye Fin8 May 2016

ATTACK:enterprise:S0020 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14cc9d67-85e2-4aae-8f3b-4201a66b918f

Rapid7 HAFNIUM Mar 2021 · FireEye Periscope March 2018 · Lee 2013 · NCSC Joint Report Public Tools

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--161c58eb-29d7-4de3-aca8-3bda085f19a3

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16d0869c-1ed4-48b9-92f9-cae22e7a001f

Trend Micro Earth Simnavaz October 2024

ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17c3e2e7-f208-408c-b767-6c5be92646c4

Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

ATTACK:enterprise:S0340 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17e5edb8-fcdf-4581-a428-5a3a75fc675a

ESET Nomadic Octopus 2018

ATTACK:enterprise:S0036 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18324fed-7770-4768-b652-59860ac4782f

ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a0117d8-422f-48ed-be65-9d2fcaf12ed9

ANSSI Sandworm January 2021

ATTACK:enterprise:S9058 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1df35a7c-a7e9-45cb-b569-422e88f6c029

Mandiant_UNC1549_Nov2025

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2095d4fa-73b6-4a67-ac25-394f64d122d5

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22e84b06-fbac-4811-b9b7-3c6587aab7d7

Cobalt Strike TTPs Dec 2017 · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:G0124 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24b8eeb2-ee0d-402b-b2e0-afaa3c867072

ESET ForSSHe December 2018

ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--267fb6e6-0776-4de0-baac-985beb079ad2

Group IB GrimAgent July 2021

ATTACK:enterprise:S9052 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27279531-587c-46cf-af46-aa3fd64985da

CheckPoint_NimbusManticore_May2026

ATTACK:enterprise:S1090 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29c989db-83f5-4c1a-944b-a0d78d652de2

MoustachedBouncer ESET August 2023

ATTACK:enterprise:S0630 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ae5b107-c648-45d4-9930-dcc42adac2c3

Bitdefender Naikon April 2021

ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b2e0b6e-10ac-42c0-8d77-3ffc9cc654a7

Malwarebytes Konni Aug 2021

ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e87ee5b-2cf9-427f-b8c7-363e37daed88

Check Point Warzone Feb 2020

ATTACK:enterprise:S1031 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ea75990-7349-4d67-8ec1-f4168792af23

Unit 42 PingPull Jun 2022

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31334bcb-0207-41c8-b04a-96c7d6d1a466

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:C0002 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3173f84e-783b-43cd-95f7-b74277936b4d

McAfee Night Dragon

ATTACK:enterprise:S1113 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32447230-f703-4baf-bd01-1477f7142f00

Mandiant Pulse Secure Update May 2021

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32bc85f6-f022-4868-8934-bd00cc36f6d4

CISA AA20-259A Iran-Based Actor September 2020

ATTACK:enterprise:S0572 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33deb846-1334-4eb7-98fc-faff39b3ad16

ClearSky Lebanese Cedar Jan 2021

ATTACK:enterprise:G0138 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--343e78cb-dbe9-4421-aca3-a8a973553c7a

FSI Andariel Campaign Rifle July 2017

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--353717ce-2c78-4752-941e-439421ec2448

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3685caad-4ab6-42e8-888d-e7619006dd04

BlackBerry Amadey 2020

ATTACK:enterprise:S0520 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36d45d93-4a7f-4af1-b89a-2c2744f6b535

US-CERT BLINDINGCAN Aug 2020

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38a72b32-dc04-493d-8b92-31174c32f3ed

ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38be247c-74b0-42f3-964e-5f23ef42a353

Cybereason Soft Cell June 2019

ATTACK:enterprise:S0615 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a3ba187-fa84-4285-97e6-8a9383c5e66f

BlackBerry CostaRicto November 2020 · CISA AR21-126A FIVEHANDS May 2021

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3be08ed9-951a-4686-9f60-114f0468325d

Mandiant APT29 Eye Spy Email Nov 22

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3fe9b64a-6435-4592-9181-2ad50ee93044

Novetta Blockbuster Loaders · Novetta Blockbuster RATs · Novetta Blockbuster · Kaspersky ThreatNeedle Feb 2021

ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3feb6e83-0491-4e3d-a581-3f68ab839e92

Eset Ramsay May 2020 · Antiy CERT Ramsay April 2020

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4071eb53-bd07-499d-88cc-f03425ea2e46

Sekoia Raccoon2 2022 · S2W Racoon 2022

ATTACK:enterprise:S0652 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41160796-9596-4a58-92a1-14dd3c9f4271

Kaspersky Ferocious Kitten Jun 2021

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--430afd29-f2c0-43d3-b7bf-e7a549960254

ESET Gamaredon June 2020 · ESET Gamaredon Sept2024

ATTACK:enterprise:G1030 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--436bc39f-a6a0-4f8c-87e8-887cef2c67cd

Unit42 Agrius 2023

ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43828aaa-5c0c-41e1-ae38-6e2abd43120d

CISA SPAWNCHIMERA RESURGE February 2026 · Google UNC5221 Ivanti April 2025 · Picus Security UNC5221 Ivanti May 2025

ATTACK:enterprise:S1017 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--441cd636-cb84-4541-b444-09881d015c43

Palo Alto Unit 42 OutSteel SaintBot February 2022

ATTACK:enterprise:S0514 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45eda154-7d5b-406d-b4eb-8d1ba2b79f40

PWC WellMess July 2020 · CISA WellMess July 2020

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--46389d22-1f4d-4597-b03d-30b9ec4146df

Trend Micro FIN6 October 2019 · RiskIQ British Airways September 2018 · RiskIQ Newegg September 2018

ATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--46536757-5c5b-4927-9f68-b12ebef13568

Bitsight Latrodectus June 2024

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--479a4e37-811b-44e7-9d4f-e226eece6c36

Crowdstrike HuntReport 2022

ATTACK:enterprise:S1060 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48316ab6-0019-47ad-b751-3b7efce756f2

SentinelLabs Metador Sept 2022

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48d34942-8001-41d2-ba53-0457c3852541

Lunghi Iron Tiger Linux

ATTACK:enterprise:S0248 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48eff76f-1f39-49e8-87c2-11607a8aeea3

ASERT Donot March 2018

ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4c530431-2ad0-4ee9-97d1-4e489aa2436f

Cybereason Bumblebee August 2022

ATTACK:enterprise:S0634 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d3467b2-34cd-484d-9526-571311b0160e

MSTIC Nobelium Toolset May 2021

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f6975b8-e16e-47ba-b241-b2267c5da4ef

FoxIT Wocao December 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--500c4228-b676-4f47-a391-9e52abd5ea51

ESET Turla PowerShell May 2019

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5073b1b4-4018-4208-a46e-86a8358a6cee

Symantec Trojan.Hydraq Jan 2010 · Symantec Hydraq Jan 2010

ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51c94403-d475-4bf0-8512-877993e17888

Socket GlassWorm January 2026

ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5260f605-09d0-4d96-9239-9b93a76d0cbe

Microsoft Analyzing Solorigate Dec 2020 · FireEye SUNBURST Backdoor December 2020

ATTACK:enterprise:S0661 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--52e9ca8d-a778-46d1-9521-743a8e47c503

MSTIC FoggyWeb September 2021

ATTACK:enterprise:M1057 → mitigates → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--53e53569-4ae7-453c-953e-fc683e7794b0

ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5403aad2-3840-4b49-8124-961e1a24d044

NCSC Cyclops Blink February 2022

ATTACK:enterprise:S1012 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--543dd290-70eb-402f-8d40-93b4a240d4a1

Cybereason PowerLess February 2022

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54f6c1c8-f3c7-44a6-9a00-2195e03cf0ae

Group IB APT 41 June 2021

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--565d5e3a-8a10-44cd-b45d-75fe2abe2677

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S0694 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--572a0bc0-58e6-4a8e-a28c-7d8be0bfd781

ClearSky Lazarus Aug 2020

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--576f0fb4-4cd7-467b-9208-3977321705e4

DFIR Conti Bazar Nov 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.