Skip to content

Code Signing

Subtechnique · ATTACK:enterprise:T1553.002

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1553.002",
  "title": "Code Signing",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1553/002",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--32901740-b42c-4fdd-bc02-345b5dc57082",
  "external_id": "T1553.002",
  "domain": "enterprise",
  "created": "2020-02-05T16:27:37.784Z",
  "modified": "2026-05-12T15:12:00.624Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "defense-impairment"
  ],
  "source_references": [
    {
      "source_name": "EclecticLightChecksonEXECodeSigning",
      "url": "https://eclecticlight.co/2020/11/16/checks-on-executable-code-in-catalina-and-big-sur-a-first-draft/"
    },
    {
      "source_name": "Securelist Digital Certificates",
      "url": "https://securelist.com/why-you-shouldnt-completely-trust-files-signed-with-digital-certificates/68593/"
    },
    {
      "source_name": "Symantec Digital Certificates",
      "url": "http://www.symantec.com/connect/blogs/how-attackers-steal-private-keys-digital-certificates"
    },
    {
      "source_name": "Wikipedia Code Signing",
      "url": "https://en.wikipedia.org/wiki/Code_signing"
    }
  ]
}

Explicit source assertions (94)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00e99176-c74e-4f49-a498-c66a71612a5b

Talos Cobalt Strike September 2020 · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01b97c8a-f08c-4f54-a401-14d888ca79b9

Unit 42 BackConfig May 2020

ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02595a79-3ef9-41a6-be6f-14aebf3a96f1

ESET RedLine Stealer November 2024

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--081c68ae-de26-4ab4-9108-5c7493f34f43

FireEye CARBANAK June 2017 · FireEye FIN7 Aug 2018

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09ee94a2-db35-4932-9a77-b47364346186

CrowdStrike Scattered Spider BYOVD January 2023

ATTACK:enterprise:S1235 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d8106ed-7d52-40bc-be54-5c8c6bc9f0f5

Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025

ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f2e2727-ffe5-42ad-93fc-e856303ca684

Symantec Tick Apr 2016

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1576ad32-c7cc-45af-b39e-410d96a6f908

Unit 42 BackConfig May 2020

ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b1223a8-f8a4-46a9-af36-d71bfc6072b8

Recorded Future RedDelta 2025

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c349498-b79e-46f6-a1dd-12f9f61352a1

Unit42 Bookworm Nov2015

ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d32eeca-9be9-4d2a-85cd-0cbe91b12be8

CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024

ATTACK:enterprise:S0698 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e60c0b8-854b-4d2e-a77b-ed98f3cc4e66

ESET Hermetic Wizard March 2022

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--237b3167-feb7-4b28-990d-d810fe99a23b

S2W Troll Stealer 2024 · ThreatConnect Kimsuky September 2020

ATTACK:enterprise:S9052 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2488d470-8d01-4279-993b-9df5dddbf41d

CheckPoint_NimbusManticore_May2026

ATTACK:enterprise:S0170 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--259a5116-2492-4d7b-b300-1cf9b8c79f00

ClearSky OilRig Jan 2017

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26e2d87c-43c2-4552-9186-2ca0f70e96c7

Check Point Black Basta October 2022

ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a4a9318-ee83-49aa-a278-bde789dd4d2c

SentinelOne Macma 2021

ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b2f2100-16ea-439b-ad64-fe1e8a9c23df

IBM StrelaStealer 2024

ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2fc6e8dc-5117-41ea-9b5f-154cff612f6f

Microsoft GALLIUM December 2019

ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--319cb374-b991-483f-b6d9-e315c333e751

Palo Alto Unit 42 OutSteel SaintBot February 2022

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3213e4e5-c3e4-4d51-8dce-929248f2882b

FireEye APT41 Aug 2019 · Group IB APT 41 June 2021

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--356744ba-4a64-4ada-9c95-6cdc4e539614

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--361cbd71-b178-44d0-9802-78a310938bad

FireEye Operation Molerats

ATTACK:enterprise:S1238 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c5f572b-263b-493c-8bf1-721a46bdbdc0

Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c6fad21-d9e4-4e58-b8d1-ba573b2ec6d8

Lunghi Iron Tiger Linux

ATTACK:enterprise:S9053 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d923980-6a59-4051-bc96-5c64d3a7aa15

CheckPoint_NimbusManticoreEurope_Sept2025

ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--415f38f8-d490-461a-9a40-968f8cd2bd8b

Symantec Ukraine Wipers February 2022 · Crowdstrike DriveSlayer February 2022 · ESET Hermetic Wiper February 2022 · Qualys Hermetic Wiper March 2022

ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41ef6c98-467f-4994-a264-1c4464e94acf

ESET MirrorFace 2025

ATTACK:enterprise:S0342 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--496017cd-f22a-4295-931c-70bb672985f8

ESET GreyEnergy Oct 2018

ATTACK:enterprise:S0520 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a60552c-4abb-4310-be2c-191042ceb637

US-CERT BLINDINGCAN Aug 2020

ATTACK:enterprise:S1150 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4dcca852-a483-4cd2-9fc5-3fa227a12f74

CISA Iran Albanian Attacks September 2022

ATTACK:enterprise:S1196 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4dd5b79e-48e0-46dc-ad7e-001ec3dde358

ASEC Troll Stealer 2024 · S2W Troll Stealer 2024

ATTACK:enterprise:S0210 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e1d7798-ffb7-4495-aab7-ca13db2dade5

Symantec Nerex May 2012

ATTACK:enterprise:S0584 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--562d2865-7133-4cdb-b280-c90105b0a118

CISA AppleJeus Feb 2021

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b6f04b3-9178-45af-be77-bdde4cf47db1

McAfee Honeybee

ATTACK:enterprise:S1151 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5baffc71-6b6f-4a8c-ae95-1aa003e6c73f

IBM ZeroCleare Wiper December 2019

ATTACK:enterprise:S0527 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c7bb53e-d396-4b7e-a925-4a928acc0762

Cybereason Kimsuky November 2020

ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e3c0815-5dc8-44a4-9dce-16bff49fb218

ESET Lazarus Jun 2020

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6004b82e-5860-4a5c-892e-775086598594

ATT QakBot April 2021 · Deep Instinct Black Basta August 2022

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a9c1a1d-f435-422c-b990-d48eb0a87d3e

ClearSky OilRig Jan 2017

ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b0b404e-7e1b-4f8f-8b78-85016f36f8e9

ESET RTM Feb 2017

ATTACK:enterprise:S0504 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7840f5de-3b13-486c-bde2-7ffc73998010

Cyberreason Anchor December 2019

ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a12d83c-edc2-413b-95b3-7516c9b6eca2

CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024

ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82b60e81-eb9a-4159-91ce-87cbb634bb6e

ESET MirrorFace DEC 2022

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83f844ec-b321-4a9d-8c43-edbf6e006a6b

Lazarus APT January 2022

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--84c18662-07de-4abc-99e2-f2bfb19cc5da

FireEye SUNBURST Backdoor December 2020

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88ad4d2e-745e-4712-8901-e772dfaf3298

Kaspersky Turla

ATTACK:enterprise:S9066 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c33f603-ed0f-444e-818e-82454caec486

Mandiant_UNC1549_Nov2025

ATTACK:enterprise:S1232 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d97f8dc-0c9e-43f2-af23-fe260e702cda

Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025

ATTACK:enterprise:G1009 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e0d4a0f-efad-4ee8-bbda-f708dca5ebe6

Checkpoint MosesStaff Nov 2021

ATTACK:enterprise:S1233 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8ffa65ef-05b7-49bb-ba1e-bbf5d1dc5857

Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025

ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--908f1fa6-c797-47c3-bcb1-3438a9105095

Group IB Silence Aug 2019

ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9234553d-b096-418f-b3d0-de75c15d8180

FireEye SUNBURST Backdoor December 2020

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9438f268-3827-435b-98b5-79dbc0ee5213

DFIR Ryuk 2 Hour Speed Run November 2020

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9493cec9-dbbc-43ef-ae57-6f307f8d6001

FireEye Periscope March 2018 · FireEye APT40 March 2019

ATTACK:enterprise:T1553.002 → subtechnique-of → ATTACK:enterprise:T1553

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a10133d4-069f-4678-bcfb-72aeaa575296

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a30f6573-061d-4df0-8c0d-0f6afc5fa96c

Security Intelligence More Eggs Aug 2019

ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a31e890a-074c-4452-95cb-b6cda3e9cbdd

Unit42 Clop April 2021

ATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5ea802c-d95a-4535-81c0-1235ccfd9ca0

Trend Micro TeamPCP MAY 2026

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a802ece1-2efd-4243-8db2-568b59a9c496

Securelist APT10 March 2021

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa896ba8-2d2c-43c3-9264-38a52a84b713

3cx official statement 2023 · Mandiant 3cx UNC4736 2023

ATTACK:enterprise:S0415 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--adbec5d6-1ffe-4b0b-ae03-9c690ff5c507

FireEye FIN7 Oct 2019

ATTACK:enterprise:G0056 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b2f7a2e7-5a72-4ace-b1de-121a8db809d8

Bitdefender StrongPity June 2020

ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b69424ec-3af6-44aa-842a-81fba219b9f4

Kaspersky Darkhotel · Securelist Darkhotel Aug 2015

ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b8dc82ba-2bd6-4299-bf36-9d5968810663

Cybereason Bazar July 2020

ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--badc4d79-2f59-4b9b-9044-9c53dcd386c0

Trend Micro TA505 June 2019 · Cybereason TA505 April 2019 · Deep Instinct TA505 Apr 2019

ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--baeb8449-b956-4119-aea5-717570edb513

Medium Metamorfo Apr 2020

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bee27cd8-cc88-4c96-9709-b0398d7d18bc

CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024 · Lab52 MUSTANG PANDA PUBLOAD MAY 2023 · Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025 · Unit42 Bookworm Nov2015 · Palo Alto Networks, Unit 42 · Sophos PlugX September 2022 · Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025 · Zscaler

ATTACK:enterprise:S0372 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c035989f-a86f-4746-a9d4-3286dc68e473

Wired Lockergoga 2019

ATTACK:enterprise:S0168 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c354bbc0-74c4-4805-b6e6-f33f49272f86

ESET Gazer Aug 2017 · Securelist WhiteBear Aug 2017

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c5407242-9958-4786-9e7f-264ff1851987

CISA Medusa Group Medusa Ransomware March 2025

ATTACK:enterprise:S0624 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c7e92a33-f627-44bd-80be-d6e0cfcef656

Securelist APT10 March 2021

ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c94a3ac7-1f05-460b-9bff-67fafd260e01

Cyberreason Anchor December 2019

ATTACK:enterprise:S0284 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9e900cd-4c6b-4027-b6ca-b93b55c3c5e7

Security Intelligence More Eggs Aug 2019

ATTACK:enterprise:G0039 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb2d2f2d-face-430b-995d-c9bd35db5b90

Symantec Suckfly March 2016

ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf0b5987-3d37-481c-979c-36c597b91fc5

Volexity Patchwork June 2018

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d0644c51-e386-4dd9-99c1-e9f601fc398b

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2ab4ecc-b4e2-414f-8cd5-db890f71f398

TrendMicro LummaStealer 2025

ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d4f37e3b-69bf-4fe4-8d4e-6899fe1f7c3b

ESET EvasivePanda 2024

ATTACK:enterprise:S9067 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d51c1b74-7e85-4b5c-b834-6afb95b604f1

Mandiant_UNC1549_Nov2025

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.