Adversary-in-the-Middle
Technique · ATTACK:enterprise:T1557
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1557",
"title": "Adversary-in-the-Middle",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1557",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--035bb001-ab69-4a0b-9f6c-2de8b09e1b9d",
"external_id": "T1557",
"domain": "enterprise",
"created": "2020-02-11T19:07:12.114Z",
"modified": "2026-05-12T15:12:00.620Z",
"version": "2.5",
"aliases": [
],
"tactics": [
"credential-access",
"collection"
],
"source_references": [
{
"source_name": "dns_changer_trojans",
"url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/web-attack/125/how-dns-changer-trojans-direct-users-to-threats"
},
{
"source_name": "volexity_0day_sophos_FW",
"url": "https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/"
},
{
"source_name": "taxonomy_downgrade_att_tls",
"url": "https://arxiv.org/abs/1809.05681"
},
{
"source_name": "ad_blocker_with_miner",
"url": "https://securelist.com/ad-blocker-with-miner-included/101105/"
},
{
"source_name": "Token tactics",
"url": "https://www.microsoft.com/en-us/security/blog/2022/11/16/token-tactics-how-to-prevent-detect-and-respond-to-cloud-token-theft/"
},
{
"source_name": "mitm_tls_downgrade_att",
"url": "https://www.praetorian.com/blog/man-in-the-middle-tls-ssl-protocol-downgrade-attack/"
},
{
"source_name": "Rapid7 MiTM Basics",
"url": "https://www.rapid7.com/fundamentals/man-in-the-middle-attacks/"
},
{
"source_name": "tlseminar_downgrade_att",
"url": "https://tlseminar.github.io/downgrade-attacks/"
},
{
"source_name": "ttint_rat",
"url": "https://blog.netlab.360.com/ttint-an-iot-remote-control-trojan-spread-through-2-0-day-vulnerabilities/"
}
]
}Explicit source assertions (20)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--029a477b-fa90-4941-a577-1af6900d1b56
ATTACK:enterprise:M1041 → mitigates → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d891052-0c98-4d4a-8d1b-42a02f656eaf
ATTACK:enterprise:M1035 → mitigates → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f9283d3-3b13-47ca-9757-7a7739738356
ATTACK:enterprise:T1557.003 → subtechnique-of → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11f8631f-9475-4910-baa6-975eb776798a
ATTACK:enterprise:S0281 → uses → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--135df9c1-63cf-4323-a803-6d54a9ac8b22
objsee mac malware 2017 · CheckPoint DokATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e3c926e-4f21-40f0-b869-6b3c0e35e243
ATTACK:enterprise:T1557.002 → subtechnique-of → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--559d4b9f-55ed-4626-9be2-a64638d0bfc3
ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5cad7810-9bad-4d98-9668-fc9e3d1042b8
Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025ATTACK:enterprise:S9044 → uses → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63def7ec-93fd-4d42-b27d-d7147a937524
Artic Wolf Labs Kali365 Device Code April 2026 · Artic Wolf Kali365 Device Code OAuth June 2026 · SpyCloud Kali365 June 2026ATTACK:enterprise:T1557.001 → subtechnique-of → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66506cb1-20d5-4cb2-b301-e4a5d2868567
ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--719d58cc-72c9-44f9-9c4f-5a6d275eedfa
Sophos Evilginx MAR 2025 · Breakdev Evilginx 3.2 AUG 2023 · Breakdev Evilginx 3.0 May 2023 · Evilginx 2 July 2018ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7833393c-1a00-432b-beed-8225f754a5bd
ATTACK:enterprise:T1557.004 → subtechnique-of → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ad6900d-ac3a-4338-9c19-e280a8e67a8e
ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--81c1e9d6-f478-4adb-af70-cc92e8094e8a
CISA AA20-301A KimsukyATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--911ca56b-8fd3-4efc-855c-f1754c8b05b7
ATTACK:enterprise:C0046 → uses → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--991379fd-72b8-4861-86e2-ebfeadeb75bd
Cisco ArcaneDoor 2024ATTACK:enterprise:M1030 → mitigates → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a19d3dcf-29a2-4e3f-9138-55dc8ace1ee5
ATTACK:enterprise:S1131 → uses → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c758c10c-ea21-42ae-b0dc-979a4da74c51
Huntress NPPSPY 2022ATTACK:enterprise:S1188 → uses → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea7bd047-2997-425a-81ea-bac54af153c7
Cisco ArcaneDoor 2024ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5f42525-f682-400c-ac85-477a7063c4d9
Talos Sea Turtle 2019 · Talos Sea Turtle 2019_2