Skip to content

Remote Desktop Protocol

Subtechnique · ATTACK:enterprise:T1021.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1021.001",
  "title": "Remote Desktop Protocol",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1021/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--eb062747-2193-45de-8fa2-e62549c37ddf",
  "external_id": "T1021.001",
  "domain": "enterprise",
  "created": "2020-02-11T18:23:26.059Z",
  "modified": "2026-05-12T15:12:00.723Z",
  "version": "1.4",
  "aliases": [

  ],
  "tactics": [
    "lateral-movement"
  ],
  "source_references": [
    {
      "source_name": "Alperovitch Malware",
      "url": "https://web.archive.org/web/20191115195333/https://www.crowdstrike.com/blog/adversary-tricks-crowdstrike-treats/"
    },
    {
      "source_name": "TechNet Remote Desktop Services",
      "url": "https://technet.microsoft.com/en-us/windowsserver/ee236407.aspx"
    }
  ]
}

Explicit source assertions (75)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0854ea2c-21b0-49b9-bb90-3653384f2de9

Netscout Stolen Pencil Dec 2018

ATTACK:enterprise:G1032 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08c3b884-5e8d-413a-a336-6246ed11af24

Huntress INC Ransomware May 2024 · Cybereason INC Ransomware November 2023 · SOCRadar INC Ransom January 2024 · Huntress INC Ransom Group August 2023

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--094a2284-eeab-47fd-b6fb-6351d98330aa

Cybereason Bumblebee August 2022 · cobaltstrike manual

ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a26c696-1288-4cb3-a24e-bbd64925b9f7

GitHub QuasarRAT · Volexity Patchwork June 2018

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--127fc875-b87c-46eb-94d8-364486710ad4

CISA AA24-038A PRC Critical Infrastructure February 2024

ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17efaef0-499d-4c09-a4c9-32a22edae6db

Mandiant Pulse Secure Update May 2021

ATTACK:enterprise:S0350 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d37f088-123f-41bb-9367-a1696dbfe895

McAfee Night Dragon

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27ead6bc-2bba-49d3-bcfe-667c7654a6fc

Crowdstrike GTR2020 Mar 2020 · FireEye APT34 Webinar Dec 2017 · Symantec Crambus OCT 2023 · Unit42 OilRig Playbook 2023

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2816f512-1a04-4cf8-94e9-36720b949c76

Cymmetria Patchwork

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c0a250b-3669-4aab-9685-f9c04af6b4b4

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31a6eec8-0281-4973-a2af-ebf30e317a9f

FireEye Know Your Enemy FIN8 Aug 2016

ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36e86ea2-e0d4-4ade-bae8-212a78c8d569

ATTACK:enterprise:M1035 → mitigates → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--375d3b8b-0e1b-4d3b-b31f-43b0e98436a5

ATTACK:enterprise:M1030 → mitigates → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3951503f-c8e9-4331-834e-df4e4afda5fb

ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3da32080-805c-4388-8490-039f1195ab23

Trend Micro Earth Kasha NOV 2024

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3fee3584-9887-428b-83e9-76caab0d0f0c

Cisco BlackByte 2024 · Microsoft BlackByte 2023

ATTACK:enterprise:S0434 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4151f66f-efcc-4c26-b3b6-8650c0a36258

QiAnXin APT-C-36 Feb2019

ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--419d663c-0fa5-411c-9697-468debf7efc5

Check Point Warzone Feb 2020

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42ddce39-b653-4466-b7ff-a9554029f1c6

FireEye APT39 Jan 2019 · BitDefender Chafer May 2020

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43c20c81-984f-418a-9202-252a3afbec46

DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43fabcba-66b6-45dc-b905-926f0a0a2bba

DHS/CISA Ransomware Targeting Healthcare October 2020 · CrowdStrike Grim Spider May 2019 · Mandiant FIN12 Oct 2021 · DFIR Ryuk 2 Hour Speed Run November 2020

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--478afd21-5bbe-4e85-9fb8-fcdb89e1a3de

Crowdstrike HuntReport 2022

ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b310a47-e010-4984-afcb-52d9c8c7933a

FireEye CARBANAK June 2017

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b5e4611-ed5c-4223-bc75-5e272090b887

Windows RDP Sessions

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b6f2524-85b4-4151-9001-32b875cfbb19

CrowdStrike StellarParticle January 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4bc4f37e-5cdd-4def-a997-1cbb37975a8f

Costa AvosLocker May 2022

ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--510b9143-95fb-482b-8680-751317550260

Volexity Ivanti Zero-Day Exploitation January 2024

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58dd2402-7b8a-4ed0-8fd3-7b9656b543b8

CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59a330b5-9ca3-4888-b81d-ce9e6ce564e5

Mandiant_UNC2165

ATTACK:enterprise:C0032 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b2fb4ff-3b19-40a1-bd49-bd5b7d0dc034

FireEye TRITON 2019

ATTACK:enterprise:C0038 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ca15f16-b87d-4373-8668-524431ceb35a

CISA Iran Albanian Attacks September 2022 · Microsoft Albanian Government Attacks September 2022

ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5cc793b0-cc45-439e-a994-c8884ca55fe7

Group IB Silence Sept 2018

ATTACK:enterprise:S1187 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d64006e-74d4-488b-a396-326e51d94caf

Fortinet reGeorg MAR 2019

ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5fa454cd-2fff-41ca-bfd0-0dce49d34f6d

Cylance Shaheen Nov 2018

ATTACK:enterprise:S0382 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--608c5d3c-ba27-430d-8655-0ff7830fb5c5

Proofpoint TA505 Jan 2019

ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66d2bbd8-1a92-4a5a-80d1-4a11860c64f3

SecureWorks August 2019

ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--703a5971-a542-4d7d-8bf5-7a9adb1db852

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70f3eaca-179d-4412-ad32-c4e3cf60c27c

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78865095-f63e-461c-9e32-e202d514747d

Group IB Cobalt Aug 2017

ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7aa62231-de12-4fc9-a3dd-fcbc948fbc77

Cisco Akira Ransomware OCT 2024

ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7aef9a3f-82ff-4e2e-bee7-962b49421067

Proofpoint TA505 October 2019

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b0a1eb4-9797-41cd-b7a4-610cb9eb2c42

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7fc56f31-3cf9-411c-a6a2-79bbaab13f29

Kaspersky Adwind Feb 2016

ATTACK:enterprise:G1030 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81049d95-f06d-46ec-b2b9-29d8adf4127a

SentinelOne Agrius 2021 · Unit42 Agrius 2023

ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--870681c3-60b5-4c91-ab00-4c9bc7cd302f

Mandiant_UNC1549TTPsTools_Nov2025

ATTACK:enterprise:T1021.001 → subtechnique-of → ATTACK:enterprise:T1021

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8787d75b-9c28-437d-b6b5-93d2d7e8462e

ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89698142-6c48-465f-9e61-0146d0fa481a

Fidelis njRAT June 2013 · Kaspersky BlindEagle AUG 2024

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8fae4ace-c3b5-4c4b-8c1a-98a32c692849

ATTACK:enterprise:S0583 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8fd19779-990a-4ce7-9b59-173896e518e8

CERT-FR PYSA April 2020

ATTACK:enterprise:C0051 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9032bb0b-a3b6-43fc-88f0-08d5083926c8

Nearest Neighbor Volexity

ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--96014091-aba9-4b8f-ac6a-6cdeb593cf30

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c593e55-8c4d-4705-9e8b-ac83962973df

ATTACK:enterprise:S0334 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a1dfbc65-48dc-4218-a10c-906fbe33b6db

Malwarebytes DarkComet March 2018

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a317b097-b819-441b-b344-9f129ba6cb40

FireEye FIN6 April 2016 · FireEye FIN6 Apr 2019

ATTACK:enterprise:G0051 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a48e7d01-012a-4336-9676-0f34e8501e22

FireEye FIN10 June 2017

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7ee1099-9380-4743-ba98-6590b65420b2

Talos ZxShell Oct 2014

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa2e1086-00f6-45f3-9159-72f2cfd50001

Mandiant FIN13 Aug 2022

ATTACK:enterprise:G0108 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abd46534-2632-4c12-a9c2-06a2a4116f2c

RedCanary Mockingbird May 2020

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b232c5da-2145-4602-a754-21d7e8af68a5

Mandiant UNC3944 May 2025

ATTACK:enterprise:C0061 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b88cac7f-5bbd-466e-b044-fb0632e5e546

sentinelone operationDigitalEye Dec 2024

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd78bfa6-f30e-4429-ac06-0039d553a69d

PWC Cloud Hopper April 2017 · District Court of NY APT10 Indictment December 2018

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4275eb1-4651-4c47-bc14-82a4b7ceec2b

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c79796c1-88d6-4cd8-95d3-4f81d3755859

Novetta Blockbuster RATs · Novetta Blockbuster

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d22e6b0e-6fc3-4676-81f4-9be42e1498a3

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2858dfa-504f-416d-8801-41a1a9561f22

Twitter Cglyer Status Update APT3 eml · aptsim

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d32354c1-0668-4997-825e-7f5652826ab9

CISA AA20-259A Iran-Based Actor September 2020 · ClearSky Pay2Kitten December 2020

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d4c15cb6-ed2f-4ed0-8e6d-dd69e06c3c3f

FireEye APT40 March 2019

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db5bc5e2-fb3d-42a7-8fbc-b0aff2be6f8f

US-CERT TA18-074A

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e7bcc9e7-d373-4b1e-a664-886c4fc04bc5

Crowdstrike GTR2020 Mar 2020 · apt41_dcsocytec_dec2022 · FireEye APT41 Aug 2019

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e7e4be4c-a6ae-44bc-b3af-9c0c41f9212e

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e87cff7f-dc75-4dfc-9c45-ec697ff4644a

Cycraft Chimera April 2020

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee172624-7e7b-44a2-8808-b7e5b1298c9f

TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f188d3ac-2bc0-4721-be80-d82323e87355

CISA Medusa Group Medusa Ransomware March 2025

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc2ffb01-2c4e-429d-b4fd-e0d20678504a

ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc96da3c-0f75-4627-a8aa-aa4fe054c172

Check Point VOID MANTICORE Handala Hack March 2026

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.