Skip to content

Python

Subtechnique · ATTACK:enterprise:T1059.006

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1059.006",
  "title": "Python",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1059/006",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--cc3502b5-30cc-4473-ad48-42d51a6ef6d1",
  "external_id": "T1059.006",
  "domain": "enterprise",
  "created": "2020-03-09T14:38:24.334Z",
  "modified": "2026-05-12T15:12:00.716Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "execution"
  ],
  "source_references": [
    {
      "source_name": "Zscaler APT31 Covid-19 October 2020",
      "url": "https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"
    }
  ]
}

Explicit source assertions (71)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0581 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02f18eff-faf1-421b-a0e9-e9852833bb04

Unit 42 IronNetInjector February 2021

ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03b2c5b8-aeca-4232-a206-521b83d56c54

ATTACK:enterprise:S0547 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--088cbe38-25e2-42a0-b65e-252bb1865d18

Cybereason Molerats Dec 2020

ATTACK:enterprise:S1218 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a1f302f-42ae-4947-9b6b-8f89ead35d96

Google Cloud Mandiant UNC3886 2024 · Google Cloud Threat Intelligence ESXi VIBs 2022

ATTACK:enterprise:S0196 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b4ebc81-20fe-45f1-a93f-e6ca03c89114

Morphisec ShellTea June 2019

ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d4145da-e755-465f-a6fe-057ce43c627d

Volexity InkySquid RokRAT August 2021

ATTACK:enterprise:S9042 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0fbbc691-0be5-402b-96d7-68a96588381a

Aikido TeamPCP Trivy MAR 2026

ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11be19d8-c5f8-4f11-a26a-9e60e5d4b763

Google Salesforce JUN 2025

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--138fb337-c378-43a3-bacb-54f40696fb6b

Trend Micro Tick November 2019

ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14b45c6e-c526-4715-b1f2-78c5e77bdbf2

Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026 · Palo Alto TeamPCP MAR 2026

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15b1bc2a-4cd1-4b82-90b0-2aa6e69637c7

ATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1bf1b5ed-0629-4f4d-ae90-aa7d01eae1d6

Aikido TeamPCP Telnyx MAR 2026 · Hunt.io TeamPCP Toolkit MAY 2026 · Trend Micro TeamPCP MAY 2026

ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e088415-be6b-4912-9e1a-ac542b7bbe48

BiZone Lizar May 2021

ATTACK:enterprise:S1217 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f8eebb8-84ef-4578-a020-50aa7286e7c6

Google Cloud Threat Intelligence ESXi VIBs 2022

ATTACK:enterprise:S0374 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2209a958-9359-4866-80e9-80d0cc660868

CheckPoint SpeakUp Feb 2019

ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27f561f4-2631-4d82-b384-4e7a208ba484

TrendMicro Tonto Team October 2020

ATTACK:enterprise:S1187 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b918315-a5bb-4de7-b982-16d96979d428

GitHub reGeorg 2016

ATTACK:enterprise:S1032 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2dc7b1ac-48d5-48cc-9298-3e11b4658cb6

Checkpoint MosesStaff Nov 2021

ATTACK:enterprise:G0128 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b689978-c74b-48e6-8d5e-73b3a6a6ea9d

Google Election Threats October 2020 · Zscaler APT31 Covid-19 October 2020

ATTACK:enterprise:S0583 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3cd8146a-8d50-4a36-8d8c-3c80e7b63105

CERT-FR PYSA April 2020

ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49d115fb-7a5a-4a6a-959d-0d76ab8394fb

CitizenLab KeyBoy Nov 2016

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--521c66b9-fe52-4c2b-bc32-8ed3d98c7a71

Anomali Rocke March 2019

ATTACK:enterprise:G0095 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--532feb00-b2ba-4cf6-81e8-57750d30b039

Cylance Machete Mar 2017 · ESET Machete July 2019 · 360 Machete Sep 2020

ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56c83dcc-1e3c-4816-8178-570232bbab39

Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023

ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57966b1d-4770-49fb-afb6-b02699bb8154

Riskiq Remcos Jan 2018

ATTACK:enterprise:S1189 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60a0669b-ed63-497a-9b28-ba7eaa3ee2fc

GitHub Neo-reGeorg 2019

ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60e86d7e-a3b9-4929-9933-84aba4a45ff3

CISA SPAWNCHIMERA RESURGE February 2026

ATTACK:enterprise:S0482 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--677878af-62d4-4407-bbe6-551b7906a366

MacKeeper Bundlore Apr 2019

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6dfa7917-c916-43e7-b5a9-1e602e997393

Microsoft Axios Compromise APR 2026

ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e6f9a76-23b6-4474-abc1-3d477284c220

TrendMicro EarthLusca 2022

ATTACK:enterprise:S1035 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f94bd08-b5cb-4e6e-ae10-f858a2e55e28

NCSC GCHQ Small Sieve Jan 2022

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70b511c9-5a2c-4810-87b6-73dfc648ec29

ATTACK:enterprise:S1223 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80f50f7b-f1b7-4780-8a2b-cda06f12485d

Mandiant Fortinet Zero Day

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87400414-05c2-42a7-9db5-fbbac101146d

GitHub SILENTTRINITY March 2022 · GitHub SILENTTRINITY Modules July 2019

ATTACK:enterprise:S0631 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--876a57e9-4a60-4863-a1b7-c1dad9903971

Cybereason Chaes Nov 2020

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95dce028-9046-4bcf-a949-2a0bc40d5038

Trend Micro Muddy Water March 2021

ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95e47f6d-6da2-4269-b6a5-b2253de83a8c

Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024 · ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023

ATTACK:enterprise:T1059.006 → subtechnique-of → ATTACK:enterprise:T1059

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--96575047-df79-4e74-9f88-44307a46bce0

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--971d6207-8f0f-4771-8f7e-a6aa9aadda1c

FoxIT Wocao December 2019

ATTACK:enterprise:S0459 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d4d3bb6-58b7-4c16-a405-d576e8e96c07

Unit 42 MechaFlounder March 2019

ATTACK:enterprise:M1033 → mitigates → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e0a19f8-e970-49a1-9952-ae7380247ace

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a05cacd8-c937-4541-960c-add8f5b1d720

AI-Mexico-Govt-Breach

ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a0b1ab1f-9427-411a-9eba-649da629adaf

Microsoft Ransomware as a Service

ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5bcc6f7-27af-4335-bf02-59fe5d0cd62e

Mandiant Cutting Edge Part 3 February 2024 · Volexity Ivanti Zero-Day Exploitation January 2024

ATTACK:enterprise:S0647 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7d7b40a-aae7-4fbc-a1c9-f6c7b756c4dd

ESET BackdoorDiplomacy Jun 2021

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--afea3455-9565-4e5d-b431-e845ec1722d2

Unit 42 IronNetInjector February 2021

ATTACK:enterprise:S1245 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b0cbc281-81ce-4c78-add4-1e9a46c94a28

Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024 · Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025 · ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024 · PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b5373794-5133-41b2-9050-228ebac75c92

Symantec Seaduke 2015

ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b7f73589-4640-468d-8422-04cfc7e7e110

ATTACK:enterprise:S0369 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b85862ff-5bde-4f6e-8483-901bab69a3a2

CoinTicker 2019

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--befbbf7a-6480-4825-b7f6-1561dc6d4189

ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1806927-2279-4597-ada9-e0c06b65b7eb

ESET Ebury Oct 2017

ATTACK:enterprise:C0045 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4d89012-734f-472c-9e07-f99fcdcf7077

Oligo ShadowRay Campaign MAR 2024

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c906ddd0-e3fb-42ad-84cb-84ca093ddbb2

FBI FLASH APT39 September 2020 · BitDefender Chafer May 2020

ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cab79b3a-4ea7-455a-9373-e8ac0d8e612f

CheckPoint Bandook Nov 2020

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb58db80-48e9-4138-9ce4-bd726a3d1745

ESET Machete July 2019 · Securelist Machete Aug 2014 · 360 Machete Sep 2020

ATTACK:enterprise:S1120 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb6311e7-46a4-4953-8080-d7908e049c94

Mandiant Cutting Edge Part 2 January 2024

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d1f53f90-7f79-488e-99ce-b2a8f688dad8

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d32fb833-c8ad-4d04-b998-3d62a6916966

Talos PoetRAT April 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d9ed5493-1610-4f65-bd2e-527b97bde8bf

Cobalt Strike TTPs Dec 2017 · Talos Cobalt Strike September 2020 · CobaltStrike Daddy May 2017 · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S1164 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e0005fdb-1bd0-4f2f-b7dc-01890d71ef4e

Palo Alto MidnightEclipse APR 2024 · Volexity UPSTYLE 2024

ATTACK:enterprise:S9013 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e05e470e-b827-42e3-a22e-e188f2de75d0

Google UNC5221 Ivanti January 2025 · Picus Security UNC5221 Ivanti May 2025

ATTACK:enterprise:S0492 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2a29101-0b7e-4dab-adec-602712c09893

Unit42 CookieMiner Jan 2019

ATTACK:enterprise:S0276 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2dd48c1-c960-4f6f-ad99-5b2aa7463e68

synack 2016 review

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e5cf97c0-5229-4d94-bd23-9dfa1517d8b3

trendmicro_redcurl

ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed7ce0cf-8044-4af8-8acf-db94abb79766

Cybereason LumaStealer Undated

ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f193b2de-eb69-469e-b5ff-acf5f149ace8

FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f35c994e-80a6-414a-ab81-1a2eb5fd0829

US-CERT TA18-074A

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f8372a2e-6db4-4353-9635-b1fcac9f90ed

CISA AA20-301A Kimsuky · KISA Operation Muzabi

ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f99a0139-7ebe-487a-ae7d-d02c009dc61e

Wiz Mini Shai-Hulud MAY 2026 · Phoenix TeamPCP 20 MAY 2026

ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ffd420b6-6edc-4d0d-8aa2-b5e94af4add0

Splunk LAMEHUG SEP 2025 · Nov AI Threat Tracker

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.