JavaScript
Subtechnique · ATTACK:enterprise:T1059.007
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1059.007",
"title": "JavaScript",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1059/007",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d",
"external_id": "T1059.007",
"domain": "enterprise",
"created": "2020-06-23T19:12:24.924Z",
"modified": "2026-05-12T15:12:00.620Z",
"version": "2.2",
"aliases": [
],
"tactics": [
"execution"
],
"source_references": [
{
"source_name": "Apple About Mac Scripting 2016",
"url": "https://developer.apple.com/library/archive/documentation/LanguagesUtilities/Conceptual/MacAutomationScriptingGuide/index.html"
},
{
"source_name": "MDSec macOS JXA and VSCode",
"url": "https://www.mdsec.co.uk/2021/01/macos-post-exploitation-shenanigans-with-vscode-extensions/"
},
{
"source_name": "Microsoft JScript 2007",
"url": "https://docs.microsoft.com/archive/blogs/gauravseth/the-world-of-jscript-javascript-ecmascript"
},
{
"source_name": "Microsoft Windows Scripts",
"url": "https://docs.microsoft.com/scripting/winscript/windows-script-interfaces"
},
{
"source_name": "JScrip May 2018",
"url": "https://docs.microsoft.com/windows/win32/com/translating-to-jscript"
},
{
"source_name": "NodeJS",
"url": "https://nodejs.org/"
},
{
"source_name": "SentinelOne macOS Red Team",
"url": "https://www.sentinelone.com/blog/macos-red-team-calling-apple-apis-without-building-binaries/"
},
{
"source_name": "SpecterOps JXA 2020",
"url": "https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5"
},
{
"source_name": "Red Canary Silver Sparrow Feb2021",
"url": "https://redcanary.com/blog/clipping-silver-sparrows-wings/"
}
]
}Explicit source assertions (83)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--063c1ea3-13a7-492c-8934-31886fbbecd8
Palo Alto TeamPCP MAR 2026ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06a82ed9-c3c3-412a-98f7-838442f4e1cc
Malwarebytes Kimsuky June 2021ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--072552be-9c74-4ee8-972c-46454a2c78c0
Talos Cobalt Strike September 2020ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--07f72efd-7960-4530-92f3-6ced33087212
Medium Metamorfo Apr 2020ATTACK:enterprise:S1246 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0bdac0c4-3faa-429c-9945-a5e3763bee23
Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024 · Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025 · ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024 · PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023 · PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c4e4578-3bb1-4c9a-9dc8-af3b7368ada9
ESET Turla Mosquito Jan 2018ATTACK:enterprise:S1144 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0eed880c-738f-4654-b6c2-fdc2362520e9
FRP GitHubATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--18771b0e-2d4b-4f76-ae1e-9cdac1c77cd0
Cybereason Cobalt Kitty 2017 · Volexity Ocean Lotus November 2020ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1884086e-4ea7-4e8d-b81a-14471eab6ee5
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e95c694-902e-4d6c-b5bd-17888e426d55
Breakdev Evilginx 2.3 JAN 2019ATTACK:enterprise:S0228 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2a94575a-8e47-4d69-964b-f96210a673bd
fsecure NanHaiShu July 2016ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3086bfc5-96b1-4768-a243-a82da7155728
win10_asrATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31221040-295a-437a-ac4a-d85e0b5d9122
Trend Micro FIN6 October 2019ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--326d0ed6-35a6-452e-a8a2-ab2a7e034faa
ATT Sidewinder January 2021 · Rewterz Sidewinder COVID-19 June 2020ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3281ad27-8a05-4389-9438-f0ffce776346
Trend Micro Black Basta October 2022 · Kaspersky QakBot September 2021ATTACK:enterprise:S1180 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--32c5ae14-5e74-4bb8-8d31-3dcef1391381
Trustwave BlackByte 2021ATTACK:enterprise:G1019 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--396056dc-8657-418c-9c7a-4468878af204
MoustachedBouncer ESET August 2023ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f21f508-5f35-4d99-a133-8abbf02cf6d5
Zscaler BlindEagle DEC 2025ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4142d0fd-6c96-417f-8725-17eabf444854
Hornet Security Avaddon June 2020 · Awake Security AvaddonATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--435c288d-1e10-4610-bf41-531390e5a650
ClearSky MuddyWater Nov 2018 · DHS CISA AA22-055A MuddyWater February 2022 · FireEye MuddyWater Mar 2018ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4504384f-f832-4ec2-87b0-b8dfc2208083
TrendMicro EarthLusca 2022ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4677c432-d537-4d61-bc25-efe1b608c378
Google_SHOracle_Jun2026ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--48f75458-3c14-4ffe-9950-97d6bff16822
PaloAlto StrelaStealer 2024 · Fortgale StrelaStealer 2023 · IBM StrelaStealer 2024ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5853af0d-4716-4290-b3d9-63fadfd5f554
ATTACK:enterprise:S0417 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--58801cab-349a-4f09-b449-149b19bcf085
SecureList Griffon May 2019ATTACK:enterprise:G1037 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5cd34b85-c6bf-48e7-8cad-3dd2147cca47
Latrodectus APR 2024ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d5fa465-7221-4ba5-9c39-9c51e9e102db
ESET WinterVivern 2023ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--60989b47-4725-4077-8aed-fb5f990fda22
Cyber Forensicator Silence Jan 2019ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--612c45b3-a705-4d6d-90f3-1406964df217
Sekoia ClickFake 2025ATTACK:enterprise:S1249 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65dfb984-a7b3-4da0-90d0-20d61eb0e828
Socket Contagious Interview NPM April 2025 · Socket HexEval BeaverTail Contagious Interview June 2025ATTACK:enterprise:G0140 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67d072c0-3439-4a61-9a67-fb3f2b72d04e
MalwareBytes LazyScripter Feb 2021ATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--69772984-96a1-47f1-ac27-08f85ff492e2
SocGholish-update · SentinelOne SocGholish Infrastructure November 2022 · Red Canary SocGholish March 2024 · Secureworks Gold Prelude ProfileATTACK:enterprise:S0634 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b58b7e3-4588-45a6-9ff4-7f6ead315ac5
MSTIC Nobelium Toolset May 2021ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6be48603-8603-45dd-8423-294169ca45a6
Cybereason Valak May 2020ATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d5e93c2-073a-4974-a25f-c5a805780a45
Bitsight Latrodectus June 2024 · Elastic Latrodectus May 2024 · Palo Alto Latrodectus Activity June 2024ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6f57b4eb-ba87-4755-9b96-3715e1da1de1
Proofpoint TA505 Sep 2017 · Proofpoint TA505 June 2018ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7105dbb9-fcb2-41f7-a740-a19d539758fb
ESET InvisiMole June 2020ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71ec5140-320c-452c-8512-6a787af027c8
Cofense Astaroth Sept 2018 · Securelist Brazilian Banking Malware July 2020ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72b1c4ab-81ca-47a4-a541-ceb44580c87b
FireEye FIN7 Aug 2018 · Flashpoint FIN 7 March 2019ATTACK:enterprise:S0648 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7667e829-3602-410b-b3ea-614ed8d55607
CrowdStrike Carbon Spider August 2021ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80516f0f-53de-4058-9ae5-d426adb9e99e
Mandiant APT41ATTACK:enterprise:S1116 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8426ec50-0d64-47c9-979a-109510ba8265
Mandiant Cutting Edge January 2024ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--87a6c355-530c-4c68-a435-f83565000e95
SecureListUbiedo_Tsundere_Nov2025ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8be670ce-f8bd-4f67-9f84-3e278235325a
Donut GithubATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8dd45f3b-a005-40b3-a6ef-c1ef208e8504
Unit42 Xbash Sept 2018ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8e8bebc7-14ff-4c84-a2a4-472446c5897a
Talos Cobalt Group July 2018 · PTSecurity Cobalt Group Aug 2017 · Group IB Cobalt Aug 2017 · Morphisec Cobalt Gang Oct 2018 · Unit 42 Cobalt Gang Oct 2018 · TrendMicro Cobalt Group Nov 2017ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8ef60c8b-f178-4b78-b5c4-76747e075d84
Malwarebytes Higaisa 2020 · Zscaler Higaisa 2020 · PTSecurity Higaisa 2020ATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96e1c86d-f92e-4443-a674-2e6f8078e8b9
Wiz TeamPCP KICS MAR 2026 · Trend Micro TeamPCP MAY 2026ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--98b90b49-f152-4eb5-8bb7-3b6c68bf9646
CISA AA20-301A Kimsuky · VirusBulletin Kimsuky October 2019 · Zscaler Kimsuky TRANSLATEXTATTACK:enterprise:S9062 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a22f6aff-ffbc-49f1-9f39-a52cafca2ed3
CheckPoint_NimbusManticoreEurope_Sept2025ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a28ed204-7e5c-4090-a0c5-0a056ef602fe
Kaspersky Adwind Feb 2016ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2eb983e-f4ad-45a3-9348-088bbfdbab77
ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a322f31a-42e0-4314-9ea0-9e04037dc5ce
SentinelOne Gootloader June 2021 · Sophos GootloaderATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a5db1eaf-094d-498f-b7bd-3701025a2987
Palo Alto Ashen Lepus DEC 2025ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a7c7be1a-68a4-408b-94c8-3bbebeed618d
Koi Glassworm New Tricks December 2025 · Koi Glassworm Extensions November 2025 · Koi Glassworm InvisibleCode October 2025 · Aikido GlassWorm October 2025 · Socket GlassWorm January 2026ATTACK:enterprise:S0646 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab55f99b-5239-4aea-93f7-e1002520bf05
Secureworks GOLD KINGSWOOD September 2018ATTACK:enterprise:C0037 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--adc39d51-e21b-488c-bdc8-a97b1524ffac
TrendMicro Pikabot 2024ATTACK:enterprise:M1021 → mitigates → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b432bca9-8f75-431d-b0af-f43623e287d4
ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b476cf81-9f9c-40bf-ac58-aa0df0af3b4e
CheckPoint_NimbusManticoreEurope_Sept2025ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b8fbce12-deae-4655-ac96-e23ebbeef624
Symantec WastedLocker June 2020ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c25ab527-d86f-4146-898c-03e9dc121321
Microsoft Axios Compromise APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026ATTACK:enterprise:C0036 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c281bef6-624b-45c9-882d-ce05d4c05a50
Elastic Pikabot 2024ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cb36459a-d37c-424f-8130-55cf8d29417e
ClearSky MuddyWater Nov 2018ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cbba2f85-d5f4-4306-a219-5eea6c59dbb6
Kaspersky MoleRATs April 2019ATTACK:enterprise:S0631 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ccc14a82-43bc-4eea-b19f-95aba6bdb5e6
Cybereason Chaes Nov 2020ATTACK:enterprise:G0077 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cd45bd64-3793-49e7-82d0-9cdabf417d61
Symantec Leafminer July 2018ATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cea08e8e-2209-4d29-bc76-722091344259
Cylance Dust StormATTACK:enterprise:S9044 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cfb02b3d-c902-480f-a579-06ac4ba0c5a4
Artic Wolf Labs Kali365 Device Code April 2026 · Artic Wolf Kali365 Device Code OAuth June 2026 · Huntress Kali365 Device Code June 2026ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cfe7f665-9597-49e5-9d2e-73058147e676
Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022ATTACK:enterprise:S0482 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d70ae3e8-39e2-4835-9ba6-56dee8d028fc
MacKeeper Bundlore Apr 2019ATTACK:enterprise:S9042 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db30a603-c3c5-4ee5-9aaf-687f21311006
Aikido TeamPCP Trivy MAR 2026ATTACK:enterprise:G1038 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e81d7554-faad-40a2-99dd-75183efa712c
Latrodectus APR 2024ATTACK:enterprise:G0120 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea3b16db-6b34-4171-9dec-7ce618f49dee
ESET EvilNum July 2020ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb17d12e-721b-4ebb-a4ff-8fe62a3189ca
Malwarebytes Konni Aug 2021ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb2b318e-2968-485e-8459-1b40c74baf83
DFIR Conti Bazar Nov 2021ATTACK:enterprise:S1248 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb5ba6c3-c7f7-4a67-9a7e-9fef2cde9527
Socket BeaverTail XORIndex HexEval Contagious Interview July 2025ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f3ac1fad-7d60-48a3-8cb0-6b778987d333
StarBlizzardATTACK:enterprise:S1075 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f3f85cfd-557c-45c1-82ae-a9e349c8714c
Mandiant Suspected Turla Campaign February 2023ATTACK:enterprise:S9008 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f53a7fa6-b4b8-4624-b6b5-2a3a7d2ded8a
Aikido Shai-Hulud September 2025 · Netskope Shai-Hulud November 2025 · Palo Alto Unit 42 Shai-Hulud November 2025 · Wiz Shai-Hulud September 2025 · Microsoft Shai-Hulud December 2025 · Socket Shai-Hulud November 2025 · Socket Shai-Hulud Trufflehog September 2025ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f8ca294b-b401-4bc3-897d-04ac9860fadb
Flashpoint Mini Shai-Hulud MAY 2026 · Trend Micro TeamPCP MAY 2026