Skip to content

Remote System Discovery

Technique · ATTACK:enterprise:T1018

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1018",
  "title": "Remote System Discovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1018",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--e358d692-23c0-4a31-9eb6-ecc13a8d7735",
  "external_id": "T1018",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:28.187Z",
  "modified": "2026-05-12T15:12:00.722Z",
  "version": "3.6",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "CISA AR21-126A FIVEHANDS May 2021",
      "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"
    },
    {
      "source_name": "Elastic - Koadiac Detection with EQL",
      "url": "https://www.elastic.co/security-labs/embracing-offensive-tooling-building-detections-against-koadic-using-eql"
    },
    {
      "source_name": "US-CERT-TA18-106A",
      "url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
    }
  ]
}

Explicit source assertions (108)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01b94982-fedb-4469-adf1-7f2a2a9069ea

CISA GRU29155 2024

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03f32a8b-4cd9-488c-9759-37f3dff9faea

FireEye APT10 April 2017 · PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:S0233 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05ee7ead-dfe8-4cd2-9e7c-8f1aada9bcde

FireEye Periscope March 2018

ATTACK:enterprise:S0586 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07324f90-f7c1-41f7-8d08-3ecec98bbe5c

CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020

ATTACK:enterprise:S0684 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b2d53db-2f5c-4dc7-97de-f0c12e22472c

ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c8370b1-efd1-4e5d-86c9-d3ffba1bb22d

Crowdstrike Indrik November 2018

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0cbe929a-96e2-4ff8-bf8d-501a9a8d2ad2

Crowdstrike Qakbot October 2020 · Trend Micro Black Basta October 2022 · Kaspersky QakBot September 2021

ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d6b67b8-016a-4335-89f1-2cdb7ed778c1

Cybereason OperationCuckooBees May 2022

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d7506cd-4869-48f9-a0e0-cb70d6b482ff

FoxIT Wocao December 2019

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1374e38c-db37-46f8-8560-63901a3e7e56

CISA AA20-259A Iran-Based Actor September 2020

ATTACK:enterprise:S0452 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15a571d1-652c-4148-9dee-12d3b1cbff62

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16d19ac1-de53-44e2-9139-32b0e0525b0c

Cybereason Bazar July 2020

ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18c44352-1eca-4d6e-9eac-9793b75223df

BitDefender BADHATCH Mar 2021

ATTACK:enterprise:G1030 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22ece51b-ebfa-474d-8a6e-6835ff891890

Unit42 Agrius 2023

ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25b8605b-9ab2-418f-b92b-abb2be815b90

Microsoft BlackCat Jun 2022

ATTACK:enterprise:G0019 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2794f341-b46f-482c-b5b7-2cc7c2dcadb5

Bitdefender Naikon April 2021

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--280bb6ec-0d7f-4a42-a3f2-7a3b43886126

Alperovitch 2014

ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2bb7ed69-8f59-47f3-8d86-f1c1202c7629

TrendMicro EarthLusca 2022

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ea4f604-c23b-4d67-8648-f2c170378e78

apt41_dcsocytec_dec2022

ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31ec568c-53c7-4dfb-8bfb-bfb7addca7ee

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3341a11e-acd1-4cba-a7a9-5bb48aec8bec

Check Point Black Basta October 2022

ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--390d98f6-dd1c-4fce-a02a-4ac2c1d30934

ESET MirrorFace DEC 2022

ATTACK:enterprise:S0248 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c021bb7-e96b-4a87-931b-d74f19ec8bcb

ASERT Donot March 2018

ATTACK:enterprise:C0007 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d4cb0b5-148f-4e3f-a09f-7a17823b2b56

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:G0053 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ef6a3fb-0d59-4ba5-b2d0-dc32d547b74f

Mandiant FIN5 GrrCON Oct 2016

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40356b61-2279-47ef-b7bd-4b355e2fb98a

Secureworks BRONZE SILHOUETTE May 2023 · Microsoft Volt Typhoon May 2023

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42d2f7f0-9548-4bdd-9e88-7200a9e91b57

ESET Telebots Dec 2016 · Dragos Crashoverride 2018

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a50bbbf-990f-4556-86e2-2990bccc90e9

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b314d34-1e53-46a4-a3b8-131a19b256d6

Fidelis njRAT June 2013

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f31fe80-6994-443d-ad54-7584601618dd

Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023 · Unit42 Chinese VSCode 06 September 2024

ATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50cf1a8b-5ed4-4155-a09d-ed65cf9c4a08

ESET Industroyer

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51742efe-5f0c-4fbf-9eb7-5e765a0a408f

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:C0049 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--52ec8e9e-4276-4793-bc9b-76c312cba5cd

CISA Leviathan 2024

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b5635da-130a-4075-8936-23078f63d419

AI-Mexico-Govt-Breach · AI-Mexico-Govt-Compromise

ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d23f25a-d98a-47a6-8da7-86e8a73c3407

Arctic Wolf Akira 2023

ATTACK:enterprise:S1198 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5fe7e204-803e-47fc-83a5-f4766d2cedfa

Symantec Troll Stealer 2024

ATTACK:enterprise:C0028 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61ce754c-da32-4f0d-9c5f-bdf4debf7377

Charles McLellan March 2016

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--625ebfc0-7aaa-4eaf-8c49-be8b55c059d4

NCC Group APT15 Alive and Strong

ATTACK:enterprise:S0488 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63b477c5-b88b-469d-8b2a-bc30507de54f

CME Github September 2018

ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64f0efcd-e46a-4bcf-9cbe-4c890e13c01b

Talos PoetRAT April 2020

ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6679b9ed-d9ec-4ff3-9961-24f39814f6d0

Kaspersky Lyceum October 2021

ATTACK:enterprise:S1212 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68b54bc3-77f8-4b4e-bd65-bfb172b85db9

Group-IB RansomHub FEB 2025

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e576576-bcd8-42ca-aa0a-8e3e24aaeafc

Kaspersky Turla

ATTACK:enterprise:C0061 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6efce751-f7b8-4918-b80d-a6c77237516b

sentinelone operationDigitalEye Dec 2024

ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71fd7b73-462f-4629-8d95-59d0129b1503

Symantec Orangeworm April 2018

ATTACK:enterprise:S1044 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74ef18b6-ca55-4fc3-acf1-10ed585c160f

Kaspersky APT Trends Q1 2020

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7748c6c9-d7a5-44e9-81bf-97d038e6edb1

Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:S0244 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77fbad9a-3a73-4ddb-8d10-60147eb64a81

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a116d1c-33ab-4729-abff-2e37dc387f31

SecureWorks WannaCry Analysis

ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ad1773a-34ba-498a-ab63-9dea0181f8f8

JPCERT MirrorFace JUL 2024

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b6eac00-8a13-42e3-b533-a40314eada68

Nccgroup Emissary Panda May 2018

ATTACK:enterprise:S0018 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7fe49f05-8f96-4fc2-bc5b-b2eea59efca3

AlienVault Sykipot 2011

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80299c96-9450-48bc-8161-e72a41389f6a

Talos Cobalt Strike September 2020 · cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80b87eab-243c-4e98-a85e-2684520f8824

GitHub SILENTTRINITY Modules July 2019

ATTACK:enterprise:S0521 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--841f6044-8c12-4063-b911-d1da4c8d6fdc

CrowdStrike BloodHound April 2018

ATTACK:enterprise:S0694 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86a7ffc8-6107-4854-96a7-d39f8bb4069f

ClearSky Lazarus Aug 2020

ATTACK:enterprise:S0165 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8765dd7e-33cc-4040-927d-bf0aa16d3d79

Symantec Buckeye

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8bda3a33-7524-49e8-aa93-708d2b6a6b17

Broadcom Medusa Ransomware Medusa Group March 2025

ATTACK:enterprise:S0696 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c155a65-b89f-44aa-b4c0-1374208a3fed

NTT Security Flagpro new December 2021

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e24b237-b2a1-4d48-ae32-fd0b2d345a74

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S9045 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8eebd114-7d43-40da-a6b1-48a11ace403a

AI-Mexico-Govt-Breach

ATTACK:enterprise:S0698 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9006e828-f70a-4c7e-8dce-07d1040de3e9

ESET Hermetic Wizard March 2022

ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--93a7d544-bed2-4d8c-abda-ab0b82ffa3a9

Symantec Bilbug 2022

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95805281-96b1-49ea-95ee-9d654178c5c3

Secureworks BRONZE BUTLER Oct 2017

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--964233cc-fa6c-4754-9684-6546eb6d5a4a

FireEye APT39 Jan 2019 · BitDefender Chafer May 2020 · Symantec Chafer February 2018

ATTACK:enterprise:S0097 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b2356e1-6544-40a7-a694-8ac36a1da1b7

ATTACK:enterprise:S0575 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c424acf-2a41-4b34-867f-590ade731fc2

CrowdStrike Wizard Spider October 2020

ATTACK:enterprise:S0241 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9dfdcec6-82b7-42a4-902a-3220f4d67bcf

ATTACK:enterprise:S0063 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ea25bfb-3e3a-42cb-8d2a-939169057806

Palo Alto CVE-2015-3113 July 2015

ATTACK:enterprise:S1146 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3742518-c231-4492-9673-95e095badddf

Symantec Daggerfly 2023

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6080757-7935-439b-b70f-72ba841cda03

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6dc02a8-2ce3-45db-a7e5-e475d6acec3c

Group IB Silence Sept 2018

ATTACK:enterprise:S0335 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a951bef0-4a5a-49b0-b6bd-6a4dfbd60ca0

GovCERT Carbon May 2016

ATTACK:enterprise:S0599 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab0c8d2a-b2da-4566-96f5-1cbbc9a41300

Aqua Kinsing April 2020

ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abcc0249-0226-440b-a32a-02512fd2db4f

Intel471_TheGentlemen_Aug2026

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ade72dc6-559e-4a84-9024-1a862faec6a0

FireEye FIN6 April 2016

ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--afe9286d-076f-49af-90f3-11ebbe82ad40

Fortinet Diavol July 2021

ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b0bba4a5-a3c3-4cf7-9347-c9070cb18998

Cyberreason Anchor December 2019

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b2c02ae1-c62a-4811-a913-b0a26f605e38

Symantec WastedLocker June 2020

ATTACK:enterprise:S0646 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b6609907-ec91-4339-a1ed-811bfe6ca48e

Secureworks GOLD KINGSWOOD September 2018

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.