Skip to content

Standard Encoding

Subtechnique · ATTACK:enterprise:T1132.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1132.001",
  "title": "Standard Encoding",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1132/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--04fd5427-79c7-44ea-ae13-11b24778ff1c",
  "external_id": "T1132.001",
  "domain": "enterprise",
  "created": "2020-03-14T23:36:52.095Z",
  "modified": "2026-09-03T19:46:40.081Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [
    {
      "source_name": "University of Birmingham C2",
      "url": "https://arxiv.org/pdf/1408.1136"
    },
    {
      "source_name": "Wikipedia Binary-to-text Encoding",
      "url": "https://en.wikipedia.org/wiki/Binary-to-text_encoding"
    },
    {
      "source_name": "Wikipedia Character Encoding",
      "url": "https://en.wikipedia.org/wiki/Character_encoding"
    }
  ]
}

Explicit source assertions (133)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0610 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b71ce5b-7174-4491-8890-c699d93907e7

Check Point APT34 April 2021

ATTACK:enterprise:S0410 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0edefa7f-0b1b-48b7-ab51-e0107b48c683

Fysbis Dr Web Analysis

ATTACK:enterprise:S1021 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f41364e-e72b-4186-980f-a5a5a5d07395

Zscaler Lyceum DnsSystem June 2022

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--103f1ad4-feec-4be3-9da7-ee0b2503c318

Kaspersky Sofacy

ATTACK:enterprise:S0696 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--118c427e-fcd2-4464-a32a-a6edb0d6ead5

NTT Security Flagpro new December 2021

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--130f35b1-17d5-45bf-9000-2040adbcc56c

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:S0053 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13c97dd2-5c0b-4f18-84ab-533949fbeb25

Unit 42 SeaDuke 2015

ATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14bcff67-6ecb-4a0a-9fcf-5b5ea72a6f06

Latrodectus APR 2024 · Elastic Latrodectus May 2024

ATTACK:enterprise:S1196 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17ea71a2-4be4-434a-956c-79ec00d010f6

S2W Troll Stealer 2024

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--185020c6-9b2a-4b08-8936-7d407ea753b4

ESET Telebots Dec 2016

ATTACK:enterprise:S9063 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a82f449-eb3f-4b9a-9eaa-f30a66f1d0ef

Mandiant_UNC1549_Nov2025

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b1a7abf-72bc-44fa-8f90-4321003f0553

Lunghi Iron Tiger Linux

ATTACK:enterprise:S0631 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b6f0ec5-55d5-4aee-a90b-30238599d13c

Cybereason Chaes Nov 2020

ATTACK:enterprise:S1020 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21295e0f-33f4-44dc-a649-87d0e55f8ed7

Kaspersky Lyceum October 2021

ATTACK:enterprise:S0472 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--215c28bd-3698-4962-b8a9-c632f27c9c82

Trend Micro Tick November 2019

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21caad94-1568-4e40-8e38-c0f7e854aede

Cymmetria Patchwork

ATTACK:enterprise:S0678 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--261937ca-8c05-430a-9c85-280b78505f65

McAfee Lazarus Nov 2020

ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27e7969b-a0bf-4db6-90bf-1f17c5e0c853

Unit 42 Playbook Dec 2017

ATTACK:enterprise:S9067 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2cfd020b-e6e7-40aa-963d-12d1dc4a2d6b

Mandiant_UNC1549_Nov2025

ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2db32876-d6f5-4862-b760-f0a9dfb28c3c

FireEye SUNBURST Backdoor December 2020

ATTACK:enterprise:S1060 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2efd43af-7571-4fd6-81cd-c26d7f769133

SentinelLabs Metador Technical Appendix Sept 2022

ATTACK:enterprise:S9052 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--300ef1e9-9b6e-44b9-b082-35295c38876f

CheckPoint_NimbusManticore_May2026

ATTACK:enterprise:S0649 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30f98441-b9cd-49ab-ba95-c7f19a82becd

FireEye SMOKEDHAM June 2021

ATTACK:enterprise:S1110 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--329f545d-7ef4-4c43-9ce8-b56e7275e11f

Mandiant Pulse Secure Zero-Day April 2021

ATTACK:enterprise:T1132.001 → subtechnique-of → ATTACK:enterprise:T1132

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34407c81-aca5-477e-a978-a66f32ae6545

ATTACK:enterprise:S0137 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35d35ecf-1326-4690-b105-23280e29c120

ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37f48df4-80b1-4f5b-917c-8ac699e5cc0e

Unit 42 QUADAGENT July 2018

ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a1883a0-8626-4cf0-8e0f-19bf9cf39a30

Cofense Astaroth Sept 2018

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a9d2be9-57a6-49d6-9301-253351927e82

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4211ef16-7a9e-49b8-92c4-b73cbef0f843

Mandiant APT42-untangling

ATTACK:enterprise:S0144 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--434a9327-8e08-4336-adbd-f24a0ee9eba6

Palo Alto menuPass Feb 2017 · JPCERT ChChes Feb 2017

ATTACK:enterprise:S1078 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--466ea5cf-ebe7-49da-9197-047c70cabaeb

RotaJakiro 2021 netlab360 analysis

ATTACK:enterprise:S0520 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--46e84bd8-d38f-43e7-b62b-ea211231abef

US-CERT BLINDINGCAN Aug 2020

ATTACK:enterprise:S1193 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--476e4837-d820-44c5-9217-30d6dc821652

Mandiant APT42-untangling

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48a7db34-eee7-4358-918b-0cc802aaec03

Binary Defense Emotes Wi-Fi Spreader · Fortinet Emotet May 2017

ATTACK:enterprise:S0340 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4919cec0-77ce-4505-91e5-5a538fe1b198

Securelist Octopus Oct 2018

ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4abcf209-1dab-435b-a347-b8ff318ac5d8

Secureworks BRONZE BUTLER Oct 2017

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4de4cf78-542c-4f7a-a83b-f876a59e2553

Unit42 RDAT July 2020

ATTACK:enterprise:S0124 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ec9a523-e27f-4984-9bde-4af785e5e75a

Palo Alto DNS Requests

ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50f0d6ac-0cfa-41d6-9795-e6843101c524

Group IB GrimAgent July 2021

ATTACK:enterprise:S1112 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--53ae8545-a24d-431c-a0ee-6d5b63278490

Mandiant Pulse Secure Zero-Day April 2021

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--545a618f-9fe4-4573-a0a0-ecfcef0b407c

Secureworks BRONZE BUTLER Oct 2017

ATTACK:enterprise:S0543 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54e27824-ac46-49ca-8b58-dc5726b6cefb

Unit42 Molerat Mar 2020

ATTACK:enterprise:S0459 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--553dc864-7d6b-41f9-bb1c-9fc6ee3724b7

Unit 42 MechaFlounder March 2019

ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56e55812-7622-4e84-96c6-6fc46dd2b541

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:S0264 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--578a4fd8-7c24-44b2-a7c3-1a47786d3c9a

Unit 42 OopsIE! Feb 2018

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--596f9132-84e2-42c9-ad58-8833fe38b1e6

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ccf856f-abd9-4ef6-b17f-803ecb20435f

Securelist Machete Aug 2014

ATTACK:enterprise:S1031 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ef73661-0bc8-47f5-bae6-2beb5342a68e

Unit 42 PingPull Jun 2022

ATTACK:enterprise:C0044 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--654d5d71-a4ab-4768-8089-fddc3b1c63ad

ESET OilRig Campaigns Sep 2023

ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a4eafba-a7fb-46d1-8c50-033e1e3d7409

Unit 42 Valak July 2020

ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d10e49f-ebd6-47c5-9042-96bd54f7ca79

Cylance Shaheen Nov 2018

ATTACK:enterprise:S1198 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d5ce011-4fb4-4b6a-8c1b-dfea3c0933a1

Symantec Troll Stealer 2024

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d69c030-d557-4d35-b5dc-99ee973f10eb

Unit42 OceanLotus 2017

ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f9916d0-70c3-4504-93cf-cd0e8dd7ead1

Unit 42 MuddyWater Nov 2017

ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70cbf260-4995-485e-8dc2-241bfc421b80

Hunt.io TeamPCP Toolkit MAY 2026 · Phoenix TeamPCP 20 MAY 2026

ATTACK:enterprise:S0093 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7123a6ee-2026-4db8-a983-cbc2932c2a09

Symantec Dragonfly

ATTACK:enterprise:S0376 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74499e24-ecca-46bb-87fb-e8beb25f1c11

US-CERT HOPLIGHT Apr 2019

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7898362c-a930-4cd4-9c94-019a253af141

ESET Okrum July 2019

ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--791b12bb-cb49-4fc6-a4a5-ea7773fce408

ZScaler Squirrelwaffle Sep 2021

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79f0712b-2cb1-47df-8ea1-26fb1502a831

Forcepoint Monsoon · PaloAlto Patchwork Mar 2018 · TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a4ed5e2-6a96-4faf-b647-2372490cfcb2

Proofpoint Bumblebee April 2022

ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ac39d41-f859-447e-947b-5da935d30894

Fidelis njRAT June 2013

ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d13961a-5fcc-4c97-aeda-f3e42325aabf

Cyberreason Anchor December 2019

ATTACK:enterprise:S0084 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f1c30eb-051f-4d1a-9d81-1ee46f7779c7

Cylance Dust Storm

ATTACK:enterprise:S0129 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--801f139f-1361-4d79-965e-078787f8ec36

Forcepoint Monsoon

ATTACK:enterprise:S0085 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--813e4416-bee6-4192-a712-6b5f80a7fff3

Cylance Dust Storm

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81682d49-acb2-4439-a7da-1a28126cea94

McAfee Lazarus Resurfaces Feb 2018

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--827f9dc6-9dbd-4556-a817-efb9b115cac1

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0200 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83a949a2-ed5d-4ae5-a45f-885e58a7d931

Microsoft PLATINUM April 2016

ATTACK:enterprise:S0270 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83ac6dba-c74f-4a9e-aba3-3581a67588bf

Unit 42 DarkHydrus July 2018

ATTACK:enterprise:S0275 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--848f00fe-4fd4-422c-b819-20d5e1f7becf

Trend Micro Earth Kasha Anel NOV 2024

ATTACK:enterprise:S0514 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86dddc68-9032-4467-be3c-a48d3bacfd06

CISA WellMess July 2020

ATTACK:enterprise:S1108 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a6b0a59-a9f7-4e65-8070-303a6b79e6bb

Mandiant Pulse Secure Zero-Day April 2021

ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8aaf06cc-1245-47d2-b270-b7854eec5b64

IBM StrelaStealer 2024

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8bbb3c5d-da3b-4f55-871d-2fd210dfddea

MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:S0487 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90126438-03a9-47c8-98c1-222a1d79ef21

ESET ForSSHe December 2018

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--91180074-16cd-448f-8955-628d06965e22

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:S9015 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--93d01da6-38c4-479a-a123-51e4d10a3d61

NVISO BRICKSTORM April 2025 · Resecurity UNC5221 BRICKSTORM F5 Big-IP October 2025

ATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--94e051ad-2f6d-4322-a854-6ee1944a8904

Unit42 BabyShark Feb 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.