Messaging Applications
Subtechnique · ATTACK:enterprise:T1213.005
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1213.005",
"title": "Messaging Applications",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1213/005",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--fb75213f-cfb0-40bf-a02f-3bad93d6601e",
"external_id": "T1213.005",
"domain": "enterprise",
"created": "2024-08-30T13:50:42.023Z",
"modified": "2026-05-12T15:12:00.726Z",
"version": "1.0",
"aliases": [
],
"tactics": [
"collection"
],
"source_references": [
{
"source_name": "Sentinel Labs NullBulge 2024",
"url": "https://www.sentinelone.com/labs/nullbulge-threat-actor-masquerades-as-hacktivist-group-rebelling-against-ai/"
},
{
"source_name": "Permiso Scattered Spider 2023",
"url": "https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud"
},
{
"source_name": "SC Magazine Ragnar Locker 2021",
"url": "https://www.scmagazine.com/analysis/ragnar-locker-reminds-breach-victims-it-can-read-the-on-network-incident-response-chat-rooms"
},
{
"source_name": "Guardian Grand Theft Auto Leak 2022",
"url": "https://www.theguardian.com/games/2022/sep/19/grand-theft-auto-6-leak-who-hacked-rockstar-and-what-was-stolen"
},
{
"source_name": "Microsoft DEV-0537",
"url": "https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"
}
]
}Explicit source assertions (10)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1213.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19f46d7e-22bd-4326-bc4e-b1b7335aee67
Github TruffleSecurity Trufflehog April 2025ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1213.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--330756e3-8bb1-4002-8626-1feef655ba8d
Microsoft Sapphire Sleet APR 2026ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1213.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5db540e2-7f7d-4816-96f2-6498b3f14e5e
ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1213.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5e09a01c-8dc8-4ada-bfaa-b2298a39eece
ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1213.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--628054bd-e758-4528-a1fb-40983ecec149
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:T1213.005 → subtechnique-of → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ccb448d-955e-438a-b394-bdafa50092b7
ATTACK:enterprise:M1060 → mitigates → ATTACK:enterprise:T1213.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b1e43f0e-e68e-427c-9b94-09080ef6634a
TrustedSec OOB CommunicationsATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1213.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf341c57-1bdf-4d7a-8c01-1d94acce69a8
CISA Scattered Spider Advisory November 2023ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1213.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c0a23c9d-a972-46a9-9a86-a440bbfd5d1f
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1213.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e4b04735-40ca-4479-b978-0745912b361b
Mandiant_UNC1549TTPsTools_Nov2025