Skip to content

Archive via Utility

Subtechnique · ATTACK:enterprise:T1560.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1560.001",
  "title": "Archive via Utility",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1560/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--00f90846-cbd1-4fc5-9233-df5c2bf2a662",
  "external_id": "T1560.001",
  "domain": "enterprise",
  "created": "2020-02-20T21:01:25.428Z",
  "modified": "2026-05-12T15:12:00.619Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "WinRAR Homepage",
      "url": "https://www.rarlab.com/"
    },
    {
      "source_name": "WinZip Homepage",
      "url": "https://www.winzip.com/win/en/"
    },
    {
      "source_name": "7zip Homepage",
      "url": "https://www.7-zip.org/"
    },
    {
      "source_name": "diantz.exe_lolbas",
      "url": "https://lolbas-project.github.io/lolbas/Binaries/Diantz/"
    },
    {
      "source_name": "Wikipedia File Header Signatures",
      "url": "https://en.wikipedia.org/wiki/List_of_file_signatures"
    }
  ]
}

Explicit source assertions (91)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0538 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01202a82-56cc-4770-abf1-1a37c8717dba

ESET Crutch December 2020

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b582433-b5e6-49d7-886c-e1edd1a0a802

ESET Okrum July 2019

ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b7dfe49-d8c3-46d8-84ed-bf1898638ac3

Microsoft HAFNIUM March 2020 · Volexity Exchange Marauder March 2021

ATTACK:enterprise:S0160 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f5462cb-ac39-49d1-848e-aefaaab321e3

LOLBAS Certutil · TechNet Certutil

ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12ee5148-c274-4c94-a0da-69316cb329d2

Cybereason OperationCuckooBees May 2022

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17262c58-2f41-41d2-a86a-5bc86642ddb4

PWC Cloud Hopper Technical Annex April 2017 · PWC Cloud Hopper April 2017 · Symantec Cicada November 2020

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18437772-ace9-4a63-b928-8f313dc44f1e

Mandiant FIN12 Oct 2021

ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f48a517-c041-4845-9aba-2dce4f559b56

Symantec Elfin Mar 2019

ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20a447db-9606-4f4a-a0e8-57167ba4535e

Socket GlassWorm January 2026

ATTACK:enterprise:C0051 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--229d6377-d7a8-462c-8ead-c9fed3f08d10

Nearest Neighbor Volexity

ATTACK:enterprise:S1043 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27fe3870-1ce3-4f62-be7c-6da08d09643c

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28d9ac63-ce5f-4d42-be72-6b4d99b6fda7

CISA AA20-259A Iran-Based Actor September 2020

ATTACK:enterprise:G0052 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e82ef21-9fb2-421e-bd96-73599089b448

ClearSky Wilted Tulip July 2017

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d6d5bc0-2160-4152-9a4b-b2f19a8768b4

CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4082e0a3-e725-4f9f-98e2-3850c8cc8df2

ESET InvisiMole June 2018

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43c34939-8236-4ddd-8def-0eb7b5fe62cf

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--449b3473-a6cc-4934-8441-84325f70e126

Secureworks BRONZE PRESIDENT December 2019 · Avira Mustang Panda January 2020 · Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023 · Unit42 Chinese VSCode 06 September 2024

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48ff3270-ada9-4f02-b4f4-bfd6a3a3865f

CISA Play Ransomware Advisory December 2023 · Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49fb7af8-50cf-4af5-9195-40b2351fa6dc

Cycraft Chimera April 2020 · NCC Group Chimera January 2021

ATTACK:enterprise:S0062 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51300de6-0f80-45dc-92f7-f48dbc887d8c

Kaspersky MoleRATs April 2019

ATTACK:enterprise:G0084 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5677034a-7015-44a2-94b3-9913bc76b9c7

Symantec Gallmaker Oct 2018

ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57527643-2aef-4171-b61a-665ab8ed991b

Symantec Tick Apr 2016

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5808dec3-568e-41e4-8781-b1f6431965a2

ATTACK:enterprise:S1141 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58401f64-b536-4a3c-a1e4-2c0d2da8db19

ESET Turla Lunar toolset May 2024

ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5853e513-667f-4384-a803-e443889f8095

Hunt Sea Turtle 2024

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d4ba3fe-d782-47e4-ad82-0b81142a5e1a

FireEye APT39 Jan 2019

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--617ce344-2317-433a-b283-8e67b90b00f7

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6239c9a5-5ab9-425d-a767-0d4e6262a598

FoxIT Wocao December 2019

ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6559a4c7-ab95-45dc-ba38-0fb1b85aaa63

Trend Micro TeamPCP MAY 2026

ATTACK:enterprise:S1168 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66573033-3145-402f-96ac-9bc2e26cac1d

ESET OilRig Downloaders DEC 2023

ATTACK:enterprise:T1560.001 → subtechnique-of → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a1d7178-8bad-42cc-81dd-cd74d949cede

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d7ac1b0-acaa-4828-8863-9efda8f79589

trendmicro_redcurl

ATTACK:enterprise:S1246 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e2fbf1f-9e92-4307-aaac-6d90c0f563f5

Socket BeaverTail XORIndex HexEval Contagious Interview July 2025

ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--705fe2ec-dbe1-4811-baf5-798f5f874639

Mandiant Pulse Secure Update May 2021

ATTACK:enterprise:G1030 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--730b45b7-ec28-4402-933f-006e39ea2f60

Unit42 Agrius 2023

ATTACK:enterprise:S0196 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73faed96-608b-4740-894f-0e2eaee92343

Morphisec ShellTea June 2019

ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--756f3884-c21b-4d00-ac2c-6c2ab386072f

Eset Ramsay May 2020 · Antiy CERT Ramsay April 2020

ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7cad7951-1d39-4083-a394-37893df1fa3b

Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026 · Sysdig TeamPCP MAR 2026

ATTACK:enterprise:C0007 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82c1c2da-e9c3-4e75-b563-22f4c1988035

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:S0647 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--855a735f-756f-4911-a69b-454439a38037

ESET BackdoorDiplomacy Jun 2021

ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86246bef-ad4c-4c30-805a-d6f1928a7c20

Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89328749-11c5-416d-99b9-f3039afc487a

apt41_dcsocytec_dec2022 · FireEye APT41 Aug 2019

ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a45b5fc-2d41-445b-b478-fbf5d1bc3c30

CrowdStrike IceApple May 2022

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8cecace8-2820-4489-b3e8-baf4b9f33ff3

Symantec MuddyWater Dec 2018

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90bb9179-c20a-4223-a177-731f015052aa

Cybersecurity Advisory GRU Brute Force Campaign July 2021

ATTACK:enterprise:S0278 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90bd9900-a78f-47da-9504-393e8ece3fac

objsee mac malware 2017

ATTACK:enterprise:S0466 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9284f651-5078-4b67-90dd-841397029edd

objective-see windtail2 jan 2019

ATTACK:enterprise:C0026 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--929a1429-88a6-4ac8-b92e-39f242b1e0d6

Mandiant Suspected Turla Campaign February 2023

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--931c0864-0b91-46b7-bdc0-0360777d95a6

Symantec Waterbug Jun 2019

ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9448e565-a9ea-44c2-9c03-8f6112cd7d1d

ATTACK:enterprise:S0212 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--948d9203-f418-4cf6-9618-e1e89f1ef2bb

FireEye APT37 Feb 2018

ATTACK:enterprise:G0054 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--953134ab-5816-43b8-b2b1-8f4c9305f57a

Symantec Sowbug Nov 2017

ATTACK:enterprise:S0339 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--96d8b8bb-3bdc-481e-a554-41790acac66a

Radware Micropsia July 2018

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--973ed739-22d9-433f-ba63-f4881639a22d

McAfee Honeybee

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--99e9583f-433d-437d-bf37-7ea2b3f1b613

Secureworks BRONZE BUTLER Oct 2017 · Trend Micro Tick November 2019

ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9a8c6873-9807-4a83-99b0-16acd96ffde8

Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024

ATTACK:enterprise:S9052 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9f1f345a-043c-490f-8def-9b2bff370914

CheckPoint_NimbusManticore_May2026

ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9f7800b9-9152-4f4a-a7f7-ad5823b710c3

Google Cloud Mandiant UNC3886 2024 · Google Cloud Threat Intelligence ESXi VIBs 2022

ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9fdf1013-db2c-4aba-a723-e21ff9c18bee

Mandiant Cutting Edge Part 2 January 2024

ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4d59eb9-9390-4f3c-9659-0083a041c576

Fortinet Remcos Campaign NOV 2024

ATTACK:enterprise:S0340 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ae4c3306-57b7-46da-8073-9336cf96e5cf

ESET Nomadic Octopus 2018

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b005a049-ecf3-4378-bff6-983b16f92482

Talos Kimsuky Nov 2021 · Aryaka Kimsuky July 2025

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b028b9a6-4031-4b56-8dd5-0bdd3c59dbec

ATTACK:enterprise:S0264 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b05da4f4-a47f-42d9-8464-58c6960a767a

Unit 42 OopsIE! Feb 2018

ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b6e427c5-ae51-4240-b91e-3c417cc4e1f0

FireEye Know Your Enemy FIN8 Aug 2016

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bde913a9-9895-4414-b79a-3156159033aa

Mandiant Operation Ke3chang November 2014 · Microsoft NICKEL December 2021

ATTACK:enterprise:C0040 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb4fc7aa-3ee0-4259-a2c7-58cd6ceb4053

Google Cloud APT41 2024

ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc58b10e-0fb0-4ee3-95b6-ae2bbaedcdea

Cisco LotusBlossom 2025 · Symantec Bilbug 2022

ATTACK:enterprise:S0274 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cca64a18-4601-4169-9a8e-63036403940f

Securelist Calisto July 2018 · Symantec Calisto July 2018

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf401927-62cc-4b10-99c1-c48841054e1e

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d0a3d891-2555-45eb-8aaf-99b86372607b

TrendMicro EarthLusca 2022

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d1323d9f-fcaa-4f41-84c2-ce0cac5cc13b

Logpoint_StealerMalwareFamilies_2024 · Unit42_Vidar_July2026 · QuorumCyber_Vidar_March2023

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d1ee6feb-91cb-4cac-ae57-e71358af29c2

ATTACK:enterprise:S1040 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d263240f-c368-4796-96cc-f574f31fc2ae

ATTACK:enterprise:S1245 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d5d9878c-4255-452e-810e-65816dfa2685

ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024

ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d7d1b763-5430-463a-bd2c-eb14001e2c64

ESET MirrorFace DEC 2022 · JPCERT MirrorFace JUL 2024 · Trend Micro Earth Kasha NOV 2024

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8609889-3d3e-4f6c-8f52-03ec41876b4d

DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022 · FireEye APT35 2018

ATTACK:enterprise:S0441 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dd82b9d7-d60c-4dc0-97d7-244a1365a1e9

Kaspersky Cloud Atlas August 2019

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dfd24960-6b7e-4fab-bb84-2fc2ed4fc772

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e0d8b438-c7be-43b3-ba3f-9dd61c0e54cb

Crowdstrike HuntReport 2022 · CrowdStrike AQUATIC PANDA December 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.