Skip to content

Credentials from Web Browsers

Subtechnique · ATTACK:enterprise:T1555.003

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1555.003",
  "title": "Credentials from Web Browsers",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1555/003",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--58a3e6aa-4453-4cc8-a51f-4befe80b31a8",
  "external_id": "T1555.003",
  "domain": "enterprise",
  "created": "2020-02-12T18:57:36.041Z",
  "modified": "2026-09-11T19:22:47.433Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "GitHub Mimikittenz July 2016",
      "url": "https://github.com/putterpanda/mimikittenz"
    },
    {
      "source_name": "Talos Olympic Destroyer 2018",
      "url": "https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
    },
    {
      "source_name": "Microsoft CryptUnprotectData April 2018",
      "url": "https://docs.microsoft.com/en-us/windows/desktop/api/dpapi/nf-dpapi-cryptunprotectdata"
    },
    {
      "source_name": "Proofpoint Vega Credential Stealer May 2018",
      "url": "https://www.proofpoint.com/us/threat-insight/post/new-vega-stealer-shines-brightly-targeted-campaign"
    },
    {
      "source_name": "FireEye HawkEye Malware July 2017",
      "url": "https://www.fireeye.com/blog/threat-research/2017/07/hawkeye-malware-distributed-in-phishing-campaign.html"
    }
  ]
}

Explicit source assertions (99)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07773227-54d9-4476-877a-739c490b7b65

Fidelis njRAT June 2013 · Trend Micro njRAT 2018 · Citizen Lab Group5

ATTACK:enterprise:S1246 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0cba3f24-f1b0-4184-afd4-f7bd3d34c49b

Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024 · Socket BeaverTail XORIndex HexEval Contagious Interview July 2025 · Socket HexEval BeaverTail Contagious Interview June 2025 · ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d4d7376-5bda-44bc-b90d-0a065bb99433

F-Secure BlackEnergy 2014 · Securelist BlackEnergy Nov 2014

ATTACK:enterprise:S0132 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d4e8cb8-c265-449a-b010-f4614135572f

Cisco H1N1 Part 2

ATTACK:enterprise:S1122 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10432a2f-2a96-46ad-b9c1-c35f405c09db

ESET Security Mispadu Facebook Ads 2019 · Metabase Q Mispadu Trojan 2023 · SCILabs Malteiro 2021

ATTACK:enterprise:S0434 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14307b7b-0837-4c15-a959-0c8d24e05b6b

QiAnXin APT-C-36 Feb2019

ATTACK:enterprise:S9062 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--151d1f28-13c0-4186-a636-f3131b6a6869

CheckPoint_NimbusManticoreEurope_Sept2025

ATTACK:enterprise:S0365 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17d2730a-c2b7-4d58-b22f-921600daccfb

Talos Olympic Destroyer 2018

ATTACK:enterprise:S0528 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1910d7f9-b71c-4a85-80ad-74b6722aa208

Securelist Brazilian Banking Malware July 2020

ATTACK:enterprise:S0492 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19bfa4e1-509b-417a-9bcc-b739f7d798a7

Unit42 CookieMiner Jan 2019

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1df7df54-c4c1-49f0-a0c3-11102db44f2c

Cymmetria Patchwork

ATTACK:enterprise:S1042 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f552cc5-66fe-44a6-8881-8e127fc5c0f0

Mandiant UNC3890 Aug 2022

ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21f211bb-733d-4fed-b8c5-e008811097db

TrendMicro LummaStealer 2025 · Fortinet LummaStealer 2024 · Cybereason LumaStealer Undated

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23b9cf45-fbd6-49b9-892d-6f3b1de18f9f

Rostovcev APT41 2021

ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25a92f58-75d6-46a5-8e82-7f576f9659a5

Check Point Warzone Feb 2020 · Uptycs Warzone UAC Bypass November 2020

ATTACK:enterprise:S1201 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28093010-d22d-43d7-9570-79e442336eae

Zscaler Kimsuky TRANSLATEXT

ATTACK:enterprise:G0128 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28757531-79b3-4c51-8e6c-b9b317a06abd

Zscaler APT31 Covid-19 October 2020

ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29403801-cdba-4de9-9b9c-c1295b9eccf6

Talos Konni May 2017

ATTACK:enterprise:G1026 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2bc01152-d964-4d53-86bd-a35e56200379

SCILabs Malteiro 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2cac54a6-fe28-45b2-b4f7-53a23f8a5f54

CrowdStrike StellarParticle January 2022

ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--352953e9-c1ca-4d25-84b6-eb05a012b2e9

ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--360f1c0d-c6ec-4d49-92a0-e8ce63559960

Kaspersky BlindEagle AUG 2024 · GitHub QuasarRAT · Volexity Patchwork June 2018

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3911c758-2c61-4615-88a1-4b9f21c99a9c

Symantec Buckeye

ATTACK:enterprise:S0349 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b806ebb-0c5d-4ba8-adf8-b215a59f81b0

GitHub LaZagne Dec 2018

ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3baf9dda-1286-4a3b-874b-7a04f0172aae

Symantec Elfin Mar 2019 · FireEye APT33 Guardrail

ATTACK:enterprise:S0153 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4086a9d6-5574-48fb-be8d-e8406145e740

Accenture Hogfish April 2018

ATTACK:enterprise:G0038 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--410e0c58-d96c-40ae-bf00-2d4b414daf50

Citizen Lab Stealth Falcon May 2016

ATTACK:enterprise:S1146 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--416dfc14-ae33-49f7-8084-d35dee036dc1

ESET EvasivePanda 2023 · Symantec Daggerfly 2023

ATTACK:enterprise:S0436 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--426c8308-0856-4dad-85e6-87df276cfa69

JPCert TSCookie March 2018

ATTACK:enterprise:S0226 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44aeb943-8861-4018-a93b-beeb393bfa8f

Talos Smoke Loader July 2018

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47173be4-dc15-49c6-9e81-cba36c6e6c68

Bitdefender Agent Tesla April 2020

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4889f7a3-2c36-423a-b48d-c5405e07442f

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48a5f18e-d744-4600-8489-18533cadb0c0

ESET Machete July 2019

ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e16de60-84f8-47c8-a069-a7af5178b13d

Koi Glassworm New Tricks December 2025 · Socket GlassWorm January 2026

ATTACK:enterprise:S0344 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ffe77f2-8b05-40ff-b572-f7c0b9040571

Unit42 Azorult Nov 2018

ATTACK:enterprise:S0113 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5033a0a2-ef95-4ec6-b5ac-d7cfbd7be9f0

ESET Operation Groundbait

ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--519b3d7a-2de3-470b-a1cd-f40d0c351ea3

Secureworks Karagany July 2019

ATTACK:enterprise:S1156 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56213677-9ebd-475c-b7a1-be35665dd4e6

Talos Manjusaka 2022

ATTACK:enterprise:S0526 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59e682dd-3a1f-48ab-8e1f-3fb967676931

Cybereason Kimsuky November 2020

ATTACK:enterprise:G0077 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d3f58bf-2192-46f9-bba3-27e917b75df6

Symantec Leafminer July 2018

ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e596415-354e-4ccc-bc9d-3deb3fe5de1e

FireEye APT37 Feb 2018

ATTACK:enterprise:S0050 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62943e4f-a181-4eb2-84a4-27ed3e7308af

F-Secure The Dukes

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6930c084-c02c-4278-8343-6a47fed4fdc0

ESET Telebots Dec 2016

ATTACK:enterprise:S0138 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--695c2f41-140a-48f9-9e14-0cd58d7712d1

ATTACK:enterprise:S0629 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70166ae9-63ec-4d74-be69-ec42a39c239c

Bitdefender Naikon April 2021

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7804d727-91bc-41bd-9b05-686d550e9e04

Deply Mimikatz · GitHub Mimikatz lsadump Module · Directory Services Internals DPAPI Backup Keys Oct 2015 · NCSC Joint Report Public Tools

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ac04e64-a09e-4a66-b6ce-047030400045

Trend Micro Emotet Jan 2019 · IBM IcedID November 2017

ATTACK:enterprise:S1245 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8117e136-627c-41bf-94ae-c99ff300c5a1

Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024 · ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81abc87e-ce9f-4b03-af21-b1f35d0b64ec

Sekoia Raccoon2 2022

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--885cab64-2589-4917-95ab-4ae5a2b75cd3

Symantec MuddyWater Dec 2018 · Trend Micro Muddy Water March 2021

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--890f944f-190d-456d-b194-f5ecb17a0868

Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e2cd29d-5d72-450d-8697-d7121e1b2e8d

GitHub SILENTTRINITY Modules July 2019

ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f58a6f1-f95b-4f38-8347-995880aa6029

Red Canary NETWIRE January 2020 · FireEye NETWIRE March 2019 · Proofpoint NETWIRE December 2020

ATTACK:enterprise:S0530 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--91a7667b-592f-45c1-a069-986380d29e71

Securelist Brazilian Banking Malware July 2020

ATTACK:enterprise:S1207 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--945108e9-bf13-48ed-bdf5-a7888d0f9fba

Netskope XLoader 2022 · Google XLoader 2017 · Zscaler XLoader 2025

ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--956078f0-e1b1-4be7-9bf3-f03630ec3f1b

MSTIC DEV-0537 Mar 2022

ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--965ea950-3680-4317-8f73-996157632a0e

Volexity InkySquid BLUELIGHT August 2021

ATTACK:enterprise:S9022 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--976118d5-b033-4dfc-b4be-b8190f2cf641

ESET MirrorFace DEC 2022 · Trend Micro Earth Kasha NOV 2024

ATTACK:enterprise:S0144 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9bc7f2ff-7ba1-42f4-9e96-2112e99ab12a

PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:S0279 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ca71386-44e2-41e5-aecf-796de464855d

objsee mac malware 2017

ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d588be8-f13d-458d-9480-f39ef82197d6

Kaspersky Lyceum October 2021

ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e27c930-eba5-467f-90e5-4ec5b4219735

Proofpoint TA505 Sep 2017

ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a06bd922-b887-4134-81cb-1e4180cf5a5a

ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a0704053-1dec-4f7d-bcb2-ff2372640b02

ESET RedLine Stealer November 2024 · Kroll RedLine Stealer August 2024 · Proofpoint RedLine Stealer March 2020 · Splunk RedLine Stealer June 2023

ATTACK:enterprise:M1051 → mitigates → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2ff468d-e5a3-4dea-a9b4-ca3583d7a72c

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3d4b793-b11a-4d6d-9a72-8c592a1eb834

ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a454aae7-c327-4df5-af79-1191f8128f4e

ATTACK:enterprise:S0130 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a76e4748-2cef-4ee6-96a3-53ee227f0333

Forcepoint Monsoon

ATTACK:enterprise:G0130 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac196369-5b5b-4e71-805a-3f64f150b1e2

Check Point Rocket Kitten

ATTACK:enterprise:G0100 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad3298b6-8cb5-4c4e-b2be-e058273c15be

Symantec Inception Framework March 2018

ATTACK:enterprise:S0093 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--adf7a6a5-91b0-4c37-9fa5-0bfbb382a838

Symantec Dragonfly

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b2ab1f44-2c92-4c1e-ba9e-c61737a59323

Microsoft Sapphire Sleet APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b620d7cd-34ef-402c-b8c2-e36c27162c63

CISA AA24-038A PRC Critical Infrastructure February 2024

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b6d8f711-8b5f-4b5e-82c4-abf144223c55

Talos Kimsuky Nov 2021 · Netscout Stolen Pencil Dec 2018 · Zdnet Kimsuky Dec 2018 · CISA AA20-301A Kimsuky

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b97afcfc-489a-4d59-89b3-1533eae926e0

Github PowerShell Empire

ATTACK:enterprise:S0161 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b9e2fac9-fc1a-4e13-ac68-1a5796b04d72

ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba93bce7-7214-45e9-9deb-4fefb5038aab

BiZone Lizar May 2021

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be16ecaf-46a6-4602-8d7e-0273c9983520

Cyfirma_Vidar_June2024 · Intrinsec_Vidar_April2026 · LevelBlue_Vidar_May2026 · Unit42_Vidar_July2026 · QuorumCyber_Vidar_March2023

ATTACK:enterprise:M1021 → mitigates → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c375648a-e0ce-49f1-8428-d498444e0e64

ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2bb226a-810d-47ea-be8d-397b9dd94031

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.