Skip to content

Malicious Link

Subtechnique · ATTACK:enterprise:T1204.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1204.001",
  "title": "Malicious Link",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1204/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--ef67e13e-5598-4adc-bdb2-998225874fa9",
  "external_id": "T1204.001",
  "domain": "enterprise",
  "created": "2020-03-11T14:43:31.706Z",
  "modified": "2026-09-11T19:19:57.658Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "execution"
  ],
  "source_references": [

  ]
}

Explicit source assertions (94)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00561c3c-345e-4578-95c3-b7e0a95db7b1

CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:G0098 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--036d9e28-e7c4-4865-b964-2ea213274521

TrendMicro BlackTech June 2017

ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--039373a2-84b0-4780-b3ca-475ce5207a94

ESET MirrorFace 2025 · Trend Micro Earth Kasha Anel NOV 2024

ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0be595fa-a284-4657-a1bd-9b22e56b6604

IBM Grandoreiro April 2020 · ESET Grandoreiro April 2020

ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17e7193e-6583-4bae-8a17-de75f006cd36

Cybereason Bazar July 2020 · Zscaler Bazar September 2020 · CrowdStrike Wizard Spider October 2020

ATTACK:enterprise:C0002 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fdcaa51-4445-43be-99eb-52787756fa1c

McAfee Night Dragon

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--218a923b-2909-4186-8cf7-8fbfed6f2aaf

IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025 · 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · Crowdstrike MUSTANG PANDA June 2018 · 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload · Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025 · Proofpoint TA416 Europe March 2022 · McAfee Dianxun March 2021

ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21ebcd72-cb89-4d26-82b7-4d17843034c5

Kaspersky MoleRATs April 2019 · Unit42 Molerat Mar 2020

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2332793b-afd0-407b-a1dc-97c5c7580bcb

SANS Windshift August 2018

ATTACK:enterprise:S1017 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24caab23-239c-4012-bb62-5b843f1ff767

Palo Alto Unit 42 OutSteel SaintBot February 2022

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ba344c1-aa24-4566-9df0-2556363fe8eb

KISA Operation Muzabi

ATTACK:enterprise:G0140 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f146c3d-5dd4-42e2-a62b-04adcb36485c

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:G0142 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f14f601-d732-4770-ab76-a7c99627398e

TrendMicro Confucius APT Aug 2021

ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--324a3d54-b9e5-4982-825d-87d281c07544

Cadet Blizzard emerges as novel threat actor · Palo Alto Unit 42 OutSteel SaintBot February 2022

ATTACK:enterprise:C0005 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3445ad37-1738-45c3-aabd-dcc048d2ad2d

ESET Operation Spalax Jan 2021

ATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--387640be-2b25-40c3-9048-f6cb86beab78

Cylance Dust Storm

ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--393317c3-7dd7-487c-a2cb-81dfe4333ea3

Unit 42 NETWIRE April 2020 · FireEye NETWIRE March 2019

ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c2b63fe-e891-4ac5-a0aa-d02536699614

ESET Lazarus Jun 2020 · ClearSky Lazarus Aug 2020

ATTACK:enterprise:G0090 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ce7d771-a246-4b79-839e-2e5670103bbe

Check Point Wirte NOV 2024

ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3de1cc89-ee9a-4476-9d93-a034da6a90bf

ZScaler Squirrelwaffle Sep 2021

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f8ae509-18e1-4189-9aa4-2ae649e56a88

Group IB Ransomware September 2020 · Trend Micro Black Basta October 2022 · Kaspersky QakBot September 2021 · Trend Micro Qakbot May 2020 · ATT QakBot April 2021 · Kroll Qakbot June 2020 · Trend Micro Qakbot December 2020

ATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ff580a6-1323-4587-8f64-137e02f148e6

Bleeping Computer Latrodectus April 2024 · Latrodectus APR 2024

ATTACK:enterprise:S0499 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--471304cd-f98a-49f7-a33e-2d69ab6c8a47

Threatpost Hancitor

ATTACK:enterprise:S0528 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4aaa3063-d1b0-4c13-aa6d-829000f05aec

Securelist Brazilian Banking Malware July 2020

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5458626f-976e-4007-bb93-43a8a69b0ec1

Microsoft CYBERWARCON NOV 2024 · Microsoft Axios Compromise APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026 · 1 - appv

ATTACK:enterprise:C0021 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5610e19c-de2e-4b9d-9e10-776e94528b0d

FireEye APT29 Nov 2018

ATTACK:enterprise:C0037 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5685e636-7ee7-47d2-a179-edcaa9d26938

TrendMicro Pikabot 2024

ATTACK:enterprise:S0649 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5969ffbe-edd3-4bb3-aee4-4e73ac9c6a7f

FireEye Shining A Light on DARKSIDE May 2021

ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a374aec-ae82-4c99-bbc2-34c4050a9932

FireEye Obfuscation June 2017 · FireEye Know Your Enemy FIN8 Aug 2016 · FireEye Fin8 May 2016

ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6035f6c6-8e6c-4ac6-9467-722502e90799

Proofpoint TA2541 February 2022 · FireEye NETWIRE March 2019

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--616bf309-ed87-4573-8640-416e6f05285d

MSTIC NOBELIUM May 2021 · Secureworks IRON RITUAL USAID Phish May 2021

ATTACK:enterprise:S9044 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--670c1635-4831-491a-be9a-f2a70b5d545c

Artic Wolf Labs Kali365 Device Code April 2026 · Huntress Kali365 Device Code June 2026

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--67154159-cd44-4d9c-ae84-c82a8cd5ee58

Symantec Patchwork · TrendMicro Patchwork Dec 2017 · Volexity Patchwork June 2018 · Unit 42 BackConfig May 2020

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--67e3c192-f0f3-4b8d-9fd7-b4200acebd85

FireEye Clandestine Wolf

ATTACK:enterprise:G0120 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c0ae1dc-2429-42fd-899e-8aafb9adc50c

ESET EvilNum July 2020

ATTACK:enterprise:S1086 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ebe95eb-909e-460e-b2ff-db0838e2f1e8

Telefonica Snip3 December 2021

ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7194f06c-abd5-4ff8-ad95-2449adaa4c13

ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71ee0311-3fdc-4baf-8c3e-2143416b742c

Proofpoint TA505 Sep 2017 · Proofpoint TA505 June 2018 · Proofpoint TA505 Jan 2019 · Cybereason TA505 April 2019 · ProofPoint SettingContent-ms July 2018 · Proofpoint TA505 Mar 2018 · Trend Micro TA505 June 2019 · Proofpoint TA505 October 2019

ATTACK:enterprise:S9026 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74244c73-6561-4dcd-b96a-e365c7e21b09

Trend Micro Earth Kasha Updates APR 2025

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74480cd6-1f2e-4c2d-a1ad-82cc50d63d14

Kaspersky LuminousMoth July 2021

ATTACK:enterprise:S0644 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--754a5c00-45bb-4279-bdd2-ec11d54f2926

Talos Oblique RAT March 2021 · Talos Transparent Tribe May 2021

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77a98e76-5a38-40a8-af9a-180c31bf7563

Certfa Charming Kitten January 2021 · ClearSky Kittens Back 3 August 2020

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77e0980c-de43-48a8-8df3-b924f8d91b51

FireEye APT39 Jan 2019 · FBI FLASH APT39 September 2020

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--788a6ca2-60ac-4f36-b708-c3a57f087b2b

Cybereason Cobalt Kitty 2017 · Volexity Ocean Lotus November 2020 · Amnesty Intl. Ocean Lotus February 2021

ATTACK:enterprise:G0103 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78a49769-fec0-4961-a25d-fc5eab623e93

FOX-IT May 2016 Mofang

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a75776c-22e1-4227-9c7a-8531f9ce6c5e

SentinelOne Gootloader June 2021 · Sophos Gootloader

ATTACK:enterprise:C0011 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7bda4cc5-09d8-4e0e-87af-f33cdb7a63d1

Cisco Talos Transparent Tribe Education Campaign July 2022

ATTACK:enterprise:G0085 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--822c5044-906d-4c4f-b350-49471beb03a8

FireEye Hacking FIN4 Video Dec 2014 · FireEye Hacking FIN4 Dec 2014

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86a6b769-470e-4aa4-a285-2559af72a21b

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8769bb08-b5e3-4264-95ac-6164bdbd54f3

US District Court Indictment GRU Unit 74455 October 2020

ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89672463-a201-43c7-a24a-1e6d7a1a188a

CSM Elderwood Sept 2012 · Symantec Elderwood Sept 2012

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8be8b96b-b69c-497a-8b38-308b8bd291ff

ESET Turla Mosquito Jan 2018

ATTACK:enterprise:G1038 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e575d01-2a20-4718-b95c-f9af3a200da0

Latrodectus APR 2024

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f8d7305-96e8-46c9-8fb9-1a1b85c8fbe5

Sophos Qilin MSP APR 2025 · SentinelOne Qilin NOV 2022

ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8fd50d9a-0d3e-4433-a2b9-b9e0ae3621f7

ESET EvasivePanda 2024

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90b7c9e6-53db-4656-a5ee-f8056a8d6ef7

Trend Micro Banking Malware Jan 2019 · Carbon Black Emotet Apr 2019

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--952edf61-e906-4ab5-989f-1d6a5dd95dce

ClearSky OilRig Jan 2017 · Unit 42 OopsIE! Feb 2018 · Unit 42 QUADAGENT July 2018 · Crowdstrike Helix Kitten Nov 2018

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9730ebe6-78b7-4dbf-93f4-add720033985

ESET Gamaredon Sept2024 · unit42_gamaredon_dec2022

ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--988fda8d-8374-4ff7-b70c-f2a654442808

Google EXOTIC LILY March 2022

ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c7833f5-6e00-4118-9f9d-c7f23e1c8857

Kaspersky BlindEagle AUG 2024

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c8cf20d-b834-4460-a8a8-13d96c19d2ea

Talos Cobalt Group July 2018 · Unit 42 Cobalt Gang Oct 2018 · Secureworks GOLD KINGSWOOD September 2018

ATTACK:enterprise:S0453 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a0b2b4b4-c522-4428-a70b-ad1002417a28

Malwarebytes Pony April 2016

ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5a1488d-2028-4132-9aef-2e6da56ffca0

CheckPoint_NimbusManticoreEurope_Sept2025 · CheckPoint_NimbusManticore_May2026 · Mandiant_UNC1549TTPsTools_Nov2025 · Mandiant_UNC1549_Feb2024

ATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a63bc24e-2b10-46bc-a9a5-992701755923

SocGholish-update

ATTACK:enterprise:S0435 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a77818b1-bbe8-477f-a8b1-1704e525d5a9

TrendMicro BlackTech June 2017

ATTACK:enterprise:S0669 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad8fcad2-fe74-4795-b369-eb669c75b9b5

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:G0128 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aeffbd1d-a962-492a-a6bf-670b70f01abb

Google Election Threats October 2020 · Zscaler APT31 Covid-19 October 2020

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b4824825-f732-44d9-a088-3ce222c0f751

Talos Oblique RAT March 2021 · Talos Transparent Tribe May 2021

ATTACK:enterprise:S0646 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b5372961-d931-497e-8043-1bfa446f65d6

Secureworks GOLD KINGSWOOD September 2018

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b6fa5f7f-1055-4a9a-8372-d281fd6ca4af

Anomali Static Kitten February 2021 · Proofpoint TA450 Phishing March 2024 · Trend Micro Muddy Water March 2021

ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b9711cc5-0d30-403c-8ff7-92e2a21e1905

Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b9dcab92-6b0d-43c7-a122-90eccb016b9d

DHS/CISA Ransomware Targeting Healthcare October 2020

ATTACK:enterprise:S0561 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba79589f-f4e2-497b-b25b-a6a0abf3eedd

Unit 42 NETWIRE April 2020

ATTACK:enterprise:G0095 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba84c2c2-e5bf-432e-9827-6d622490ba2d

Cylance Machete Mar 2017 · Securelist Machete Aug 2014 · ESET Machete July 2019

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bbeb5b3a-3533-4252-9c81-3cc027ba8b20

Intrinsec_Vidar_April2026

ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4600507-03d9-471f-a175-d5fd3953c0c6

Cybereason Bumblebee August 2022 · Proofpoint Bumblebee April 2022

ATTACK:enterprise:G1020 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c809e1ba-e97b-41bf-a704-26fe09b6235c

SocGholish-update · Microsoft Ransomware as a Service

ATTACK:enterprise:T1204.001 → subtechnique-of → ATTACK:enterprise:T1204

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ce39dc03-c3aa-4c6b-9edb-c05c3b934cbd

ATTACK:enterprise:S0436 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d15c7116-2d00-48cd-9003-1ab6fc4a0076

JPCert TSCookie March 2018

ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2ea2645-1940-4776-a874-09309f75636a

ATT Sidewinder January 2021 · Rewterz Sidewinder APT April 2020 · Rewterz Sidewinder COVID-19 June 2020 · Cyble Sidewinder September 2020

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.