Skip to content

Steganography

Subtechnique · ATTACK:enterprise:T1027.003

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1027.003",
  "title": "Steganography",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1027/003",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--c2e147a9-d1a8-4074-811a-d8789202d916",
  "external_id": "T1027.003",
  "domain": "enterprise",
  "created": "2020-02-05T14:28:16.719Z",
  "modified": "2026-05-12T15:12:00.714Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "McAfee Malicious Doc Targets Pyeongchang Olympics",
      "url": "https://securingtomorrow.mcafee.com/mcafee-labs/malicious-document-targets-pyeongchang-olympics/"
    },
    {
      "source_name": "Wikipedia Duqu",
      "url": "https://en.wikipedia.org/wiki/Duqu"
    }
  ]
}

Explicit source assertions (32)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02438776-1130-4715-83b0-9bd6781bf8c0

Aikido TeamPCP Telnyx MAR 2026 · Palo Alto TeamPCP MAR 2026

ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09f5abff-ad09-4d5b-a6c4-612d4171c089

TrendMicro EarthLusca 2022

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15698fb0-12df-4135-8ecb-093e9fd268a2

Unit42 RDAT July 2020

ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18f4bc4e-ef29-4fe4-ace3-c4671f94ccef

Volexity PowerDuke November 2016

ATTACK:enterprise:C0005 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1aad8f36-aec7-4210-8edb-7ad3dd14f5ed

ESET Operation Spalax Jan 2021

ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fedf226-02b4-4634-a7bf-4dac49bd97a3

Talos Group123 · Securelist ScarCruft May 2019

ATTACK:enterprise:S0513 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e55a09d-0784-4a74-bd3a-6beca63adcce

ESET Dukes October 2019

ATTACK:enterprise:S0470 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3811b12a-fcfc-47d2-83ec-89df60ca4c21

Trend Micro Tick November 2019

ATTACK:enterprise:S0511 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44d62933-848e-481e-84f9-7dbdec9a4b85

ESET Dukes October 2019

ATTACK:enterprise:S0471 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5342c0fb-0f4d-456a-a7e7-525c60b7f82e

Trend Micro Tick November 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54ece776-8a64-4e0c-9d54-4350680c07b8

ESET Okrum July 2019

ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5791055c-1a0c-460e-91cc-7d85278ce533

CheckPoint Bandook Nov 2020

ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59ef906c-f395-427a-9cd5-30887a983516

Unit 42 TA551 Jan 2021

ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65838f5f-0cc3-4e33-953a-11f1e5e7a20e

Fortinet Diavol July 2021

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c9ed67e-95f1-4585-8d8d-14a27f21e14c

CISA AA21-200A APT40 July 2021

ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--879ee01b-0517-42bd-8ac8-3857e63e40c4

Antiy CERT Ramsay April 2020

ATTACK:enterprise:S0644 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8aca6fab-b526-4716-98e0-1300847b9478

Talos Oblique RAT March 2021

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d36ae15-a2af-4c13-86f0-f657afbb4c86

Juniper IcedID June 2020

ATTACK:enterprise:T1027.003 → subtechnique-of → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f748caa-dd1e-41aa-b09a-333ce8916bd0

ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--96a0df58-61cc-4380-aaba-e05207c39673

Zscaler Pikabot 2023

ATTACK:enterprise:S0469 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aba32ee8-9eca-45fa-99f3-89e75dbc16a6

Trend Micro Tick November 2019

ATTACK:enterprise:S0654 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b0557c84-d4c5-4016-8381-f419d18f2d47

Group IB Ransomware September 2020

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b8e0c578-c249-4106-9568-3cbe0473b081

ClearSky MuddyWater Nov 2018

ATTACK:enterprise:S0231 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c09c2f08-3bda-4af7-9578-01fa1c7fba2c

GitHub Invoke-PSImage

ATTACK:enterprise:C0023 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c09f73f8-f350-457c-a492-8cd820b00074

ESET Dukes October 2019

ATTACK:enterprise:S0565 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6572007-a3f6-40d1-bfd2-37abf6a63b58

Symantec RAINDROP January 2021

ATTACK:enterprise:S0473 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c748a743-6d63-4287-a86a-d799e14fcd99

Trend Micro Tick November 2019

ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d10d70ee-38f4-43b4-85a2-bab4f944c645

Kaspersky BlindEagle AUG 2024 · Recorded Future TAG-144 AUG 2025 · Zscaler BlindEagle DEC 2025

ATTACK:enterprise:G0138 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--da7dcfcb-7a36-43a8-8a0a-409d15b7e62e

MalwareBytes Lazarus-Andariel Conceals Code April 2021 · Kaspersky Andariel Ransomware June 2021

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e35f5636-2ae8-4ab7-9851-73410e6a58d0

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:S0518 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e9342a76-171e-4831-96b7-d998a6de8282

ESET Dukes October 2019

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f5777849-9cea-4e02-93ba-9065b27f0e58

Trend Micro Tick November 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.