Compromise Host Software Binary
Technique · ATTACK:enterprise:T1554
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1554",
"title": "Compromise Host Software Binary",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1554",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--960c3c86-1480-4d72-b4e0-8c242e84a5c5",
"external_id": "T1554",
"domain": "enterprise",
"created": "2020-02-11T18:18:34.279Z",
"modified": "2026-05-12T15:12:00.706Z",
"version": "2.2",
"aliases": [
],
"tactics": [
"persistence"
],
"source_references": [
{
"source_name": "Google Cloud Mandiant UNC3886 2024",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"
},
{
"source_name": "Unit42 Banking Trojans Hooking 2022",
"url": "https://unit42.paloaltonetworks.com/banking-trojan-techniques/#post-125550-_rm3d6xxbk52n"
},
{
"source_name": "ESET FontOnLake Analysis 2021",
"url": "https://web-assets.esetstatic.com/wls/2021/10/eset_fontonlake.pdf"
}
]
}Explicit source assertions (26)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S9014 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--08057a27-6711-4956-8a27-739ad26a2883
Google UNC5221 Ivanti January 2025ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--159f5a62-ad01-481e-ba18-a70cd19fa40d
Flashpoint Mini Shai-Hulud MAY 2026ATTACK:enterprise:S1116 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ec3f511-0684-4e13-90a0-d8d93a7279b0
Mandiant Cutting Edge January 2024ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--221a785c-45cc-42d7-9831-268a2d6019e3
Google Cloud Mandiant UNC3886 2024 · Mandiant Fortinet Zero DayATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f9b76e7-7902-44b1-b589-51f5657fff75
ESET IndustroyerATTACK:enterprise:S1136 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4cc2992e-016b-47cb-a1be-5bcf808a34c2
Unit42 Agrius 2023ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f2fa285-c269-4bbc-afe8-afbd8fcfcda9
Mandiant Cutting Edge Part 2 January 2024 · Mandiant Cutting Edge January 2024 · Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:S1118 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5011498f-ddfd-44fb-8f1b-8b7e9a113a26
Mandiant Cutting Edge Part 3 February 2024 · Mandiant Cutting Edge Part 2 January 2024ATTACK:enterprise:S0641 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c365b61-0c14-41aa-b82a-052eb977062b
ESET Kobalos Jan 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5f14394c-2b44-4187-a2a4-7ccb4109fdb1
Mandiant Pulse Secure Zero-Day April 2021 · Mandiant Pulse Secure Update May 2021ATTACK:enterprise:M1045 → mitigates → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--685da2a8-4205-4773-982b-5954393c70f8
ATTACK:enterprise:S0487 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68e017e5-ee14-4e33-9907-2537fbbdb117
ESET ForSSHe December 2018ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7300af33-a55d-47a7-86a6-3b756abfc8e5
wardle evilquest partii · reed thiefquest ransomware analysisATTACK:enterprise:S1121 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--81e312b8-5413-4018-b0e7-0cdb50393839
Mandiant Cutting Edge Part 3 February 2024ATTACK:enterprise:S1184 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b35ba04-fdad-4265-a1e8-e089a79baf4d
Google Cloud BOLDMOVE 2023ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d90820b-fd91-4452-aa91-50b783c2da38
ESET Ebury Feb 2014 · ESET Ebury May 2024ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--960aa72e-9821-40e7-aff4-7dd5b92873de
AI-Mexico-Govt-BreachATTACK:enterprise:S1119 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aba5da8c-1c64-459b-8fdb-6c29be72e878
Mandiant Cutting Edge Part 2 January 2024 · Mandiant Cutting Edge January 2024ATTACK:enterprise:S0486 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc40c6be-575a-4eb9-981f-fa6c127d2286
ESET ForSSHe December 2018ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c434336b-336d-490f-bf9a-5e0d259d6d5c
Koi Glassworm New Tricks December 2025ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2e10525-62f5-42ba-a923-ed29cfb4040e
trendmicro xcsset xcode project 2020ATTACK:enterprise:C0025 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e51f5310-3508-4a79-8f3e-3a02f5d685e8
ESET IndustroyerATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9ee370f-d437-4030-8b26-00f0f66020e4
Juniper RedPenguin MAR 2025ATTACK:enterprise:S1120 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb9a97fd-b87d-42d1-b1ee-3a6a17447d56
Mandiant Cutting Edge Part 2 January 2024ATTACK:enterprise:S1104 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb9d818f-cf34-4d58-9326-3391adbbb656
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:S1115 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f9f9a03b-107a-4cba-ad4e-39d9424da100
Mandiant Cutting Edge January 2024 · Volexity Ivanti Zero-Day Exploitation January 2024