aol.pm

Shared Modules

Technique · ATTACK:enterprise:T1129

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1129",
  "title": "Shared Modules",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1129",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--0a5231ec-41af-4a35-83d0-6bdf11f28c65",
  "external_id": "T1129",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:40.542Z",
  "modified": "2026-09-11T19:58:20.992Z",
  "version": "2.3",
  "aliases": [

  ],
  "tactics": [
    "execution"
  ],
  "source_references": [
    {
      "source_name": "RotaJakiro 2021 netlab360 analysis",
      "url": "https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/"
    },
    {
      "source_name": "Apple Dev Dynamic Libraries",
      "url": "https://developer.apple.com/library/archive/documentation/DeveloperTools/Conceptual/DynamicLibraries/100-Articles/OverviewOfDynamicLibraries.html"
    },
    {
      "source_name": "Unit42 OceanLotus 2017",
      "url": "https://unit42.paloaltonetworks.com/unit42-new-improved-macos-backdoor-oceanlotus/"
    },
    {
      "source_name": "Microsoft DLL",
      "url": "https://learn.microsoft.com/troubleshoot/windows-client/deployment/dynamic-link-library"
    },
    {
      "source_name": "Linux Shared Libraries",
      "url": "https://tldp.org/HOWTO/Program-Library-HOWTO/shared-libraries.html"
    }
  ]
}

Explicit source assertions (24)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02d4ee3d-adb9-49fc-8e91-3379c508692b

Gh0stRAT ATT March 2019

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15455c48-f71c-480d-91b8-e41f12608705

Symantec Trojan.Hydraq Jan 2010 · Symantec Hydraq Jan 2010

ATTACK:enterprise:S0196 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--163c1ca5-c5cb-4cc8-b9e4-d0a137d41e52

FireEye Know Your Enemy FIN8 Aug 2016

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--261e7ed2-9252-40ea-9f06-abc45797c004

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c89cab1-efbb-405c-930d-197ae1910e5b

ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30c9343b-bb15-494a-a1cf-4449131ec216

Cybereason Astaroth Feb 2019

ATTACK:enterprise:S1185 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5cf3da17-8c0a-4a4d-8926-3fc251085ddf

Huntress LightSpy macOS 2024

ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75640de7-9608-4c19-a0b3-6fb4816ec56a

Trend Micro KillDisk 1

ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79cb18f3-0640-4b9d-9e93-62e3300f99d8

Fortinet Metamorfo Feb 2020

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a520abb-af16-4501-935c-bb13fc490813

Eset PlugX Korplug Mustang Panda March 2022

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7bbc0809-d6ba-4be5-9397-e44b9481f317

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--831513ed-bbf2-406f-ab74-bfffa8a376b7

ESET Attor Oct 2019

ATTACK:enterprise:S0661 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--91d0f880-8928-4173-bb2f-518876a8c0b3

MSTIC FoggyWeb September 2021

ATTACK:enterprise:S1078 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9da28d8d-5111-491a-9557-bee7004fc3a6

RotaJakiro 2021 netlab360 analysis

ATTACK:enterprise:S0520 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2c141ff-d733-4d73-96af-618ed26b7547

US-CERT BLINDINGCAN Aug 2020

ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7ec0d1d-462b-4909-acee-f2aa1f9199b1

Medium Ali Salem Bumblebee April 2022

ATTACK:enterprise:S0467 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b4ef6c6e-d7aa-451a-b071-faf0138cfbff

Kaspersky TajMahal April 2019

ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--da8e4a55-195f-4fbc-8a8b-565581d3a3d4

ESET Ebury May 2024

ATTACK:enterprise:S0415 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db3b37f1-9c85-4e52-bbd7-4b71ad68400d

FireEye FIN7 Oct 2019

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e07d9070-6989-43e7-aee0-1b18aff1ffbe

CyberBit Dtrack

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e6e81473-84f4-40f0-b7a1-122599f801e6

Unit42 OceanLotus 2017

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1c37a4a-bcfe-4626-94bb-749112023a44

QuorumCyber_Vidar_March2023

ATTACK:enterprise:S0501 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f77738b8-e17c-4b6b-98fc-ffcc569cc008

ESET PipeMon May 2020

ATTACK:enterprise:S1154 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd385a66-84ba-4bd5-8ab2-afd7c7699e57

Lumen Versa 2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.