Skip to content

Match Legitimate Resource Name or Location

Subtechnique · ATTACK:enterprise:T1036.005

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1036.005",
  "title": "Match Legitimate Resource Name or Location",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1036/005",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
  "external_id": "T1036.005",
  "domain": "enterprise",
  "created": "2020-02-10T20:43:10.239Z",
  "modified": "2026-09-11T19:59:49.678Z",
  "version": "3.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "Aquasec Kubernetes Backdoor 2023",
      "url": "https://www.aquasec.com/blog/leveraging-kubernetes-rbac-to-backdoor-clusters/"
    }
  ]
}

Explicit source assertions (230)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0083 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01ab8fee-5204-40c1-ac7a-b11a5683a87d

Cylance Dust Storm · Microsoft DTC

ATTACK:enterprise:S9065 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01e2c7fd-2fca-4ba0-81cb-ad0a3db779a9

Mandiant_UNC1549_Nov2025

ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--026e7bb0-2037-4bfc-b9ae-98e70530f22a

ATTACK:enterprise:S0629 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0529ea16-1644-455d-a682-27e1f04b8cd1

Bitdefender Naikon April 2021

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--069f77c1-aafd-4883-aecd-707802442427

Cisco Talos Intelligence Group

ATTACK:enterprise:S0459 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08057442-4b2c-4841-b351-8813431704e9

Unit 42 MechaFlounder March 2019

ATTACK:enterprise:S1050 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--095d33b5-523d-40ae-aad9-448910d527d3

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--095e5f7b-288c-4995-8045-b691602d38c9

ATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d50119b-b045-4d30-8ba7-ec1ce2d4be40

Aqua Security Blog Trivy Compromise APR 2026 · Aikido TeamPCP Telnyx MAR 2026 · Palo Alto TeamPCP MAR 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d6bcabd-39bd-458b-8efc-5d409d9c2339

Microsoft Axios Compromise APR 2026 · Microsoft Sapphire Sleet APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0def160c-4c74-477c-91b4-005603097cf2

2022 November_TrendMicro_Earth Preta_Toneshell_Pubload · Zscaler

ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f174d38-f30b-4037-a1bc-ecc099809966

CISA MAR SLOTHFULMEDIA October 2020

ATTACK:enterprise:S0081 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0fd5d3bc-d736-43c0-b9ec-f1dcd95411a7

Lotus Blossom Jun 2015

ATTACK:enterprise:S0072 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1088fc27-2de5-4b73-83fd-6741ab3ff4d6

ATTACK:enterprise:C0025 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10976d43-afcf-44d5-bcbf-122f39e0cbff

Dragos Crashoverride 2017

ATTACK:enterprise:S0482 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10c609ce-f256-436c-8288-3441cb123fc5

MacKeeper Bundlore Apr 2019

ATTACK:enterprise:S0085 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11874e26-e692-43da-bb54-760e51a4714f

Cylance Dust Storm · Microsoft DTC

ATTACK:enterprise:S1014 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1617d3d7-77c9-4a6b-bdd6-8914e0890495

ClearSky Siamesekitten August 2021

ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ad60707-d84f-4768-9013-6b499de49c40

NCSC Cyclops Blink February 2022

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e049e66-14ce-46d5-8af1-d93ea35f4aec

Unit 42 Gamaredon February 2022 · VenereCiscoTalos_Gamaredon_Mar2025

ATTACK:enterprise:S0668 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e1045dd-0ae7-427e-a205-d41c88b0a5d9

Talos TinyTurla September 2021

ATTACK:enterprise:S1203 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e15679d-de1c-47a8-a993-8d70fbffd6e4

Lumen J-Magic JAN 2025

ATTACK:enterprise:S0484 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--201502c6-d208-408b-b6f3-50e39dab14ca

Prevx Carberp March 2011 · Trusteer Carberp October 2010

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20384b7e-e720-44ed-9aea-7f6857ce18c1

CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2174c465-8855-4c92-a683-97eb0eba9f7c

Secureworks BRONZE BUTLER Oct 2017

ATTACK:enterprise:S1090 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2443296f-a8fc-431d-9865-d68dd6142b37

MoustachedBouncer ESET August 2023

ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2463fa2a-0264-4287-a87b-3d4ada527ac5

Proofpoint TA2541 February 2022

ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25398304-d7db-4180-864c-e123cd2ba041

CrowdStrike IceApple May 2022

ATTACK:enterprise:S9015 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25fe3382-4792-4fa7-b439-2249bf572e72

CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025 · CISA BRICKSTORM UNC5221 AR25-338A February 2026 · Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024 · Google BRICKSTORM September 2025

ATTACK:enterprise:S0171 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2843ccc2-4869-48a0-8967-b9856a778a2c

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--285baef5-e948-4e56-a078-5e7f5e7404fd

FireEye APT41 Aug 2019 · Group IB APT 41 June 2021

ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28aabd70-0158-42e3-8d2d-691b3abd5e8a

Wiz TeamPCP KICS MAR 2026

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29878d2d-b66f-488f-a721-d6b44885ef66

Mandiant APT42-charms

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a79e7df-12a8-41c3-990b-158c31ce9666

rapid7-email-bombing

ATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c8a4c1a-0faf-444d-a6b2-556c55374fa2

Picus Sodinokibi January 2020

ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d882b40-11c3-4b7e-a400-5e87ae2bd899

IBM Grandoreiro April 2020 · ESET Grandoreiro April 2020

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f33e27a-6fdf-4121-9e25-a307910b118f

Crowdstrike Indrik November 2018

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--306ab1b7-4926-43ae-8989-b0dde2a43111

BlackBerry_FIN7_April2024 · CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:C0030 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30ac4618-8059-4e7a-869a-4c3cb84577a2

ATTACK:enterprise:S0468 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30c69dcc-9cf7-4352-a30c-0e7bc86b38e7

Trend Micro Skidmap

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3109f288-8024-4ae4-a284-f4f87d94f33d

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3564dc8e-09d0-4855-8a90-d4c28a9488e5

Cisco Talos Avos Jun 2022

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--378bf78e-6c5c-4466-9d6b-a494ae375526

Volexity SolarWinds · Microsoft Analyzing Solorigate Dec 2020

ATTACK:enterprise:G1020 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37ad67f8-5b5c-4513-8465-fa584103f25b

SocGholish-update · Red Canary SocGholish March 2024

ATTACK:enterprise:S1011 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--388e6809-55d3-4689-93b1-ddd9058b965c

Tarrask scheduled task

ATTACK:enterprise:S0138 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a241a6c-11ee-4abc-a551-b5d4e594aad4

ATTACK:enterprise:M1045 → mitigates → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c37c043-7f27-4fb9-ba7f-bce3181849ac

ATTACK:enterprise:S1182 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d975f4e-8fea-41f7-9b9f-d995e2a3ee4c

Cisco MagicRAT 2022

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e79db26-a2ce-4233-a86c-5a97b10dd937

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e82234f-db7b-4a0f-8c0a-979b01381a6a

FireEye MuddyWater Mar 2018 · Talos MuddyWater May 2019 · Anomali Static Kitten February 2021

ATTACK:enterprise:S1032 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40b50ac5-b1c1-4f80-b350-460cc0ed9f9f

Checkpoint MosesStaff Nov 2021

ATTACK:enterprise:G0090 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4258f16d-4484-4b5f-8a2b-76366b2ee46c

Check Point Wirte NOV 2024 · Kaspersky WIRTE November 2021

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42d4ae64-75da-4dfd-b23f-d270252115ee

Cymmetria Patchwork · Volexity Patchwork June 2018

ATTACK:enterprise:S0520 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44577477-b599-46f0-84bf-7e0de773d848

US-CERT BLINDINGCAN Aug 2020

ATTACK:enterprise:S0698 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47d25590-2bcb-4acf-81ac-24d7ef23db91

ESET Hermetic Wizard March 2022

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4899bf68-d60e-4132-a962-faafd35f0c4a

Unit42 RDAT July 2020

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48b75b8b-5bef-4f99-baa8-5fa978d371d2

Kaspersky ProjectSauron Full Report · ComputerWeekly Strider

ATTACK:enterprise:S1074 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49cf55fb-437d-439d-aeb7-466de585a0ed

Mandiant Suspected Turla Campaign February 2023

ATTACK:enterprise:S0565 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a942244-9b88-43d0-9a1c-c0277e7903e8

Symantec RAINDROP January 2021 · Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4c4cdef4-a2e9-42af-bd3d-876ae3cc2d4d

DOJ FBI Handala Hack March 2026 · FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d1b4d28-84c8-4ae4-9e04-c437dc391eac

Kaspersky Transparent Tribe August 2020

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4da943df-a7dc-499f-a8b7-ca8d298d8ff6

FireEye admin@338

ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4dee672e-a7ed-41de-94b6-83246688171d

Splunk LAMEHUG SEP 2025 · Nov AI Threat Tracker

ATTACK:enterprise:C0032 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e18fbf9-4e26-4425-bb09-f18406284368

FireEye TRITON 2019

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f17c215-893f-4c2d-9d9f-944b170d21e5

Trendmicro_IcedID

ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4feaa82b-a356-4412-be2b-daa6ea6df82c

TrendMicro EarthLusca 2022

ATTACK:enterprise:S0084 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ffe2425-c971-45e5-9256-0b1a2bf63bbf

Cylance Dust Storm · Microsoft DTC

ATTACK:enterprise:G0135 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5017f2dc-e43e-438b-b63f-5f3f4603e9db

ESET BackdoorDiplomacy Jun 2021

ATTACK:enterprise:S0526 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--506d7613-59ce-4fa4-90b3-f991691d5b93

Cybereason Kimsuky November 2020

ATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--509a016a-6243-40b1-b1b5-74f6c79ce413

ESET Bad Rabbit · Secure List Bad Rabbit

ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5263da97-9946-4768-99de-b5b7e91e52ba

Cisco Akira Ransomware OCT 2024

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5449bc94-31c6-471a-8525-23af9cdc25bd

CyberBit Dtrack

ATTACK:enterprise:S1158 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--558b32a6-f870-4d7f-bbdd-1590e21db2c3

Google Cloud APT41 2024

ATTACK:enterprise:S1196 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55eb87ba-64a9-4720-a3ce-fe03f66b074c

S2W Troll Stealer 2024 · Symantec Troll Stealer 2024

ATTACK:enterprise:G0137 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59d3a882-3f6d-442a-8fbe-bb2f9cecd2f5

Kaspersky Ferocious Kitten Jun 2021

ATTACK:enterprise:S1042 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59e2e811-8f23-40bc-ae20-040feb1fa1fe

Mandiant UNC3890 Aug 2022

ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59eef083-632d-412d-b8bd-de8ba39c8de6

SoučekESET_Gentlemen_Jun2026

ATTACK:enterprise:S0196 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a1876a1-144f-4416-b9bf-6df819613962

FireEye Know Your Enemy FIN8 Aug 2016 · Morphisec ShellTea June 2019

ATTACK:enterprise:S0340 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5bb90c4f-b260-4de2-8312-8de73df3fead

Securelist Octopus Oct 2018 · ESET Nomadic Octopus 2018

ATTACK:enterprise:S0446 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5cba4a5e-c005-495d-9cd6-60794d9b3247

CrowdStrike Ryuk January 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.