Skip to content

Masquerading

Technique · ATTACK:enterprise:T1036

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1036",
  "title": "Masquerading",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1036",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--42e8de7b-37b2-4258-905a-6897815e58e0",
  "external_id": "T1036",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:38.511Z",
  "modified": "2026-05-12T15:12:00.629Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "LOLBAS Main Site",
      "url": "https://lolbas-project.github.io/"
    }
  ]
}

Explicit source assertions (81)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0446f0ed-4214-4294-ba65-962b4fe08b08

ATTACK:enterprise:T1036.008 → subtechnique-of → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--064f8984-e6cc-4334-a5ad-903a7af9bf4c

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06b18704-e29e-4bf9-900f-44aa719df0c6

FireEye APT10 Sept 2018

ATTACK:enterprise:T1036.003 → subtechnique-of → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b24b8de-944d-49ea-a15f-cb732aeb31de

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d7c99f4-b1af-4278-b8bf-3bb04cce166d

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:T1036.006 → subtechnique-of → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10fdc4f4-9f50-40d8-94db-966fcc434a14

ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18ff6d49-0bcb-4878-8a01-821ad1091ef0

Sekoia ClickFake 2025 · Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024 · ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024 · PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023 · PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024

ATTACK:enterprise:C0046 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b45a6b4-8c3e-49c2-948c-5606ec872003

Cisco ArcaneDoor 2024

ATTACK:enterprise:S0453 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--237cd65a-e30e-4f8a-9822-f50b818e1491

Malwarebytes Pony April 2016

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25207694-a0db-46df-bbe8-f700aeb80418

ATTACK:enterprise:S0565 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--288d8f70-d2af-44f8-86c9-fb8c2cd5103f

Symantec RAINDROP January 2021 · Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c595799-aebe-40f3-baa1-0e52cacee8b5

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f2432b0-d985-41d8-bc47-e4aa1dbf8372

Trend Micro Tick November 2019

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f249959-a448-454d-85ab-f71c8c5ff277

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ffc25c4-3939-40df-841c-91059c6879d4

Check Point APT34 April 2021

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33134dd2-7bc5-47a1-a06a-101f3ecf2878

Cadet Blizzard emerges as novel threat actor

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34371a06-bc30-47c0-89c7-cae8bb7a6f22

Leonard TAG 2023

ATTACK:enterprise:S1018 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37e3dbd7-9ecc-4e3a-9fa3-488e3a910f55

Malwarebytes Saint Bot April 2021 · Palo Alto Unit 42 OutSteel SaintBot February 2022

ATTACK:enterprise:G0133 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3cc1b62f-5059-4fb1-be06-72bb13498002

Securelist Octopus Oct 2018

ATTACK:enterprise:T1036.004 → subtechnique-of → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49c28aef-b7a2-464f-af3d-e104f9edf119

ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d7fd920-ea04-483b-98bf-dbf7bfac67f4

Google Salesforce JUN 2025

ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f2f6d11-519c-4489-9104-e3d3b72ef3a8

SoučekESET_Gentlemen_Jun2026

ATTACK:enterprise:M1045 → mitigates → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4fd3ec25-00ed-48c1-af72-e2523959860e

ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51650560-9aff-460b-9766-14c83bdb2198

trendmicro xcsset xcode project 2020 · Microsoft March 2025 XCSSET

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5566a165-9435-4683-9461-870f15450fd3

ATTACK:enterprise:S1066 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c6230da-a47d-435f-9836-49648f03e76e

Secureworks DarkTortilla Aug 2022

ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5cd22798-0d6e-4bed-b139-c46a4cfa87a5

Kroll RedLine Stealer August 2024

ATTACK:enterprise:T1036.002 → subtechnique-of → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e7f7b93-bf98-4528-b6bc-dc60e47af788

ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61f793e5-6b95-46db-a54d-74745747a3d5

Aikido GlassWorm October 2025 · Koi GlassWorm Rust December 2025

ATTACK:enterprise:S0661 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c0510e4-a642-4dfe-9632-dff6f97e09de

MSTIC FoggyWeb September 2021

ATTACK:enterprise:S0696 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--702c674e-110e-4f6d-9117-be1803d84e88

NTT Security Flagpro new December 2021

ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72de6e56-e5d1-4a3f-aa85-d7155f7ff42c

ATTACK:enterprise:T1036.005 → subtechnique-of → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73672e43-5a42-4b6a-934b-a52f57bdd7ac

ATTACK:enterprise:G1030 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73952ccb-9ad7-405d-94f4-ad75fdfb8507

Unit42 Agrius 2023

ATTACK:enterprise:S1046 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--757e8e47-b89d-4a70-a785-deefe6468006

DHS CISA AA22-055A MuddyWater February 2022

ATTACK:enterprise:S1015 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b43c9ba-49bc-4966-a987-2f991d0f44a2

ClearSky Siamesekitten August 2021

ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c0d0a39-3a59-450b-8101-3e79792cd37f

IBM StrelaStealer 2024

ATTACK:enterprise:S0466 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81603db2-a657-4716-a7ca-e6562799e98e

objective-see windtail1 dec 2018

ATTACK:enterprise:S0635 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--84be9d61-ec20-4066-8c99-b99d9127fce2

MSTIC Nobelium Toolset May 2021

ATTACK:enterprise:T1036.011 → subtechnique-of → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d0b4152-800e-4a22-ae48-7701beb7c682

ATTACK:enterprise:T1036.007 → subtechnique-of → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8dda1296-0835-4748-92a3-24b34eb8a084

ATTACK:enterprise:T1036.010 → subtechnique-of → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--937daf9d-0f3c-4257-85ac-86bf104453da

ATTACK:enterprise:G1007 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--945ebd48-f638-469c-a106-113ab8bbf408

SentinelOne Aoqin Dragon June 2022

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--970e9eb2-51d7-4986-9480-d8a3b59c3006

Cisco Talos Intelligence Group

ATTACK:enterprise:G0140 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--99717cce-1987-4ca1-8df2-c6ec6ce17cf5

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:S1164 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--99bc173b-a825-483c-969e-868356209ff6

Volexity UPSTYLE 2024

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a292f2c5-a071-424e-b8b8-03d195c466ad

Cybersecurity Advisory GRU Brute Force Campaign July 2021

ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a38af2cc-ccc7-41aa-936c-fe15a13ddafa

Eset Ramsay May 2020

ATTACK:enterprise:G0128 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3990ec1-b4bb-43dd-b7d8-51bd3cb7e1c7

Google Election Threats October 2020 · Zscaler APT31 Covid-19 October 2020

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a53879ca-2185-42ea-84de-823878fb871d

Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022

ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a69c8555-cd70-40ca-a250-d6e9c57f9279

Lumen KVBotnet 2023

ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8126b8d-8dd7-4e12-a384-96dabb975725

Cyberreason Anchor December 2019

ATTACK:enterprise:S0368 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab372993-3d63-4ca3-a064-e4b5820d8970

Talos Nyetya June 2017

ATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aba65eb4-6bd9-40bc-9b06-48b86e9a85e2

Cylance Dust Storm

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad880548-e776-4e7b-995d-ce6fdc91e865

objective-see windtail1 dec 2018 · BlackBerry Bahamut

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b771894c-366a-4e73-af67-d6d43d2c9881

rapid7-email-bombing

ATTACK:enterprise:T1036.001 → subtechnique-of → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--baedd4b3-1fc9-4056-a282-322496a3cceb

ATTACK:enterprise:S0637 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc2fe4e7-cb7c-4707-b28b-a709c2ac017d

SentinelOne NobleBaron June 2021

ATTACK:enterprise:T1036.012 → subtechnique-of → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c0ebb63b-b083-4373-9257-8f3fb0d1b856

ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c3c1440f-4585-47a6-8864-e5d3a22c2b84

SentinelOne WinterVivern 2023

ATTACK:enterprise:S9038 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c5fe3e1e-775e-4fe6-8a70-0a7e70835081

CERT Polska · ESET DynoWiper Update JAN 2026

ATTACK:enterprise:S1246 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb88a1a6-33a4-4c1a-a6ad-10b4b5f827dd

PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024

ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d4e0558a-83e2-4d99-bc80-aff1bb367724

Medium S2W WhisperGate January 2022

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dc595175-bd4d-4409-829b-43c42b762647

ATTACK:enterprise:T1036.009 → subtechnique-of → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ddc5f723-da25-42b0-b281-4cc20d3e8da1

ATTACK:enterprise:S0446 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--df3548d1-800d-4d18-8566-3a5fe925a2ef

ANSSI RYUK RANSOMWARE

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e67bb9cd-a76c-4666-a3e5-1e466dceb22b

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ea99ff52-af1e-49af-9cfe-b224c9a9eea4

Secureworks BRONZE PRESIDENT December 2019 · Trend Micro DRBControl February 2020

ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eb5ade8c-73e9-4b69-9dea-c8a8206dec25

ATTACK:enterprise:S0497 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ebfa89db-b37b-4b66-a820-b863bd012b80

SentinelOne Lazarus macOS July 2020

ATTACK:enterprise:S0682 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eca68811-ebe9-4ee0-8fb0-afa5975eb938

CrowdStrike StellarParticle January 2022

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed149b2f-6743-4d06-b869-158c0f96746e

Cisco Talos Avos Jun 2022

ATTACK:enterprise:S0634 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f09c9f4a-345f-4352-aaba-7b0b0a24085c

MSTIC Nobelium Toolset May 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2a58ddd-c9d8-4769-a93b-2e876e304105

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2e075b3-1125-4259-bf0b-1ff90c738354

Unit 42 TA551 Jan 2021

ATTACK:enterprise:G0068 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f3b19f07-d8a9-4aca-a649-039024997a4f

Twitter ItsReallyNick Platinum Masquerade

ATTACK:enterprise:S0615 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f40170e7-5246-442e-95ad-1b810107b8b8

CISA AR21-126A FIVEHANDS May 2021

ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f981c633-9333-4c7d-a168-7bea28f64d52

Unit42 Redaman January 2019

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd094102-e496-4dcf-bbf1-1630a762019d

Ensilo Darkgate 2018

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff7ecfd6-bbe0-4fc6-9ea2-551ff2359157

McAfee Honeybee

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.