Skip to content

Masquerade Task or Service

Subtechnique · ATTACK:enterprise:T1036.004

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1036.004",
  "title": "Masquerade Task or Service",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1036/004",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c",
  "external_id": "T1036.004",
  "domain": "enterprise",
  "created": "2020-02-10T20:30:07.426Z",
  "modified": "2026-05-12T15:12:00.644Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "Fysbis Dr Web Analysis",
      "url": "https://vms.drweb.com/virus/?i=4276269"
    },
    {
      "source_name": "Palo Alto Shamoon Nov 2016",
      "url": "http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/"
    },
    {
      "source_name": "Systemd Service Units",
      "url": "https://www.freedesktop.org/software/systemd/man/systemd.service.html"
    },
    {
      "source_name": "TechNet Schtasks",
      "url": "https://technet.microsoft.com/en-us/library/bb490996.aspx"
    }
  ]
}

Explicit source assertions (96)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--038059c4-ff9c-4d4e-982e-632e1f27d254

CheckPoint_NimbusManticore_May2026

ATTACK:enterprise:S1033 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07019af0-e801-48c7-a3bd-efc637003aa2

Checkpoint MosesStaff Nov 2021

ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d989c2e-0207-4412-b52a-5d9bf9f96d18

FireEye APT10 April 2017

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14398d6b-aeb3-4d7c-9c65-9dfa1ab162ce

Crowdstrike HuntReport 2022

ATTACK:enterprise:S1064 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15563e89-85cc-4092-a359-4351999bb9f3

HP SVCReady Jun 2022

ATTACK:enterprise:C0034 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1747e509-d1d8-4d30-bde5-65adeccb2dae

Mandiant-Sandworm-Ukraine-2022

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20a9afe3-de36-428e-a054-cce863b2f4e9

ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20ac9204-3ee3-454d-9d53-d5caa9ec582e

ESET Attor Oct 2019

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20cedb41-1f7b-44df-8d49-5d6fc166c557

Sophos Maze VM September 2020

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--240ba2e0-c718-4327-a6a6-cb35d6145c35

Unit42 RDAT July 2020

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2447ac98-019d-40a9-8913-c97d6eb93d90

CISA AA20-301A Kimsuky · Securonix Kimsuky February 2025

ATTACK:enterprise:G0008 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28a4517c-89b9-4744-a58f-6a1f1fec3c33

Kaspersky Carbanak

ATTACK:enterprise:S1042 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2913137b-33ce-4488-a274-25fc9198d693

Mandiant UNC3890 Aug 2022

ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ccf654b-1077-4277-9a24-099fb3bf095f

ClearSky MuddyWater Nov 2018

ATTACK:enterprise:S0410 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d0510d6-765b-4352-8ddc-36556831215b

Fysbis Dr Web Analysis

ATTACK:enterprise:S0688 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--349025c3-f266-41ce-a738-330b5e7f1b4e

Check Point Meteor Aug 2021

ATTACK:enterprise:S0169 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37aa4e22-824b-468c-ae46-d9d007cc7cc7

Kroll RawPOS Jan 2017 · TrendMicro RawPOS April 2015 · Mandiant FIN5 GrrCON Oct 2016

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37ba7858-8765-4445-a65e-d2765b673b34

Morphisec FIN7 June 2017

ATTACK:enterprise:S9042 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--380bd384-e2c5-418b-9b69-740b03d9a3c7

Aikido TeamPCP Trivy MAR 2026 · Palo Alto TeamPCP MAR 2026

ATTACK:enterprise:S0629 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3922a8b2-5a5d-4822-be22-75f246d56fa4

Bitdefender Naikon April 2021

ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c630128-27ba-4c71-b09a-c9ac39e7acac

Palo Alto Shamoon Nov 2016 · McAfee Shamoon December 2018

ATTACK:enterprise:S1013 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--452ebe8a-fc71-42e2-994f-2a974ab16c8d

Cisco Talos Bitter Bangladesh May 2022

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47131d16-bc98-4883-913f-1277066eb9a0

Cisco Talos Qilin Ransomware OCT 2025

ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47b6edf8-f827-4ecc-8c83-007bb2553f5b

TrendMicro RaspberryRobin 2022

ATTACK:enterprise:T1036.004 → subtechnique-of → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49c28aef-b7a2-464f-af3d-e104f9edf119

ATTACK:enterprise:S0471 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--506ed241-ba1e-47da-901a-d1943510d4b5

Trend Micro Tick November 2019

ATTACK:enterprise:S1031 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5647a587-99fc-497b-80b7-ed63ee6126a6

Unit 42 PingPull Jun 2022

ATTACK:enterprise:S0491 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--580254b6-1227-4c7d-a7b5-c4e7908e0acb

Talos Promethium June 2020 · Bitdefender StrongPity June 2020

ATTACK:enterprise:S0345 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--597555f7-33e3-4699-9acf-9c7f15a850c9

Mandiant APT1 Appendix

ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b530bcc-d137-4b4c-a22f-a3c15ec2f101

Malwarebytes Konni Aug 2021

ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c039dbf-c443-4f9b-b036-fcabaed74a3b

CISA MAR SLOTHFULMEDIA October 2020

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c6b16c7-9977-4d40-b0df-75eecf350298

Mandiant FIN13 Aug 2022

ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5cabd775-7d78-4150-b529-bb8cfb747013

QiAnXin APT-C-36 Feb2019

ATTACK:enterprise:S1044 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60269020-6ab2-496a-9649-3b1cd707aced

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:S1134 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60692cc5-ca97-4c1d-8011-8dbe111ca8f4

SentinelOne Agrius 2021

ATTACK:enterprise:S0527 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62a81aa2-bba1-47f3-81bc-ddc1912e2540

Cybereason Kimsuky November 2020

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65f315be-e62d-44a5-b21a-7211041a75bb

ESET Okrum July 2019

ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66db460f-5e90-4a79-a34c-f757f6c0b3ee

Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--684b6701-559f-4ba9-a2b0-f79ed5683eb1

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c6a8e6f-3340-4cd7-8abb-c39c408440f1

Intrinsec Egregor Nov 2020

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c92e9a2-ed4b-40ba-831e-91fcc60aebd4

ESET Machete July 2019

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e3bfea5-846f-46d4-9383-bdc59768c8f6

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f0b6cfd-ebe2-46f3-9be1-0075237dbcb9

FireEye APT32 May 2017

ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f2f2822-6858-4c8c-9d33-62d2ee17f1af

SentinelOne WinterVivern 2023

ATTACK:enterprise:S1011 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6fb99c55-5c27-4069-8348-2540f10848ba

Tarrask scheduled task

ATTACK:enterprise:S0601 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--718851be-6d2e-4073-86e1-d331198e2bc3

Unit 42 Hildegard Malware

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e555910-0e1b-403d-a369-e7a2e8e61670

CrowdStrike Grim Spider May 2019 · FireEye KEGTAP SINGLEMALT October 2020

ATTACK:enterprise:S0668 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e588158-1962-42d4-b836-0a2c764fdc5e

Talos TinyTurla September 2021

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--829794bf-ad71-4f31-8e78-df712d751419

Lunghi Iron Tiger Linux

ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--842c8968-1dab-46f9-838d-cb29d748fe5a

Cisco Talos Bitter Bangladesh May 2022

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--848da21a-d33d-4dc4-a948-4b0e30963d30

Unit42 Bookworm Nov2015

ATTACK:enterprise:S0178 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--84bc4ba8-ab0e-4c60-92ed-26496a831611

Microsoft Win Defender Truvasys Sep 2017

ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--874d4046-5b9a-4f60-88f4-79ae63a70a1e

Unit42 Redaman January 2019

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87c11236-9f13-4179-aa6f-7b0fe9124a13

FireEye FIN6 Apr 2019

ATTACK:enterprise:S0630 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87e49c65-5484-47f3-bcd6-a8cc6308c3f2

Bitdefender Naikon April 2021

ATTACK:enterprise:G0019 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--887465a0-6818-4e79-b86d-b83d3a0f39eb

Bitdefender Naikon April 2021

ATTACK:enterprise:S0581 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d305ed1-3ac5-4431-ae3c-766d430d9d5f

Unit 42 IronNetInjector February 2021

ATTACK:enterprise:S1090 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e0dd075-33a5-464a-822e-f0878982ebf8

MoustachedBouncer ESET August 2023

ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9949853c-ab7e-43c8-bc77-8b9b6bddba50

Lumen KVBotnet 2023

ATTACK:enterprise:S0118 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b1709f3-5062-42f1-82d9-191e66e1d14a

Symantec Backdoor.Nidiran · Microsoft SAM

ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c2766b3-87ff-4ec7-9ff4-faa3d4572eb4

Cybereason Bazar July 2020

ATTACK:enterprise:S0538 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d7c40f1-44ad-47ec-9a07-bc3b8f2d2cd1

ESET Crutch December 2020

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9da66aaa-79be-426c-8abe-3c68a9159e8b

Binary Defense Emotes Wi-Fi Spreader

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e6bbb1a-95c6-4f51-9aff-6b424c731cfc

Unit42 OceanLotus 2017

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a27943d2-6839-4be3-81ea-19ea6704d218

CISA AA20-259A Iran-Based Actor September 2020

ATTACK:enterprise:G0056 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5b0b3ae-737a-4f2b-bbe9-23ca214eb733

Talos Promethium June 2020 · Bitdefender StrongPity June 2020

ATTACK:enterprise:S0259 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7653df0-63f4-4632-b5a2-6b00aead446f

ASERT InnaputRAT April 2018

ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a9923513-b249-48bb-81da-8e58730855de

Recorded Future RedDelta 2025

ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab429228-9528-49c6-a986-7999199ab7f7

Mandiant Fortinet Zero Day

ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abdf9690-d578-4f86-a2cc-295c2789bb4e

Symantec Orangeworm April 2018

ATTACK:enterprise:S1217 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ae3397ba-a9b1-45d3-a102-db21dab54f18

Google Cloud Threat Intelligence ESXi VIBs 2022

ATTACK:enterprise:C0040 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b3bee3aa-2dd0-4268-8cfd-671ba779be1f

Google Cloud APT41 2024

ATTACK:enterprise:S0261 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b4c195b6-7b1f-4320-8040-e91c11ec8cbb

Symantec Catchamas April 2018

ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b5e58b07-8d96-4453-90b9-c257f152f6d4

Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

ATTACK:enterprise:C0001 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b84a9cf4-976d-452d-8de0-76e318078a5c

Talos Frankenstein June 2019

ATTACK:enterprise:S1052 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba116238-1da4-415f-94a8-d4c577a16561

ATTACK:enterprise:G0128 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--baefaf38-da2d-4864-9c96-3bf2352bc20b

Zscaler APT31 Covid-19 October 2020

ATTACK:enterprise:S0690 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bf906149-256b-4c05-971e-843c026a9a43

Objective See Green Lambert for OSX Oct 2021 · Glitch-Cat Green Lambert ATTCK Oct 2021

ATTACK:enterprise:S1140 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c11054b6-8e97-483d-b941-44dd723184f6

Google TAG COLDRIVER January 2024

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c235df18-28b1-48f9-bcfb-38f671005b5e

DFIR Phosphorus November 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.