Skip to content

SMB/Windows Admin Shares

Subtechnique · ATTACK:enterprise:T1021.002

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1021.002",
  "title": "SMB/Windows Admin Shares",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1021/002",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--4f9ca633-15c5-463c-9724-bdcd54fde541",
  "external_id": "T1021.002",
  "domain": "enterprise",
  "created": "2020-02-11T18:25:28.212Z",
  "modified": "2026-05-12T15:12:00.632Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "lateral-movement"
  ],
  "source_references": [
    {
      "source_name": "Medium Detecting WMI Persistence",
      "url": "https://medium.com/threatpunter/detecting-removing-wmi-persistence-60ccbb7dff96"
    },
    {
      "source_name": "TechNet RPC",
      "url": "https://technet.microsoft.com/en-us/library/cc787851.aspx"
    },
    {
      "source_name": "Microsoft Admin Shares",
      "url": "http://support.microsoft.com/kb/314984"
    },
    {
      "source_name": "Windows Event Forwarding Payne",
      "url": "https://docs.microsoft.com/en-us/archive/blogs/jepayne/monitoring-what-matters-windows-event-forwarding-for-everyone-even-if-you-already-have-a-siem"
    },
    {
      "source_name": "Lateral Movement Payne",
      "url": "https://docs.microsoft.com/en-us/archive/blogs/jepayne/tracking-lateral-movement-part-one-special-groups-and-specific-service-accounts"
    },
    {
      "source_name": "Wikipedia Server Message Block",
      "url": "https://en.wikipedia.org/wiki/Server_Message_Block"
    }
  ]
}

Explicit source assertions (72)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0575 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00789efc-c0c5-4bc2-96ad-9f893bf9c06d

Cybereason Conti Jan 2021 · CarbonBlack Conti July 2020

ATTACK:enterprise:G1009 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--046310ee-386b-4ed6-a623-6436341b8b8c

Checkpoint MosesStaff Nov 2021

ATTACK:enterprise:G0028 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0512a63b-58c8-4b0c-b2b4-e4da562cee5f

ATTACK:enterprise:C0049 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a9bd6e2-f367-4403-82b1-ab4b484359b2

CISA Leviathan 2024

ATTACK:enterprise:S0698 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0feab3d1-4d0d-4543-bbc1-63505eda12f8

ESET Hermetic Wizard March 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10a3e014-047a-4b6a-b8f2-6297f0043ab9

Crowdstrike HuntReport 2022

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1bc150db-66ca-4361-84a2-2dd0f104790f

Binary Defense Emotes Wi-Fi Spreader · Malwarebytes Emotet Dec 2017

ATTACK:enterprise:S0350 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ec9706f-7faa-466d-afd0-97cc71714f7b

McAfee Night Dragon

ATTACK:enterprise:S0446 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2251345d-d828-4768-b8f0-4a4ddd8e41ca

Bleeping Computer - Ryuk WoL

ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24a8acc7-3c91-44d9-a521-d1380eda581f

Mandiant_UNC1549TTPsTools_Nov2025

ATTACK:enterprise:S0029 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27102940-8ec1-42ad-98e5-57dc24b572eb

PsExec Russinovich

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2bb3c950-2099-4d7d-ac13-05a1470fc3c6

DFIR Ryuk 2 Hour Speed Run November 2020 · DFIR Ryuk's Return October 2020

ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38ea7367-26e7-4a6a-b735-e98e3a35450a

FireEye Shamoon Nov 2016

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39808511-28ac-4cff-b6b4-49d996855e8a

Crowdstrike GTR2020 Mar 2020 · apt41_dcsocytec_dec2022

ATTACK:enterprise:S1073 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c1dbc6c-c608-4745-8cd2-863b4d56fabe

Cybereason Royal December 2022

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42d2f816-9db2-47bf-9481-3065d038725d

Mandiant Operation Ke3chang November 2014 · NCC Group APT15 Alive and Strong

ATTACK:enterprise:S0368 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44232d0d-5a86-4662-8934-054fcc9afbb3

Talos Nyetya June 2017 · US-CERT NotPetya 2017 · PsExec Russinovich

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a6248d4-4fa1-404a-abed-84e9b7c32dbe

Kaspersky Turla

ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4dd44f72-a08e-4dac-9875-98690508ed08

Fortinet Diavol July 2021

ATTACK:enterprise:T1021.002 → subtechnique-of → ATTACK:enterprise:T1021

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5071c70a-5aa8-4534-8cc4-676192728151

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--53d7b242-3ed6-4281-9829-e25d425e28fe

Securelist BlackEnergy Nov 2014

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57d595d2-4363-4816-826e-91e45dd364e5

CrowdStrike StellarParticle January 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d5bda78-ea1a-4e73-b663-6105b77728bb

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--602d3c1d-6337-4134-9dc7-b1452f95b88f

Picus Qilin MAR 2025 · Cisco Talos Qilin Ransomware OCT 2025

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62a2b674-1eb3-4a9f-ac4f-2766c077eb58

Cycraft Chimera April 2020 · NCC Group Chimera January 2021

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65e9d954-30d8-4354-ad5c-3a6d69867a7e

CISA AA20-259A Iran-Based Actor September 2020

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d9f27eb-cc6b-4871-b42a-37640f45f8fa

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ecd51f2-d57d-4daa-a98f-764b9b3ddac1

MDSec Brute Ratel August 2022 · Dark Vortex Brute Ratel C4 · Palo Alto Brute Ratel July 2022

ATTACK:enterprise:S0672 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--717442d5-dd5a-4658-87e1-33f727dd1fa2

ATTACK:enterprise:S1212 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72cc3cce-f2a0-47bb-beb4-a047da713404

Group-IB RansomHub FEB 2025

ATTACK:enterprise:S0608 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78e4027f-b5ff-4cb3-8b27-ab931baf3476

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ed0bce7-c9b1-4c48-9e42-930f6006fa4d

Dragos Crashoverride 2018 · Microsoft Prestige ransomware October 2022

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82e1cb6f-7528-430f-8e8e-fc3213f25402

FoxIT Wocao December 2019

ATTACK:enterprise:S0038 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d7cd505-3b0e-4e90-bf47-6552612958dc

Symantec W32.Duqu

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--935ca61c-b4ff-4cfc-a4e9-9b8aa9514ea3

ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9663d78b-0a81-42af-93b0-8e62cc3af2d7

Symantec Orangeworm April 2018

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--96705ab7-dfd9-4360-a0bb-e434bd194697

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--96797ece-5783-4d34-a399-32496c8705ac

Symantec Buckeye

ATTACK:enterprise:C0048 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--975335fe-ac44-4763-a151-373b043313ad

Volexity UPSTYLE 2024

ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2423ac3-94b4-4936-962b-06562115cb70

ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a83e6a0f-fc31-472f-bffd-135dfc5ce683

Bitdefender Sardonic Aug 2021 · FireEye Know Your Enemy FIN8 Aug 2016

ATTACK:enterprise:C0038 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a9880e35-afe0-4537-a45d-3f63103b69b5

CISA Iran Albanian Attacks September 2022 · Microsoft Albanian Government Attacks September 2022

ATTACK:enterprise:M1035 → mitigates → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--afe166b7-d849-4635-8e85-65b9d0bf11c5

ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b5f6b196-576d-4f4e-be05-1923cbbd21a0

Volexity Ivanti Zero-Day Exploitation January 2024

ATTACK:enterprise:S0019 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b98c506f-3dd3-45c1-b81a-3e23bcfe6198

Kaspersky Regin

ATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bf3b7eae-a651-4a2b-9308-52fe2542766e

Microsoft Preventing SMB

ATTACK:enterprise:G0108 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bf4d368e-202d-4bd2-9ffe-013ca6104e05

RedCanary Mockingbird May 2020

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bfdffc50-dba0-41d1-a332-0a02a0a8de07

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6c086b1-65b6-45ba-ba86-7ccd7f2849d3

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6cf559e-1ead-4fba-9c61-72e33bae10e5

Sygnia Emperor Dragonfly October 2022

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8b6114c-df7f-4e19-ae9f-6cde01c46b04

Palo Alto Lockbit 2.0 JUN 2022 · SentinelOne LockBit 2.0

ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca4d13b8-73e2-4eaa-94be-952f609c422f

JPCERT MirrorFace JUL 2024 · Trend Micro Earth Kasha NOV 2024

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d486dd75-bb96-44e6-9898-c256b9f1b8ba

Cobalt Strike TTPs Dec 2017 · Trend Micro Black Basta October 2022

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d6523780-3cae-483e-ae54-f9383b60dc0e

Picus BlackByte 2022 · Cisco BlackByte 2024 · Microsoft BlackByte 2023

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db52ebfc-92b0-446d-9712-0b5c09e5e566

Sygnia VelvetAnt 2024A

ATTACK:enterprise:S1180 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dc2077f1-b891-48f8-a1a0-397ed8601bde

Trustwave BlackByte 2021

ATTACK:enterprise:S1187 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ddc8d1c3-0ae4-4598-b54f-df8ef2784b63

Fortinet reGeorg MAR 2019

ATTACK:enterprise:S0365 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ddf5cb3a-6cfa-40c8-8992-396329632f14

Talos Olympic Destroyer 2018 · PsExec Russinovich

ATTACK:enterprise:C0051 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e0585bfc-e890-43ef-8ab4-0da3f5814ed4

Nearest Neighbor Volexity

ATTACK:enterprise:G0071 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e09c37a3-ae23-403e-93d5-aef4953bd43c

Symantec Orangeworm April 2018

ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e5d1b1c8-e569-4861-8fb1-18765df9092f

Joint Cybersecurity Advisory LockBit 3.0 MAR 2023

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e6cafa6a-22ce-49f7-8136-dc5a51c3aaeb

Novetta Blockbuster RATs · Novetta Blockbuster

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e823abe8-8edb-4066-adc5-b190af0fb2e1

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026 · TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:S0056 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e89d06bc-31f3-49c0-a555-360eeff7f7c6

Cylance Cleaver

ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ef5479d8-f8f3-4754-989e-9930a245899c

Unit 42 Lucifer June 2020

ATTACK:enterprise:C0025 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f08b8e20-4dda-4ced-8e9d-f0a5e4ebcc52

Dragos Crashoverride 2018

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f43ab4db-5dea-4a1f-977a-f5d779330193

Alperovitch 2014

ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f72aba67-b581-4836-b5f7-74d125aa906c

ATTACK:enterprise:S0504 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f7ebcffb-0397-430b-a19f-0f2f842d79ed

Medium Anchor DNS July 2020

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fa82d7c2-bdc5-4945-9d59-5b40eb9a7454

Symantec Chafer February 2018

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fe028d0f-b02e-4856-8593-c71a07b9519b

Cybersecurity Advisory GRU Brute Force Campaign July 2021

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fe16ff68-56ac-4e5f-9566-8b79125f0dcf

rapid7-email-bombing

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.