Skip to content

Command Obfuscation

Subtechnique · ATTACK:enterprise:T1027.010

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1027.010",
  "title": "Command Obfuscation",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1027/010",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--d511a6f6-4a33-41d5-bc95-c343875d1377",
  "external_id": "T1027.010",
  "domain": "enterprise",
  "created": "2023-03-14T17:36:01.022Z",
  "modified": "2026-05-12T15:12:00.718Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "Twitter Richard WMIC",
      "url": "https://x.com/rfackroyd/status/1639136000755765254"
    },
    {
      "source_name": "Invoke-Obfuscation",
      "url": "https://github.com/danielbohannon/Invoke-Obfuscation"
    },
    {
      "source_name": "Invoke-DOSfuscation",
      "url": "https://github.com/danielbohannon/Invoke-DOSfuscation"
    },
    {
      "source_name": "FireEye Obfuscation June 2017",
      "url": "https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html"
    },
    {
      "source_name": "Malware Monday VBE",
      "url": "https://bromiley.medium.com/malware-monday-vbscript-and-vbe-files-292252c1a16"
    },
    {
      "source_name": "Akamai JS",
      "url": "https://www.akamai.com/blog/security/catch-me-if-you-can-javascript-obfuscation"
    },
    {
      "source_name": "Bashfuscator Command Obfuscators",
      "url": "https://bashfuscator.readthedocs.io/en/latest/Mutators/command_obfuscators/index.html"
    },
    {
      "source_name": "Microsoft PowerShellB64",
      "url": "https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_powershell_exe?view=powershell-5.1#-encodedcommand-base64encodedcommand"
    },
    {
      "source_name": "RC PowerShell",
      "url": "https://redcanary.com/threat-detection-report/techniques/powershell/"
    }
  ]
}

Explicit source assertions (77)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--010ee4a6-41cb-4ce5-8dc2-9a1d1003ec4e

CrowdStrike AQUATIC PANDA December 2021

ATTACK:enterprise:S1085 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--051d3269-bc25-4844-aa83-d1acb5927a90

Bitdefender Sardonic Aug 2021

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05245120-4208-4cd1-b32e-e31e069c0d28

ESET Telebots Dec 2016

ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06219288-2833-4a8e-b8bc-10a834e3af7f

Kaspersky Lyceum October 2021

ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0bb3a317-c459-4c7f-b47b-c0521d15bf62

Talos PoetRAT October 2020

ATTACK:enterprise:G0077 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0eb683e1-bd09-4572-866a-f178ce54f7b6

Symantec Leafminer July 2018

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f356b7d-a206-4dfd-950f-41abbb85a59f

TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1010f466-818d-4387-9e43-9ae5e9bf9a40

Morphisec Cobalt Gang Oct 2018 · Talos Cobalt Group July 2018

ATTACK:enterprise:S0451 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14476a38-f67d-45ed-a932-6a9c593e0d61

ESET LoudMiner June 2019

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16e0be5b-93bb-4db2-b6ed-02e34a6ce3cb

Github PowerShell Empire

ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1919b6a0-302d-4e7e-b15d-e64125b11187

CrowdStrike IceApple May 2022

ATTACK:enterprise:S0685 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a514acc-4385-4bcd-8451-5d5304e70066

Microsoft Actinium February 2022

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d4cd137-b6e5-4113-a1e2-82b8e7167de9

Securonix Kimsuky February 2025

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--203e846e-c99d-457f-80b7-11cba574a869

Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24bd2350-8bae-44e9-833f-9fafeaac9544

AI-Mexico-Govt-Breach

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24db980d-90c2-4934-838c-92209ae110f7

Microsoft ASR Obfuscation

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2904937b-f1ed-4fa8-87e9-a7d69cbccc27

CISA AA20-259A Iran-Based Actor September 2020

ATTACK:enterprise:C0001 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29883758-034d-4811-9145-9e12652edf66

Talos Frankenstein June 2019

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c8ae921-219f-42ab-a4a4-5736ef0f8bf8

Visa FIN6 Feb 2019

ATTACK:enterprise:C0021 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38ecb5dd-08b5-45ca-b048-9c4ba6f842fc

FireEye APT29 Nov 2018 · Microsoft Unidentified Dec 2018

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3baa4f86-8ad4-4778-9327-1c23cebdfdca

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:S9014 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3eb12364-62c6-4b47-822b-079a939a6d83

Google UNC5221 Ivanti January 2025

ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--422ae7c9-d403-4d3e-89d4-593e03f3b4a3

BitDefender BADHATCH Mar 2021

ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--427f45bd-6518-4527-9ca2-37cf368947f5

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45bff763-b4f8-45e5-bb40-c98b415131f9

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4683801a-abe8-4db2-88b9-ebbd2073bfeb

GitHub Invoke-Obfuscation · FireEye APT32 May 2017 · Cybereason Cobalt Kitty 2017

ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--488fe004-cb37-4e15-a847-99c32b4fd757

CISA ComRAT Oct 2020 · ESET ComRAT May 2020

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d8df710-e1a4-4069-afef-2e8e63ed6587

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5112b872-0d2e-48a7-ac5c-512a3720d46d

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5483bd88-4073-4fc9-93c8-eb45da7f4d97

Cyberint Qakbot May 2021 · Trend Micro Black Basta October 2022

ATTACK:enterprise:S9029 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--570803c7-55eb-4d77-85aa-b7953bb0a613

Check Point Wirte NOV 2024

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5829ee6d-68e4-44a8-828e-ba188b14c163

Unit 42 Magic Hound Feb 2017 · Microsoft Iranian Threat Actor Trends November 2021

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a2c4561-48e4-4d51-8f00-ff470a18df32

FireEye Ryuk and Trickbot January 2019 · DFIR Ryuk's Return October 2020

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c2cd95f-9c3a-4893-9a5f-960cfed62572

Talos MuddyWater May 2019 · GitHub Invoke-Obfuscation · ClearSky MuddyWater June 2019 · Securelist MuddyWater Oct 2018 · Unit 42 MuddyWater Nov 2017 · Talos MuddyWater Jan 2022 · Trend Micro Muddy Water March 2021 · FireEye MuddyWater Mar 2018

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c75f4e0-27ab-45d0-b8bc-3991137bdb87

TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0457 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--678102a1-38ac-4d10-a0cc-a1c0cb47c78a

Sophos Netwalker May 2020 · TrendMicro Netwalker May 2020

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6bca8252-8339-470b-a994-519eee5ea3ec

Prevailion DarkWatchman 2021

ATTACK:enterprise:T1027.010 → subtechnique-of → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7139ac4a-7ece-47da-a5e5-0da99847d6fa

ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75a779b1-7b77-40bd-86cd-7ef5e54e78c1

Cybereason OperationCuckooBees May 2022

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79633fcf-d22a-40f0-a9be-52fc0608825f

Cycraft Chimera April 2020

ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b2113c8-9b48-4f93-9090-3946a980c183

Cyber Forensicator Silence Jan 2019

ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b5178ce-a9bc-405e-b062-22b4276fbf99

GitHub Invoke-Obfuscation · Unit 42 QUADAGENT July 2018

ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7bb7b19e-83dc-4095-83b5-f647bf5f2800

Bromium Ursnif Mar 2017

ATTACK:enterprise:S0270 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80bdb12e-5bf8-4f3c-aaba-185f31a7ad0a

GitHub Invoke-Obfuscation · Unit 42 DarkHydrus July 2018

ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82ce1bf6-b1a1-4a82-9c86-8ff372d6a873

FireEye Obfuscation June 2017 · FireEye Know Your Enemy FIN8 Aug 2016 · Bitdefender FIN8 July 2021

ATTACK:enterprise:S0462 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--856aff2c-9289-4c45-ade7-24cb3c338003

Unit 42 CARROTBAT November 2018

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--905e27bb-8d9b-4185-b5e6-4febc5d17333

Costa AvosLocker May 2022 · Cisco Talos Avos Jun 2022

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95fc970d-98cd-4bc9-895a-9534ba89c795

FireEye Obfuscation June 2017 · FireEye FIN7 Aug 2018 · CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b222cfd-8b08-4843-8b08-32e2476aba36

Unit 42 Valak July 2020

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9f6eef25-7a90-4f74-a788-8022166952f8

Talos Emotet Jan 2019 · Picus Emotet Dec 2018 · ESET Emotet Dec 2018 · Trend Micro Emotet Jan 2019

ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4e89138-7df9-4be1-9d45-4089f1744ad0

ATT Sidewinder January 2021 · Rewterz Sidewinder APT April 2020

ATTACK:enterprise:S0277 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7590c10-ba0a-453d-b086-1b3427e20462

objsee mac malware 2017

ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8b86839-9c18-465d-aa02-0f0b0132421b

Cybereason TA505 April 2019 · Deep Instinct TA505 Apr 2019

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab60e20c-3b1f-4895-995a-e48e50bedb1d

Check Point Wirte NOV 2024

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ae6620d4-5320-4e5a-a61a-5bda4ac1c9e4

ESET Turla PowerShell May 2019

ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--af15ac73-56cc-4a16-bcf9-806c93c5f321

Trend Micro SharePoint Attacks JUL 2025 · Eye Research ToolShell JUL 2025 · SentinelOne ToolShell JUL 2025 · Microsoft SharePoint Exploit JUL 2025 · Palo Alto SharePoint Vulnerabilities JUL 2025

ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b145e291-ce58-4174-b0e2-e0c5bc51e151

SecureListUbiedo_Tsundere_Nov2025

ATTACK:enterprise:S0390 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b1c27a03-1598-41eb-b2e6-426704d22ba8

Flashpoint FIN 7 March 2019

ATTACK:enterprise:S0450 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b5952b5f-281b-4ff4-9cfb-c2898f3028cc

TrendMicro POWERSTATS V3 June 2019

ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b82ea861-86df-4574-9727-f0d5828e9fe8

Unit 42 BackConfig May 2020

ATTACK:enterprise:G0115 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba7fad22-26af-43f1-a120-6a4d4269d9ab

Tetra Defense Sodinokibi March 2020

ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--baf31b81-e175-49e3-b2d9-d7552ea902a1

ClearSky MuddyWater Nov 2018 · TrendMicro POWERSTATS V3 June 2019 · FireEye MuddyWater Mar 2018

ATTACK:enterprise:S0330 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bfbde4cb-a8e5-4e55-8700-7d25b17ecad1

Talos Zeus Panda Nov 2017

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c0a4bcc3-8e3c-4f92-8b87-db70483e10e4

FoxIT Wocao December 2019

ATTACK:enterprise:G0140 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c18296e4-93a2-4f75-8bcb-4a05692d9940

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c3616986-bffd-486d-acc9-68aebc17849b

ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · SecurityScorecard Contagious Interview October 2024 · Securonix Contagious Interview DEVPOPPER April 2024 · Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024

ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c97d4d74-994a-48eb-8175-5e897c98b99a

Cybereason Astaroth Feb 2019

ATTACK:enterprise:S0492 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d3142001-8501-474a-a0cd-2e12bba52148

Unit42 CookieMiner Jan 2019

ATTACK:enterprise:S0669 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d4c1ae1c-e258-4cce-9047-1557e1bdb680

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d9ae6db9-d29e-4576-8567-520920c7ef79

McAfee RedLine Stealer April 2024

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de38c540-354f-4ac7-b79a-b5a4b40567f3

MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e17c193a-d616-42d3-9525-940f3424c96c

ESET Gamaredon June 2020 · Microsoft Actinium February 2022 · ESET Gamaredon Sept2024 · SymantecCarbonBlack_ShuckwormUSB_Apr2025

ATTACK:enterprise:S1248 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e7c4553f-442f-456f-82ee-9fdb6c6c7c40

Socket BeaverTail XORIndex HexEval Contagious Interview July 2025

ATTACK:enterprise:G0090 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eaadb798-4690-42c9-b545-180bceb88736

Check Point Wirte NOV 2024

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f12b1234-4eb8-4b3d-8b84-50df8dfa8df9

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd78292b-d484-4d08-baa4-f6b58bb63622

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fdf56c06-8e42-4cb5-b6e0-a7ec55355ff6

ESET Machete July 2019 · Cylance Machete Mar 2017

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.