Environmental Keying
Subtechnique · ATTACK:enterprise:T1480.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1480.001",
"title": "Environmental Keying",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1480/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--f244b8dd-af6c-4391-a497-fc03627ce995",
"external_id": "T1480.001",
"domain": "enterprise",
"created": "2020-06-23T22:28:28.041Z",
"modified": "2026-05-12T15:12:00.724Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"stealth"
],
"source_references": [
{
"source_name": "Proofpoint Router Malvertising",
"url": "https://www.proofpoint.com/us/threat-insight/post/home-routers-under-attack-malvertising-windows-android-devices"
},
{
"source_name": "Kaspersky Gauss Whitepaper",
"url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20134940/kaspersky-lab-gauss.pdf"
},
{
"source_name": "EK Clueless Agents",
"url": "https://www.schneier.com/academic/paperfiles/paper-clueless-agents.pdf"
},
{
"source_name": "EK Impeding Malware Analysis",
"url": "https://pdfs.semanticscholar.org/2721/3d206bc3c1e8c229fb4820b6af09e7f975da.pdf"
},
{
"source_name": "Demiguise Guardrail Router Logo",
"url": "https://github.com/nccgroup/demiguise/blob/master/examples/virginkey.js"
},
{
"source_name": "Environmental Keyed HTA",
"url": "http://web.archive.org/web/20200608093807/https://www.nccgroup.com/uk/about-us/newsroom-and-events/blogs/2017/august/smuggling-hta-files-in-internet-exploreredge/"
}
]
}Explicit source assertions (12)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1480.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0a06687e-7e1c-48f1-a3dc-23333f57f215
2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · Trend Micro Mustang Panda Earth Preta Toneshell February 2025 · 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload · ZscalerATTACK:enterprise:G0020 → uses → ATTACK:enterprise:T1480.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3d661b40-6ebf-470f-a675-142f86b6c649
Kaspersky Gauss Whitepaper · Kaspersky Equation QAATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1480.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5212a108-111b-4467-84c9-933d2b84aad2
Twitter ItsReallyNick APT41 EKATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1480.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78617eb0-f679-48ad-82ca-3a85d0f9371e
Volexity InkySquid RokRAT August 2021ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1480.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e11a24f-8194-4d7c-884c-ef6390955b04
2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDAATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1480.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--81089e7a-66d8-49a4-9acc-f786c3cfb1a0
Kaspersky ToddyCat June 2022ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1480.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--85cff8f7-2c44-4886-8b8c-efaac50d4596
ESET InvisiMole June 2020ATTACK:enterprise:M1055 → mitigates → ATTACK:enterprise:T1480.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9a513f75-f09b-4840-8654-521fa4ff59fa
ATTACK:enterprise:T1480.001 → subtechnique-of → ATTACK:enterprise:T1480
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2468213-1073-43d0-bd10-020b23597a6f
ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1480.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dbe1b093-af31-4abd-999e-0e2bf1d0a4d5
Zscaler Pikabot 2023 · Elastic Pikabot 2024ATTACK:enterprise:S0685 → uses → ATTACK:enterprise:T1480.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e8ddbb71-4b8e-44f1-a259-3801efc450b0
Microsoft Actinium February 2022ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1480.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f74ed982-fc1d-4c6b-945c-52c5e8f13fce
Novetta Winnti April 2015