Skip to content

System Information Discovery

Technique · ATTACK:enterprise:T1082

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1082",
  "title": "System Information Discovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1082",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--354a7f88-63fb-41b5-a801-ce3b377b36f1",
  "external_id": "T1082",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:04.307Z",
  "modified": "2026-09-11T19:56:24.154Z",
  "version": "3.0",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "Amazon Describe Instance",
      "url": "https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-information.html"
    },
    {
      "source_name": "Google Instances Resource",
      "url": "https://cloud.google.com/compute/docs/reference/rest/v1/instances"
    },
    {
      "source_name": "Varonis",
      "url": "https://www.varonis.com/blog/vmware-esxi-in-the-line-of-ransomware-fire"
    },
    {
      "source_name": "Crowdstrike Hypervisor Jackpotting Pt 2 2021",
      "url": "https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/"
    },
    {
      "source_name": "Microsoft Virutal Machine API",
      "url": "https://docs.microsoft.com/en-us/rest/api/compute/virtualmachines/get"
    },
    {
      "source_name": "20 macOS Common Tools and Techniques",
      "url": "https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/"
    },
    {
      "source_name": "OSX.FairyTale",
      "url": "https://www.sentinelone.com/blog/trail-osx-fairytale-adware-playing-malware/"
    },
    {
      "source_name": "US-CERT-TA18-106A",
      "url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
    }
  ]
}

Explicit source assertions (437)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0339 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--002c9202-d7a0-4181-b912-42f7d6d38339

Talos Micropsia June 2017 · Radware Micropsia July 2018

ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--005cbf7d-9d0b-443b-91db-7b148a1eb55b

Fidelis njRAT June 2013

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--011286cc-53bc-4910-bf38-79f1d79fc707

Ensilo Darkgate 2018 · Rapid7 BlackBasta 2024

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--014d0996-93ef-4435-aac2-f73dbd4a9d60

Trend Micro Agenda Ransomware OCT 2025

ATTACK:enterprise:S1249 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01933b06-956c-4f09-9dcc-e7c6b672dc94

Socket HexEval BeaverTail Contagious Interview June 2025

ATTACK:enterprise:S1245 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01a2dceb-e7bf-414b-9919-6c9724cfb404

Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024 · Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025 · ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023

ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01aac35b-55e1-40d6-962f-5b5a6efdb2be

S2 Grupo TrickBot June 2017 · Fidelis TrickBot Oct 2016 · Cyberreason Anchor December 2019 · Eclypsium Trickboot December 2020

ATTACK:enterprise:S0553 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01b542b1-3222-459b-9cdf-b91dcd29c749

Cybereason Molerats Dec 2020

ATTACK:enterprise:S0388 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01c60a20-2eff-4b4e-a15a-24e56a487b4e

TrendMicro TropicTrooper 2015

ATTACK:enterprise:S0464 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01ebd689-8233-409a-a12d-eafb2546f665

Unit 42 CARROTBAT January 2020

ATTACK:enterprise:S0130 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02206f22-80e9-4f87-9e4b-5c1df1eb737e

Forcepoint Monsoon

ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02a1f8ce-390e-46e4-b945-9cd61c593f9f

Symantec Bumblebee June 2022 · Proofpoint Bumblebee April 2022 · Google EXOTIC LILY March 2022

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--041e8f9b-6cdb-44b3-aa37-a274a4de9a0b

Talos GravityRAT

ATTACK:enterprise:S0211 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05104256-7e9a-457b-8e9f-86976992f3c7

Symantec Linfo May 2012

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--055261fd-70cd-49c6-b9e6-2641bae4dda7

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:S0634 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--055a15db-2f5b-4c61-821e-36de6f83a90b

MSTIC Nobelium Toolset May 2021

ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0586324a-680a-46a4-917b-8c00c7211065

Check Point APT35 CharmPower January 2022

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--061cfa7a-df09-40cc-bed5-35407b425cb8

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:G0124 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06ae1d46-2349-457e-817b-e9fdca2f7768

ESET ForSSHe December 2018

ATTACK:enterprise:S0254 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--072af62a-85d5-4803-aa05-d7c6efa9ec2a

Rancor Unit42 June 2018

ATTACK:enterprise:S1234 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08b94d01-f4c1-4692-aa39-a203fd97d581

Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--090a553a-b863-4214-aa3b-cf8ea7ba2d68

ESET Sednit Part 2 · Bitdefender APT28 Dec 2015

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--093c0ace-8e89-4948-8aab-f7b484347f6a

Microsoft BlackByte 2023 · Symantec BlackByte 2022 · FBI BlackByte 2022

ATTACK:enterprise:S9067 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09a27a67-29f5-4ecf-ac38-b0acd0041105

Mandiant_UNC1549_Nov2025

ATTACK:enterprise:S0374 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a8c04f1-c724-4215-92f0-3863b2a3d96d

CheckPoint SpeakUp Feb 2019

ATTACK:enterprise:S0462 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b37289c-b118-45f7-98b2-5efe06cbf0b2

Unit 42 CARROTBAT November 2018 · Unit 42 CARROTBAT January 2020

ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0bc7c262-604c-42af-8829-ce9f579436d4

Rapid7 KeyBoy Jun 2013 · PWC KeyBoys Feb 2017

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c03f2b4-a752-4d74-9c26-5306132a3329

FireEye APT34 July 2019 · Check Point APT34 April 2021 · Palo Alto OilRig May 2016 · Palo Alto OilRig Oct 2016 · Symantec Crambus OCT 2023

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d3f773c-ed0e-4db4-8457-204a7a33eb58

McAfee Maze March 2020

ATTACK:enterprise:S0433 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d557837-8936-43e7-95fd-2c30938d34d3

Carbon Black HotCroissant April 2020

ATTACK:enterprise:S1129 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d853746-8d17-4d1a-be4a-6133e39a6c84

Kersten Akira 2023

ATTACK:enterprise:S0381 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d95b411-1192-42d0-96b1-98fe18742a04

Proofpoint TA505 Mar 2018

ATTACK:enterprise:G0128 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e07a552-cea0-47f0-b96b-009a19c3e09a

Zscaler APT31 Covid-19 October 2020

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e714323-a3b6-4848-852c-5e35608d0970

Cyble Black Basta May 2022 · Minerva Labs Black Basta May 2022

ATTACK:enterprise:S9019 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e770d53-2dea-4d8d-8bbf-a2290d4a78a7

Check Point Blind Eagle MAR 2025 · Zscaler PureCrypter JUN 2022

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e79e44d-036a-478f-a6f5-1acc420095bf

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:S1141 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ed59ea2-85bb-4633-9b55-9e322dcbbd83

ESET Turla Lunar toolset May 2024

ATTACK:enterprise:S0252 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f66681a-7daf-4cd7-99af-3005b6586306

McAfee Gold Dragon

ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f688474-53c2-4ad5-8998-bd8c39a79f04

ZScaler Squirrelwaffle Sep 2021

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f9f9bd3-ccea-4369-b8e7-371d1aad5ff8

Rostovcev APT41 2021

ATTACK:enterprise:S1156 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0fa5e3ed-8b00-4f03-9adf-caf5d0e0bd2c

Talos Manjusaka 2022

ATTACK:enterprise:S0284 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--100f4917-1702-4707-bd9f-58d471e77018

Talos Cobalt Group July 2018 · Security Intelligence More Eggs Aug 2019

ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--108fe161-3cea-4517-bd7c-4c623de4094f

Trend Micro Earth Kasha Anel NOV 2024

ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11764f59-a7b9-4dff-8e37-471d739f5343

HP RaspberryRobin 2024

ATTACK:enterprise:S0520 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11ed4654-a7bf-4063-9452-6d6174b9f8bc

US-CERT BLINDINGCAN Aug 2020

ATTACK:enterprise:S1037 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12168524-c6cf-4b8f-b114-7b10b06b8f32

DHS CISA AA22-055A MuddyWater February 2022 · Mandiant UNC3313 Feb 2022

ATTACK:enterprise:S0218 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--128eb6e8-d1a7-4ff6-85e6-a68cfea3298e

FireEye APT37 Feb 2018

ATTACK:enterprise:S9045 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12a69be7-09b4-4188-9b78-a035d0b622ee

AI-Mexico-Govt-Breach

ATTACK:enterprise:S1085 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12ecc5cc-dad6-4532-9945-df575b008c2a

Bitdefender Sardonic Aug 2021

ATTACK:enterprise:S0482 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--132c7780-3fa4-478b-b037-f2c1ad99d98f

MacKeeper Bundlore Apr 2019 · 20 macOS Common Tools and Techniques

ATTACK:enterprise:S0513 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--137ce702-f0e6-4dfa-8ca5-439155d91af9

ESET Dukes October 2019

ATTACK:enterprise:S0081 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14135aaa-6080-48c1-8a08-d6ee9bb15c3d

Lotus Blossom Jun 2015

ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--142afe71-581e-415e-9867-97ac0aaded65

FireEye SUNBURST Backdoor December 2020 · Microsoft Analyzing Solorigate Dec 2020

ATTACK:enterprise:S0493 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1489f01c-fe49-4332-99e2-d72c487403b6

Trustwave GoldenSpy June 2020

ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1501c966-8f40-4093-b0d1-b3d572b3a1ee

ESET DazzleSpy Jan 2022

ATTACK:enterprise:S0046 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--166c430d-0272-4dca-8d30-318cda0a0a63

F-Secure CozyDuke

ATTACK:enterprise:S0031 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16cb7ede-b431-4711-bcb1-91bc925663e5

ATTACK:enterprise:S1013 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16e1777b-af28-412b-bcc3-469aba0f8a87

Cisco Talos Bitter Bangladesh May 2022

ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--170e1e46-f3ea-4edb-a115-dde5a7c13e0f

Splunk LAMEHUG SEP 2025 · Nov AI Threat Tracker

ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--172da5b1-cf68-468a-8208-b15ea5c813dc

Medium KONNI Jan 2020 · Talos Konni May 2017 · Malwarebytes Konni Aug 2021

ATTACK:enterprise:S0441 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--175199ba-b8b8-467b-9010-a2f549abd957

Unit 42 Inception November 2018

ATTACK:enterprise:S0467 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--179538d1-5770-42ef-976f-c0fd65faa1ea

Kaspersky TajMahal April 2019

ATTACK:enterprise:C0001 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--191aac5f-38bc-429b-8343-32eb17fa4919

Talos Frankenstein June 2019

ATTACK:enterprise:S1248 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--196fcf2a-e520-4fab-baa2-68af3cb0e57c

Socket BeaverTail XORIndex HexEval Contagious Interview July 2025

ATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a28d78a-d11b-466a-977f-19d2e88c1952

SocGholish-update · Red Canary SocGholish March 2024 · Secureworks Gold Prelude Profile

ATTACK:enterprise:S1178 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b265c93-7331-41b7-9cf2-c8c21a0969e7

Kaspersky ShrinkLocker 2024 · Splunk ShrinkLocker 2024

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b47deed-a8b9-4e0f-a47e-9570ecccaa90

Securelist Dtrack · CyberBit Dtrack

ATTACK:enterprise:G0108 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b9b84cc-f9c7-48c5-8e23-ac00a7a4691a

RedCanary Mockingbird May 2020

ATTACK:enterprise:S0457 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c3bc7ec-cabe-4c8f-9d6e-99afd877e845

TrendMicro Netwalker May 2020

ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1da27474-f902-419e-97a9-1fba8743cce8

Volexity InkySquid BLUELIGHT August 2021

ATTACK:enterprise:S1015 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1daf23d1-fdf0-4858-8509-836efb883f18

Accenture Lyceum Targets November 2021 · ClearSky Siamesekitten August 2021

ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f238bb1-62c0-409b-ac79-38b38f54497d

Kaspersky Lyceum October 2021

ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fda6ff7-a344-4bc3-b545-4083cc15290d

Volexity PowerDuke November 2016

ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2026783b-b6c7-432f-9c28-72090cb5539a

Cybereason OperationCuckooBees May 2022

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20f422e8-6244-46e3-8842-f5dc3e37568c

Talos ZxShell Oct 2014

ATTACK:enterprise:S1073 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20f43b8b-55c7-4710-8813-6512c3b11c1a

Cybereason Royal December 2022 · Trend Micro Royal Linux ESXi February 2023

ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2147037d-4af2-4492-9c86-c85dfc6965af

Fortinet Remcos Campaign NOV 2024

ATTACK:enterprise:S1019 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21f5a441-fe32-430e-935c-0929f4101b6e

Accenture Lyceum Targets November 2021 · ClearSky Siamesekitten August 2021

ATTACK:enterprise:S0233 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--231dc643-8b22-4a24-83f2-7327a1c5bd13

FireEye Periscope March 2018

ATTACK:enterprise:S0504 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23c89ec7-3407-4f6d-8b4b-0ab16fbf356c

Medium Anchor DNS July 2020

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.