Skip to content

Deobfuscate/Decode Files or Information

Technique · ATTACK:enterprise:T1140

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1140",
  "title": "Deobfuscate/Decode Files or Information",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1140",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--3ccef7ae-cb5e-48f6-8302-897105fbf55c",
  "external_id": "T1140",
  "domain": "enterprise",
  "created": "2017-12-14T16:46:06.044Z",
  "modified": "2026-09-11T19:42:55.679Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "Volexity PowerDuke November 2016",
      "url": "https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/"
    },
    {
      "source_name": "Sentinel One Tainted Love 2023",
      "url": "https://www.sentinelone.com/labs/operation-tainted-love-chinese-apts-target-telcos-in-new-attacks/"
    },
    {
      "source_name": "Malwarebytes Targeted Attack against Saudi Arabia",
      "url": "https://blog.malwarebytes.com/cybercrime/social-engineering-cybercrime/2017/03/new-targeted-attack-saudi-arabia-government/"
    },
    {
      "source_name": "Carbon Black Obfuscation Sept 2016",
      "url": "https://www.carbonblack.com/2016/09/23/security-advisory-variants-well-known-adware-families-discovered-include-sophisticated-obfuscation-techniques-previously-associated-nation-state-attacks/"
    }
  ]
}

Explicit source assertions (358)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S9028 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0133e2fc-5673-40a5-982b-9b0f441217f5

sentinelone operationDigitalEye Dec 2024

ATTACK:enterprise:C0044 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--017c304d-dec3-4d0e-ac60-8acfbfe41a7c

ESET OilRig Campaigns Sep 2023

ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01fa087f-2238-4bd6-b2d9-8fca29ac9cb0

JPCERT SPAWNCHIMERA Ivanti February 2025

ATTACK:enterprise:S0230 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--026a63ae-dd3d-4ea6-8a32-c40c9b37b893

Proofpoint ZeroT Feb 2017

ATTACK:enterprise:S0584 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--026d4fb6-4683-4e64-a69c-82e39dd11b23

CISA AppleJeus Feb 2021

ATTACK:enterprise:S1028 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0303acd0-64a4-4e40-b8e3-29e1c43694d2

MalwareBytes SideCopy Dec 2021

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03303147-db81-4cb3-9368-98ee4f963c1a

Secureworks BRONZE BUTLER Oct 2017

ATTACK:enterprise:S0669 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03b52236-a63f-4ffe-88bd-15cb5ac69a66

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:S1086 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03e6a535-5c95-47e7-a369-aed653022c7c

Morphisec Snip3 May 2021

ATTACK:enterprise:S0574 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--045da2d4-f599-447b-931b-c11e8692fa1c

Unit42 BendyBear Feb 2021

ATTACK:enterprise:S0513 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0575a941-3af6-4b7b-93df-30f6001760ac

ESET Dukes October 2019

ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0686ee2f-ff46-418b-b6e8-1766e4dc33a8

ANSSI Sandworm January 2021

ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06f8a778-eebf-4d73-86d3-6ebdbf94ce46

Medium KONNI Jan 2020 · Malwarebytes Konni Aug 2021

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07516f04-c7aa-46c7-9cca-0f81b84043e2

ESET Turla PowerShell May 2019

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--075c6890-45e1-495e-a83e-b81ab05a8b4e

ESET Machete July 2019

ATTACK:enterprise:S0415 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07bbfaa8-c62f-4abc-845c-55b28434d058

FireEye FIN7 Oct 2019

ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0805f7ac-0596-4154-bf56-8eb0ee5cc635

Joint Cybersecurity Advisory LockBit 3.0 MAR 2023 · INCIBE-CERT LockBit MAR 2024 · Sentinel Labs LockBit 3.0 JUL 2022

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--089eeb46-323e-410b-a27b-dc5ff4467c40

FBI FLASH APT39 September 2020

ATTACK:enterprise:S1078 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0924ca96-c26b-4bd1-8c50-d3c1a9e1e25b

RotaJakiro 2021 netlab360 analysis

ATTACK:enterprise:S0284 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--095f6266-2535-4991-ad6b-64388513d6e7

Security Intelligence More Eggs Aug 2019

ATTACK:enterprise:S1066 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0977c267-10f9-4e4d-a947-464359c7a4ba

Secureworks DarkTortilla Aug 2022

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09e94c75-2a53-4f13-a290-a4acf5dd4e71

ESET Gelsemium June 2021

ATTACK:enterprise:S9026 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0bdfdf48-6d8b-4eeb-968d-fb3a73889d17

Trend Micro Earth Kasha Updates APR 2025

ATTACK:enterprise:S0226 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c4af99b-e82d-422f-86da-ccc94e55d763

Talos Smoke Loader July 2018

ATTACK:enterprise:S1122 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0da38f11-0e39-4505-aa05-61464113ba8f

ESET Security Mispadu Facebook Ads 2019 · SCILabs Malteiro 2021

ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e3d54bf-90de-450d-af1c-c4372488b4f8

Mcafee Clop Aug 2019

ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--102849c0-0ed7-4e85-9d0b-791bcb7ef7ab

IBM TA505 April 2020 · Proofpoint TA505 October 2019

ATTACK:enterprise:S9046 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--114934d2-1f35-461f-9a18-1ae434695b30

Claroty-IOCONTROL · Dragos-2026-Year-In-Review

ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--114f4fb4-3c0a-44b0-aeaf-2e2a3ba50fa5

Sogeti CERT ESEC Babuk March 2021 · Medium Babuk February 2021

ATTACK:enterprise:S0127 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--128e8365-7645-41fa-832e-5ff4d8639035

Palo Alto Networks BBSRAT

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1387ec64-ba36-42cd-b659-c29e708d8281

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13bc2a82-c51d-4410-9e62-223df287b8f7

Talos Lokibot Jan 2021

ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1477187e-7bd8-4622-8c2d-e5978c1fd29f

ClearSky MuddyWater Nov 2018

ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--198cddce-40f7-43eb-aeac-60171f111065

Unit 42 QUADAGENT July 2018

ATTACK:enterprise:G0090 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19f9e4af-3ad9-4d0d-b4af-db145f514be9

Lab52 WIRTE Apr 2019

ATTACK:enterprise:S0636 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a06ec1e-319c-4229-8ec7-b368f3886791

MSTIC Nobelium Toolset May 2021

ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b1e5d59-20a4-4915-a553-4db606d8121d

Unit 42 Gorgon Group Aug 2018

ATTACK:enterprise:S9057 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1bb8999a-16c3-420d-8feb-65b104d18fd9

Mandiant_UNC1549_Nov2025

ATTACK:enterprise:S1164 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1bd6e148-29c0-473e-8752-66bd01e3a629

Palo Alto MidnightEclipse APR 2024 · Volexity UPSTYLE 2024

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c7681f4-4dc4-4722-9fcc-a79712fe502e

Talos Kimsuky Nov 2021 · Securonix Kimsuky February 2025 · Aryaka Kimsuky July 2025

ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c9d4988-d9ea-4dd5-aef1-adb0232e87a3

Unit 42 Lucifer June 2020

ATTACK:enterprise:S9016 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f12b17d-366e-44b6-bc1b-cfbb2b305616

Zscaler BlindEagle DEC 2025

ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f67c603-a567-42d1-b1ee-48fe9564c9bc

Arxiv Avaddon Feb 2021

ATTACK:enterprise:S1186 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20c3b1d7-7702-4a0b-9902-dece6e413bf1

CCCS ArcaneDoor 2024

ATTACK:enterprise:S0615 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21281614-d7cc-4211-9365-d318c99cb906

BlackBerry CostaRicto November 2020 · CISA AR21-126A FIVEHANDS May 2021

ATTACK:enterprise:S1248 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21b4dd86-a629-4e42-944c-f5e4b90e5312

Socket BeaverTail XORIndex HexEval Contagious Interview July 2025

ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2310666c-87e1-45ae-bac8-2255215e858a

Microsoft Moonstone Sleet 2024

ATTACK:enterprise:S1026 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2310e7b8-a4c7-460d-a89d-8d5854c59a44

SentinelOne Aoqin Dragon June 2022

ATTACK:enterprise:S1115 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2329e6c4-5462-4d14-9a50-2d9272f83a09

Mandiant Cutting Edge January 2024

ATTACK:enterprise:S0661 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23679538-e90c-430d-b375-6d8bbf8ec723

MSTIC FoggyWeb September 2021

ATTACK:enterprise:S0434 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--239cb026-369a-43f0-922c-cdc38d124430

QiAnXin APT-C-36 Feb2019

ATTACK:enterprise:S9014 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--243b5790-ce5b-45cb-80d0-55944a7e3b53

Google UNC5221 Ivanti January 2025

ATTACK:enterprise:C0005 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25446e74-d461-4113-8ff9-9d6984696680

ESET Operation Spalax Jan 2021

ATTACK:enterprise:S1113 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--254dea59-0bd6-4966-9eff-d5997a7e91c1

Mandiant Pulse Secure Update May 2021

ATTACK:enterprise:S0456 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26303f07-87f0-4740-b6ea-e81e8c01b267

CheckPoint Naikon May 2020

ATTACK:enterprise:S0596 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26a6be0e-6d53-4f54-b190-af359bfab4fc

Kaspersky ShadowPad Aug 2017

ATTACK:enterprise:S1076 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27d0ccf1-00df-40f5-ad96-807e54862467

Mandiant Suspected Turla Campaign February 2023

ATTACK:enterprise:S0188 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--283bdd5f-f356-43a2-864c-6f8211073d45

Symantec Sowbug Nov 2017

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28f9439e-f458-4c48-8f5c-2e58852fdf79

Lab52 MUSTANG PANDA PUBLOAD MAY 2023 · EclecticIQ Mustang Panda PlugX · Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025 · Unit42 Bookworm Nov2015 · Palo Alto Networks, Unit 42 · Sophos Mustang Panda PLUGX

ATTACK:enterprise:S0436 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b062058-3345-4993-9715-6ad6e98dc2ad

JPCert TSCookie March 2018

ATTACK:enterprise:S0575 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ca546e0-6a3f-4a9f-82c3-2e41ffa67b79

Cybereason Conti Jan 2021 · CarbonBlack Conti July 2020

ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d822996-4574-402d-8d0f-1cfc0e963850

Symantec Orangeworm April 2018

ATTACK:enterprise:S0629 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e2e3a71-51b6-4779-a376-a9cc2750b5da

Bitdefender Naikon April 2021

ATTACK:enterprise:S0255 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--309652a1-45a4-4479-9e84-dfab33d0a1f5

Rancor Unit42 June 2018

ATTACK:enterprise:S0361 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31fa2481-0b4f-40d4-b438-1d04a7eb0888

Microsoft Expand Utility

ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33d24077-13af-4e14-ba79-87ca145c5383

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:S1224 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--340825b1-a2db-4be1-943a-9b529842ae18

Mandiant Fortinet Zero Day

ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3471a32a-47fc-4ba7-ac67-887d9872e316

Proofpoint Bumblebee April 2022 · Medium Ali Salem Bumblebee April 2022

ATTACK:enterprise:G1030 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--347aa8dd-7fb9-45b0-9472-6894b881ebf1

SentinelOne Agrius 2021

ATTACK:enterprise:S0355 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--347ee2ed-7def-45ac-9935-063a679859ae

Unit 42 Nokki Oct 2018

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--352e6e5a-f1e0-46f8-826a-978981f6d893

Microsoft NICKEL December 2021

ATTACK:enterprise:S0635 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--353dd407-0850-4bc4-a447-cd1b708b3833

MSTIC Nobelium Toolset May 2021

ATTACK:enterprise:S1041 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--356aa4b0-e6c2-4ef7-a3b2-837c25c283b3

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:S0344 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3733dda5-9dd9-43d1-ac3a-24f1b5fb86e7

Unit42 Azorult Nov 2018 · Proofpoint Azorult July 2018

ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--383301a1-1cf9-4a74-ab22-2ed1a8c2a42b

Cybereason Astaroth Feb 2019 · Securelist Brazilian Banking Malware July 2020

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--386f2d28-9b7b-43b7-bc06-d7d8ffc644e2

Cyberint Qakbot May 2021 · ATT QakBot April 2021 · Kaspersky QakBot September 2021

ATTACK:enterprise:S1142 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38d896b7-6e7a-44e0-9b52-77da42dd59f6

ESET Turla Lunar toolset May 2024

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3921c748-c29e-4c2f-b5cb-bcc7c0237219

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:S0457 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3967e156-2135-4416-b3c3-79372d19d610

Sophos Netwalker May 2020

ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39742f2e-0cba-4315-b2c5-fd8d8e604413

Netskope LummaStealer 2025

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.