Exploit Public-Facing Application
Technique · ATTACK:enterprise:T1190
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1190",
"title": "Exploit Public-Facing Application",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1190",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--3f886f2a-874f-4333-b794-aa6075009b1c",
"external_id": "T1190",
"domain": "enterprise",
"created": "2018-04-18T17:59:24.739Z",
"modified": "2026-05-12T15:12:00.628Z",
"version": "2.8",
"aliases": [
],
"tactics": [
"initial-access"
],
"source_references": [
{
"source_name": "CWE top 25",
"url": "https://cwe.mitre.org/top25/index.html"
},
{
"source_name": "CIS Multiple SMB Vulnerabilities",
"url": "https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-microsoft-windows-smb-server-could-allow-for-remote-code-execution/"
},
{
"source_name": "Ars Technica VMWare Code Execution Vulnerability 2021",
"url": "https://arstechnica.com/information-technology/2021/02/armed-with-exploits-hackers-on-the-prowl-for-a-critical-vmware-vulnerability/"
},
{
"source_name": "Recorded Future ESXiArgs Ransomware 2023",
"url": "https://www.recordedfuture.com/blog/esxiargs-ransomware-targets-vmware-esxi-openslp-servers"
},
{
"source_name": "Wired Russia Cyberwar",
"url": "https://www.wired.com/story/russia-ukraine-cyberattacks-mandiant/"
},
{
"source_name": "Mandiant Fortinet Zero Day",
"url": "https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"
},
{
"source_name": "NVD CVE-2016-6662",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6662"
},
{
"source_name": "NVD CVE-2014-7169",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7169"
},
{
"source_name": "Cisco Blog Legacy Device Attacks",
"url": "https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954"
},
{
"source_name": "OWASP Top 10",
"url": "https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project"
},
{
"source_name": "US-CERT TA18-106A Network Infrastructure Devices 2018",
"url": "https://us-cert.cisa.gov/ncas/alerts/TA18-106A"
}
]
}Explicit source assertions (85)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0062 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0365ae71-f035-48af-bed4-7609e7029804
Anthropic AI Orchestrated Campaign NOV 2025ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--04e866d0-5d9d-435d-b37c-311bb0bbdb1e
Crowdstrike TELCO BPO Campaign December 2022ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06508c23-746d-4894-b414-cff925692bd5
Talos Rocke August 2018 · Unit 42 Rocke January 2019ATTACK:enterprise:C0039 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--07dec22a-ac65-448c-a948-cefd8effa6f2
Lumen Versa 2024ATTACK:enterprise:C0045 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0beabd79-c7a6-449b-806b-c50979cbc3d7
Oligo ShadowRay Campaign MAR 2024ATTACK:enterprise:M1048 → mitigates → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c8fdb59-a28f-4f8f-a788-9e3e8928c6d5
ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11e07a59-502c-44e9-9a70-03eff1433c33
Trend Micro Iron Tiger April 2021ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--198a9aa2-5d98-46c2-b43b-0191786049e7
Microsoft Ransomware as a ServiceATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c0c0c90-7974-48f4-9de0-15a8d9b00e0a
ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--237d7c2e-503a-420c-bf94-047f5c42a646
Cisco Talos Avos Jun 2022ATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--269fbafb-f9ad-4782-b9e6-ccf44e3723f8
Aqua Security Blog Trivy Compromise APR 2026 · Aikido TeamPCP Telnyx MAR 2026 · Wiz Mini Shai-Hulud MAY 2026 · Palo Alto TeamPCP MAR 2026ATTACK:enterprise:S0623 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26ecce49-13ab-43a9-a626-10dae30b6961
Unit 42 Siloscape Jun 2021ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--284eb222-c310-480c-aaaa-82c1d5c64e62
CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f30a994-602d-48a0-bd19-bcd02e1cb322
DOJ FBI Handala Hack March 2026ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31353596-4fa7-4a37-8bb9-bc0690742576
Leonard TAG 2023 · NSA Sandworm 2020ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--329d115e-2a1d-443e-800c-d28f5f11d6b9
US District Court Indictment GRU Oct 2018 · Cybersecurity Advisory GRU Brute Force Campaign July 2021ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--33eb4a61-d966-4193-a8e5-237eb5a5129a
KISA Operation MuzabiATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--37306ec5-a50c-43a5-aa02-08b2179fb09d
Cadet Blizzard emerges as novel threat actor · CISA GRU29155 2024ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a41f311-3961-4446-ad71-2a6f4e3561ec
FoxIT Wocao December 2019ATTACK:enterprise:M1030 → mitigates → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3b726298-74dc-4f8a-b58d-f623bc645124
ATTACK:enterprise:C0002 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c695c3d-7f8e-43dd-baad-b2afdfc86fc2
McAfee Night DragonATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f22638d-1003-44d6-a46e-eab83b966834
Mandiant APT41ATTACK:enterprise:G0135 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f4096d5-06d8-4a1e-bb31-0e2b37d5f622
ESET BackdoorDiplomacy Jun 2021ATTACK:enterprise:G0115 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--42d0b653-1d08-4e7b-910f-753412fda316
Secureworks REvil September 2019ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--430c6ce1-4461-4c3a-b7e2-3617cc82483a
ElecticIQ Buyukkaya_ShinyHunters_Sept2025 · Google_SHOracle_Jun2026ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4bbc5989-38f8-4057-a01b-2ff7812ef589
AI-Mexico-Govt-BreachATTACK:enterprise:M1016 → mitigates → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c308ec1-f0c6-4444-af7d-ff045204c326
OWASP Top 10ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d50a045-d85d-481f-ac7d-672065f1e348
ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f5f1da9-9396-4b66-a67b-c08470924882
Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022ATTACK:enterprise:G0098 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--51cc3f41-f5aa-4d04-95de-15d96e103bac
TrendMicro BlackTech June 2017ATTACK:enterprise:M1050 → mitigates → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--53a95297-1cce-401c-99a3-34079e878fac
ATTACK:enterprise:S0225 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--547b575e-bc3c-488a-ae38-8bf6387b33f5
sqlmap IntroductionATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54af36a6-0a08-4853-9002-a1ae51b22ca5
Check Point APT35 CharmPower January 2022 · Cybereason PowerLess February 2022 · DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022 · Microsoft Log4j Vulnerability Exploitation December 2021 · Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:C0049 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57b386c4-5322-4e5b-a8a9-37d68a75f4c0
CISA Leviathan 2024ATTACK:enterprise:C0038 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c1f3cc7-902d-4af1-9910-d149b76ae4a0
CISA Iran Albanian Attacks September 2022ATTACK:enterprise:C0048 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5debdfdd-fe10-4872-a8a2-63309c28d309
Palo Alto MidnightEclipse APR 2024 · Volexity UPSTYLE 2024ATTACK:enterprise:S0516 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61ee8aa7-89fc-4414-97f3-95fa9f1f26ad
CISA SoreFang July 2016ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--62ab55a6-4341-41df-866d-5cc784770e6f
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025ATTACK:enterprise:C0055 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64711bac-8f6b-43f6-bcbc-1bdbf76dd47d
Microsoft Storm-0940 · TP-Link Quad 7 AUG 2025ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6496a79b-5946-4928-a92f-d8372e9c5de8
Talos Sea Turtle 2019 · PWC Sea Turtle 2023ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65971cda-62b8-4685-8070-3d61ded0850d
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66fe07f5-fe08-4ad1-98b6-cb300007fe42
Talos ZxShell Oct 2014ATTACK:enterprise:S1105 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6bbf2f6b-de27-435b-bf3e-bc991a25e561
NCSC-NL COATHANGER Feb 2024ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6cfdc8e4-4970-428b-80c3-89ebb12328c4
Trend Micro SharePoint Attacks JUL 2025 · ESET ToolShell JUL 2025 · Eye Research ToolShell JUL 2025 · SentinelOne ToolShell JUL 2025 · Microsoft SharePoint Exploit JUL 2025 · Palo Alto SharePoint Vulnerabilities JUL 2025ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d4f3696-caa9-4100-bef5-e42d0f18470e
ClearkSky Fox Kitten February 2020 · Dragos PARISITE · CrowdStrike PIONEER KITTEN August 2020 · CISA AA20-259A Iran-Based Actor September 2020 · ClearSky Pay2Kitten December 2020ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7bf7f711-823d-41b8-8e88-801f7fa98591
Sygnia Emperor Dragonfly October 2022 · SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022 · Microsoft Log4j Vulnerability Exploitation December 2021 · Microsoft Ransomware as a ServiceATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7cd37736-47d4-4d56-8398-bd4104f43cb9
Picus BlackByte 2022 · Microsoft BlackByte 2023 · Symantec BlackByte 2022 · FBI BlackByte 2022ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e834bba-4d5d-47b6-b689-b905eba66c0d
Microsoft NICKEL December 2021ATTACK:enterprise:C0052 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--81041da9-e3ff-4487-a54b-f02c0384c95c
NSA APT5 Citrix Threat Hunting December 2022 · ORB MandiantATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--836ba167-10bd-40ce-8578-bbac18d074ed
BradyUnit42_TheGentlemen_July2026 · Intel471_TheGentlemen_Aug2026 · TrendAI_TheGentlemen_Sept2025 · SoučekESET_Gentlemen_Jun2026ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83ac4384-a6a8-42d1-9b1b-273902c57144
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:G1030 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83cd501e-c042-4d2d-bf76-f2d499971302
SentinelOne Agrius 2021ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9171c149-2e87-4882-9e9d-8abce7533beb
Volexity SolarWinds · Cybersecurity Advisory SVR TTP May 2021ATTACK:enterprise:C0061 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9558b7a7-f58b-4b6f-a1f5-8a7cdab03279
sentinelone operationDigitalEye Dec 2024ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96295901-89c2-4646-b18f-3d2eeec651ba
SentinelOne Qilin NOV 2022ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9cf09dbc-7668-4c1c-8e57-01f9c082c80d
Volexity Ivanti Global Exploitation January 2024 · Mandiant Cutting Edge Part 3 February 2024 · Mandiant Cutting Edge Part 2 January 2024 · Mandiant Cutting Edge January 2024 · Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e27b122-a10d-4f0a-8ca8-6040d8879586
Securelist APT10 March 2021ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2a5e505-b957-430e-9bbd-75e6d9e34532
Kaspersky ToddyCat June 2022ATTACK:enterprise:G0108 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4bb6f26-b659-4d1d-b0fc-f4f4efe32db6
RedCanary Mockingbird May 2020ATTACK:enterprise:S1184 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a7fbea9e-99a2-4319-b159-f4cb18908c27
Google Cloud BOLDMOVE 2023ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad60e0be-02a4-4f79-a81d-afdde78492be
Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019ATTACK:enterprise:C0053 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b1eac432-b174-49c1-a8bf-93cedcc7d407
ORB MandiantATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b20bd897-988b-422b-82d1-61e155d34115
ESET WinterVivern 2023 · Proofpoint WinterVivern 2023ATTACK:enterprise:M1035 → mitigates → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b7b6cc9f-50ac-4774-9dd4-3c14b408b99e
ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b8012238-cfd9-4c5b-8759-8d86f0d6f933
TrendMicro EarthLusca 2022ATTACK:enterprise:C0046 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b8a77549-8dbe-4089-97af-0875c90f874b
CCCS ArcaneDoor 2024ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf0ff6f3-51a5-4718-af3f-8f75b1eb507c
NCSC APT29 July 2020 · Cybersecurity Advisory SVR TTP May 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c010891f-9ddb-4943-a87a-e83c46075406
CISA Leviathan 2024ATTACK:enterprise:G0123 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4bc8f71-e4f4-42b8-a39f-b4512987a423
CheckPoint Volatile Cedar March 2015 · ClearSky Lebanese Cedar Jan 2021ATTACK:enterprise:G1032 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c962253b-d89e-4645-bdd4-5625df63abc1
SentinelOne INC Ransomware · SOCRadar INC Ransom January 2024ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca3b64e6-7422-48ce-b9c0-eff9d4ad2635
Google Cloud Mandiant UNC3886 2024 · Mandiant Fortinet Zero DayATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cebc9afb-0f47-4fb5-b3f4-53aa59653a83
JPCERT MirrorFace JUL 2024ATTACK:enterprise:S0224 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ced175fd-1f27-44cb-8d7f-44277b1754e4
Check Point Havij AnalysisATTACK:enterprise:G1009 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf1d394d-a767-40a8-be7a-87c17531dfdb
Checkpoint MosesStaff Nov 2021ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d06cd799-f61b-460e-a287-e58e8ff39022
CISA AA20-296A Berserk Bear December 2020ATTACK:enterprise:M1051 → mitigates → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d373eebb-b578-4b59-9de1-2946bf837d96
ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e11a3d87-d9cf-4dcf-b722-fef4b0a324b4
Cisco Group 72 · Novetta-AxiomATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e7fc5a89-f5a7-432f-a885-6b9532153e7e
apt41_dcsocytec_dec2022 · FireEye APT41 March 2020 · Rostovcev APT41 2021ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e8148225-e246-45c4-b203-2958d0bb07da
CISA Play Ransomware Advisory December 2023 · Trend Micro Ransomware Spotlight Play July 2023ATTACK:enterprise:C0041 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e869a152-1a24-4ae6-9060-2e6cd928589f
Dragos FROSTYGOOP 2024