aol.pm

Visual Basic

Subtechnique · ATTACK:enterprise:T1059.005

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1059.005",
  "title": "Visual Basic",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1059/005",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--dfd7cc1d-e1d8-4394-a198-97c4cab8aa67",
  "external_id": "T1059.005",
  "domain": "enterprise",
  "created": "2020-03-09T14:29:51.508Z",
  "modified": "2026-05-12T15:12:00.722Z",
  "version": "1.5",
  "aliases": [

  ],
  "tactics": [
    "execution"
  ],
  "source_references": [
    {
      "source_name": "VB .NET Mar 2020",
      "url": "https://devblogs.microsoft.com/vbteam/visual-basic-support-planned-for-net-5-0/"
    },
    {
      "source_name": "Default VBS macros Blocking ",
      "url": "https://techcommunity.microsoft.com/t5/microsoft-365-blog/helping-users-stay-safe-blocking-internet-macros-by-default-in/ba-p/3071805"
    },
    {
      "source_name": "Microsoft VBScript",
      "url": "https://docs.microsoft.com/previous-versions//1kw29xwf(v=vs.85)"
    },
    {
      "source_name": "Microsoft VBA",
      "url": "https://docs.microsoft.com/office/vba/api/overview/"
    },
    {
      "source_name": "VB Microsoft",
      "url": "https://docs.microsoft.com/dotnet/visual-basic/"
    },
    {
      "source_name": "Wikipedia VBA",
      "url": "https://en.wikipedia.org/wiki/Visual_Basic_for_Applications"
    }
  ]
}

Explicit source assertions (137)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0077d777-1e32-4b34-ab12-461b34110ffe

Talos Lokibot Jan 2021

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01d1922c-6900-4ed3-8ddf-bae4d06296b3

TrendMicro Patchwork Dec 2017 · Volexity Patchwork June 2018

ATTACK:enterprise:C0025 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--029ee791-c82b-43b4-8107-e3c0dfcfe3f4

Dragos Crashoverride 2018

ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03a8b070-a7dd-43b0-a044-1cf9f999475b

Securelist Brazilian Banking Malware July 2020 · ESET Grandoreiro April 2020

ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--04aedfef-4f86-414f-8465-4fdc3f419aa9

ESET MirrorFace 2025

ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0614fc3b-614c-4d50-9ae2-ab526160faf5

Unit 42 BackConfig May 2020

ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0862c2ff-157e-4ccd-973a-2b74cb6c79f1

ZScaler Squirrelwaffle Sep 2021 · Netskope Squirrelwaffle Oct 2021

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08738197-aa06-4177-acc2-10569c39f423

Github Koadic

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0884b8fd-64b4-4736-b52d-0182d312b9bf

PTSecurity Higaisa 2020

ATTACK:enterprise:S0585 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08e172e1-561d-4bb9-a1a5-259131686547

Unit 42 KerrDown February 2019

ATTACK:enterprise:S0477 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--097a4294-e9e6-46a1-8ecb-06ab0b00d773

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0cd688c6-1e0b-4004-b4fd-bbfb79478dd4

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:G0085 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ef0077e-ee87-4e67-a466-2085a9148fc9

FireEye Hacking FIN4 Video Dec 2014 · FireEye Hacking FIN4 Dec 2014

ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f27ea83-21e7-4a9f-9c66-85fe85da5135

ATTACK:enterprise:G0090 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f7fd21f-9cba-411a-a8dc-f5689d294037

Lab52 WIRTE Apr 2019

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--116f105a-ee8c-4544-9164-a0a28a572228

BlackBerry Bahamut

ATTACK:enterprise:T1059.005 → subtechnique-of → ATTACK:enterprise:T1059

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1313b6ce-f09b-4747-abd9-0220293d60f3

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13ac3b6b-d008-44fa-88c3-53d0927961d2

Symantec Waterbug Jun 2019

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1461fa53-bc4f-4ae5-b131-3f6058e6a72a

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--149f62ba-b5c1-4dcb-b677-a45b72cf5d7b

Kaspersky Adwind Feb 2016

ATTACK:enterprise:S1064 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--188366e1-a2a9-4025-ac5a-ce56d940094a

HP SVCReady Jun 2022

ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a69dce6-b39e-4cd2-a29a-18e42293c51a

Default VBS macros Blocking

ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f6da45b-bf15-47d7-ab80-5c110b0f4d62

McAfee Lazarus Jul 2020 · ClearSky Lazarus Aug 2020

ATTACK:enterprise:S1086 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20740afb-283e-4143-ab47-685d4c73beda

Telefonica Snip3 December 2021 · Morphisec Snip3 May 2021

ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21117898-adc0-41c1-9e2e-2551e638ef71

Unit42 Xbash Sept 2018

ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--245ced0a-5a53-44bd-a4db-07451f752b14

TrendMicro EarthLusca 2022

ATTACK:enterprise:G0075 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2466dc21-d32d-4a62-a815-8f1d5d09d88d

Rancor Unit42 June 2018

ATTACK:enterprise:C0007 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d0de5c1-ff34-44b5-ba47-b3841eb1b8f3

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d352952-c19d-4e1d-8d23-1001f69b74d0

Anomali MUSTANG PANDA October 2019 · Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · Secureworks BRONZE PRESIDENT December 2019 · Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023 · Crowdstrike MUSTANG PANDA June 2018

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--312f53be-d610-4c7c-af9b-44148c07bf7e

Proofpoint Operation Transparent Tribe March 2016 · Kaspersky Transparent Tribe August 2020

ATTACK:enterprise:S0442 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--338371ce-f2c3-4401-9e9a-c4c5667f87cb

Kaspersky Cloud Atlas August 2019

ATTACK:enterprise:S0343 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3456ec22-b2ac-470d-8a01-f5d5797a3521

ESET TeleBots Oct 2018

ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34ad093b-408b-4694-8aba-862f8de10102

Securelist Brazilian Banking Malware July 2020

ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--378914cd-36cf-409f-8c99-25e144218546

Cyber Forensicator Silence Jan 2019

ATTACK:enterprise:S0228 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a31a022-8bb1-4102-9c9a-7289febdcc5c

fsecure NanHaiShu July 2016

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a6022ea-7647-4d61-8103-dd354d8dfd4d

ESET Gamaredon June 2020 · CERT-EE Gamaredon January 2021 · TrendMicro Gamaredon April 2020 · Microsoft Actinium February 2022 · ESET Gamaredon Sept2024 · Secureworks IRON TILDEN Profile · SymantecCarbonBlack_ShuckwormUSB_Apr2025

ATTACK:enterprise:S0582 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e55d71d-b733-41a9-9ad2-a53131617c78

Proofpoint LookBack Malware Aug 2019

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f0e6cfa-7edc-4eaa-bc03-754d0f46d605

FireEye FIN7 Aug 2018 · Flashpoint FIN 7 March 2019 · CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:S1193 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40705d29-f7f1-4a9d-b66b-e03f8ab16471

Mandiant APT42-untangling

ATTACK:enterprise:S0631 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40ac660a-5f6d-4cac-8518-bb8dff6933ea

Cybereason Chaes Nov 2020

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--415b6755-70d1-433c-b076-3598dcaa9c7d

Donut Github

ATTACK:enterprise:S1178 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41681a87-79e2-4daf-bc5f-cdfea1b47a50

Kaspersky ShrinkLocker 2024 · Splunk ShrinkLocker 2024

ATTACK:enterprise:S0226 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4287de65-be1d-44aa-9c50-9c391e321597

Malwarebytes SmokeLoader 2016

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--457cc54b-4fd9-490f-bb2f-d7d559624388

CISA AA20-239A BeagleBoyz August 2020 · Microsoft CYBERWARCON NOV 2024 · Microsoft Axios Compromise APR 2026 · 1 - appv

ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4647d052-512b-41cf-a8db-cb33c49edc90

FireEye NETWIRE March 2019 · Proofpoint NETWIRE December 2020

ATTACK:enterprise:G0095 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--472878d3-3a6a-4ad2-8fcf-e73a74fd48b6

360 Machete Sep 2020

ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4806e7c3-c8df-477f-ac3b-819248878a79

Unit 42 Bisonal July 2018 · Talos Bisonal Mar 2020

ATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49dcbb09-c4d8-4ade-8429-94afe0b9747b

G Data Sodinokibi June 2019 · Picus Sodinokibi January 2020

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a0ee05d-f020-4811-bba6-56d12c15e275

ClearSky MuddyWater Nov 2018 · ClearSky MuddyWater June 2019 · Securelist MuddyWater Oct 2018 · Talos MuddyWater Jan 2022 · Trend Micro Muddy Water March 2021 · Reaqta MuddyWater November 2017 · FireEye MuddyWater Mar 2018 · Symantec MuddyWater Dec 2018 · MuddyWater TrendMicro June 2018

ATTACK:enterprise:S0696 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f5f0017-9924-4737-aa42-b4cbbce20099

NTT Security Flagpro new December 2021

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51e59a65-1ca2-4649-afa0-f9244d323315

Mandiant APT42-untangling

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--529360d5-172a-4326-b993-e3af75d3e7af

Secureworks BRONZE BUTLER Oct 2017 · Trend Micro Tick November 2019

ATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55c1d32b-f6f7-46ee-9749-f9a91033b267

Mandiant APT43 March 2024

ATTACK:enterprise:G0142 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--565d59a0-e2a6-45d2-b655-cff8d02f7ebf

TrendMicro Confucius APT Feb 2018

ATTACK:enterprise:C0001 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59de6826-2503-422d-9e53-b3c0a43738dd

Talos Frankenstein June 2019

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59fd7bfd-f99b-4a76-9ea0-4fc89c27f204

Cybersecurity Advisory SVR TTP May 2021

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a166a20-4191-429c-9fd0-f566a86f0753

Cobalt Strike TTPs Dec 2017 · Talos Cobalt Strike September 2020 · CobaltStrike Daddy May 2017

ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5aaee352-e4b5-4d4c-b021-9f38adb346da

IBM TA505 April 2020 · Trend Micro TA505 June 2019 · Proofpoint TA505 Sep 2017 · Proofpoint TA505 June 2018

ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5f7db516-c204-4e6b-9bda-b891bf763843

Symantec Bumblebee June 2022 · Proofpoint Bumblebee April 2022

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60bab055-6927-4240-8716-6218dc131aa9

TrendMicro MacOS April 2018

ATTACK:enterprise:S0170 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--610fcccc-c03a-4bd1-8f86-95802fe33cba

Palo Alto OilRig May 2016

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--675f24e0-c445-4eb3-a191-16fb181f6e30

Unit 42 Magic Hound Feb 2017

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--676efaa5-591b-46b3-abb2-a0b308e037db

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68a15e63-2f89-4828-8be3-4494d7ff36e3

Malwarebytes RokRAT VBA January 2021

ATTACK:enterprise:S0679 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--699bbb0a-3b06-4def-ad89-994c8981fa28

Kaspersky WIRTE November 2021

ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--69b07a47-2d70-4672-9771-92fa4280b3d3

Unit 42 QUADAGENT July 2018

ATTACK:enterprise:G0140 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f1ea286-593c-4255-9ea8-708e04184987

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:S0648 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72549a7f-7996-4ddc-bcde-a48b1e3d7059

CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:G1026 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--785b597e-cd9b-4598-80d9-51f060b27f0a

SCILabs Malteiro 2021

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c1e0451-66d7-4445-9b8d-8d9770043421

Qualys LolZarus · Lazarus APT January 2022

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d115073-c008-4394-867d-07c385d3db87

Talos Cobalt Group July 2018 · PTSecurity Cobalt Group Aug 2017 · Group IB Cobalt Aug 2017 · Morphisec Cobalt Gang Oct 2018 · Unit 42 Cobalt Gang Oct 2018 · TrendMicro Cobalt Group Nov 2017

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d2c1704-b190-4b47-854c-5c1e122fa5ce

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:S1018 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e000a72-a127-4cb4-be17-9541593462f6

Palo Alto Unit 42 OutSteel SaintBot February 2022

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f80cb84-3cb5-4de3-a484-1c0a60e2dbcf

Check Point APT34 April 2021

ATTACK:enterprise:S1132 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8171e1a4-6a31-4acd-aba8-c04f9d6b8e36

SentinelOne Agrius 2021

ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86bfc0ee-73e0-4f1b-a4f9-f8e44eae2dc3

MalwareBytes SideCopy Dec 2021

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86d110ea-060e-462f-a520-ad650564c05e

FoxIT Wocao December 2019

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--875eff48-2319-4e86-b3cf-0f17d6253b9c

win10_asr

ATTACK:enterprise:S0244 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87c25621-eef0-49ae-b4ef-9eac3b7ef841

Palo Alto Comnie

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88309efb-b366-4c4a-bd23-ba43b9f05c4c

Symantec Emotet Jul 2018 · Talos Emotet Jan 2019 · Trend Micro Emotet Jan 2019 · Picus Emotet Dec 2018 · Carbon Black Emotet Apr 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.