Skip to content

Junk Code Insertion

Subtechnique · ATTACK:enterprise:T1027.016

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1027.016",
  "title": "Junk Code Insertion",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1027/016",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--671cd17f-a765-48fd-adc4-dad1941b1ae3",
  "external_id": "T1027.016",
  "domain": "enterprise",
  "created": "2025-03-04T21:38:49.913Z",
  "modified": "2026-05-12T15:12:00.639Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "ReasonLabs",
      "url": "https://cyberpedia.reasonlabs.com/EN/dead%20code%20insertion.html"
    },
    {
      "source_name": "ReasonLabs Cyberpedia Junk Code",
      "url": "https://cyberpedia.reasonlabs.com/EN/junk%20code.html"
    }
  ]
}

Explicit source assertions (29)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0bbdc984-1515-4a8e-a211-2817371fc75e

McAfee Maze March 2020

ATTACK:enterprise:S0117 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c143634-89e1-47a0-9044-4ca39ccff76a

ESET Sednit Part 2

ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10ce7f0b-4e2d-4e56-9ae1-646f5b3ceba5

Fortgale StrelaStealer 2023

ATTACK:enterprise:S9053 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14c5552a-9352-4fb2-8904-aa8de6a4950a

CheckPoint_NimbusManticoreEurope_Sept2025

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19ab4bf2-7498-4f53-afd7-fc1a99a96187

Mandiant FIN7 Apr 2022

ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23f9a212-8dce-4677-a8c4-2e72e86a4ce8

Recorded Future TAG-144 AUG 2025

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28c17b23-901c-46d5-84f2-544401f68d83

ESET Gamaredon June 2020

ATTACK:enterprise:S0248 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37533c33-9cc4-4707-8b30-d8be6aeaefc6

ASERT Donot March 2018

ATTACK:enterprise:S0230 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47df35dd-7d45-452d-af46-d04348a6b363

Proofpoint ZeroT Feb 2017

ATTACK:enterprise:S9062 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4896c142-fabb-4b28-9fff-c4cb9af6f734

CheckPoint_NimbusManticoreEurope_Sept2025

ATTACK:enterprise:S0453 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b2fa1ed-6c4f-4974-a44e-beeadf3a887c

Malwarebytes Pony April 2016

ATTACK:enterprise:S0370 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4c44fea9-545c-4d2f-a5e9-caee38ee65b4

Sophos SamSam Apr 2018

ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63893202-b877-4ada-9844-dda729fc9b16

ITOCHU LODEINFO JAN 2024

ATTACK:enterprise:S0477 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6bf3a83b-d66d-4b6a-972c-c348686ebecb

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7fa8b980-bfe5-47e0-a5fd-3007ea2f6564

Securonix Kimsuky February 2025

ATTACK:enterprise:S0612 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97aa311a-04b1-473f-a298-1d230c82e881

NCC Group WastedLocker June 2020

ATTACK:enterprise:S0137 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b88372d-4f3f-4442-906d-9ab07e22e781

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5b3e4ab-3150-4dc0-b78a-e26b4c04d796

ATTACK:enterprise:T1027.016 → subtechnique-of → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ae282182-36be-41be-98bb-33ff7e5d29a6

ATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b10b7d66-3bee-4ebc-98c2-2eec2259e19e

Microsoft FinFisher March 2018 · FinFisher Citation

ATTACK:enterprise:S9027 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b219dd79-cc7d-4119-a5e9-80b3703730f2

Trend Micro Earth Kasha Anel NOV 2024

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d57fba3a-0ed8-49a1-9446-13a4b73c3bc5

ESET OceanLotus Mar 2019 · ESET OceanLotus

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d704a927-fe82-4e17-85e9-55009860bd13

Eset PlugX Korplug Mustang Panda March 2022 · Avira Mustang Panda January 2020

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e1d0aa1d-c1ce-4cbc-bed2-097d6ea256c4

ESET Gelsemium June 2021

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e5c565bd-dce1-4bdf-b45e-053f9c5b3712

Microsoft Sapphire Sleet APR 2026

ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee47ad7d-0c85-46fb-a4f7-047fdff09a03

TrendMicro POWERSTATS V3 June 2019

ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1a70ff1-a4e7-437e-96fd-8017feea0b5a

ESET Dukes October 2019

ATTACK:enterprise:S9019 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fa760bd6-1a7f-47ed-95b2-195cd3ab7bf8

Zscaler PureCrypter JUN 2022

ATTACK:enterprise:S9025 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ffece054-4a07-4089-9bcc-8a8b72ef0e30

JPCERT MirrorFace JUL 2024 · Trend Micro Earth Kasha NOV 2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.