Skip to content

Archive Collected Data

Technique · ATTACK:enterprise:T1560

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1560",
  "title": "Archive Collected Data",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1560",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a",
  "external_id": "T1560",
  "domain": "enterprise",
  "created": "2020-02-20T20:53:45.725Z",
  "modified": "2026-05-12T15:12:00.633Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "DOJ GRU Indictment Jul 2018",
      "url": "https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"
    },
    {
      "source_name": "Wikipedia File Header Signatures",
      "url": "https://en.wikipedia.org/wiki/List_of_file_signatures"
    }
  ]
}

Explicit source assertions (61)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0082e86b-a7b7-496b-af03-88785b6c8fbb

US-CERT TA18-074A

ATTACK:enterprise:S0667 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02174a5c-9cda-4ddc-9952-1ff1b956d31e

ESET Gelsemium June 2021

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03b18e87-f5f2-4d12-b5b3-2e1ba131b091

TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0343 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1631a8e5-36e6-4468-9ed6-48df1138461c

ESET TeleBots Oct 2018

ATTACK:enterprise:S0586 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f066ba6-31e2-48d1-a7ac-27a20879287b

CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2202d670-a6f3-42eb-ae1b-1ae615c3b620

ATTACK:enterprise:S1101 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--255eb82c-19d3-43bd-a13c-e7c54413bfd6

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S0521 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2762485e-c8a2-4bbe-b3d8-8b20ca70197b

Trend Micro Black Basta October 2022 · GitHub Bloodhound

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a8f0313-4059-42b9-b487-6c8f860588c0

ESET Sednit Part 2

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e3dd466-e330-4d59-9c23-59f1f697d60d

CISA GRU29155 2024

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32fc949c-2127-425b-9480-6d07ead49982

Github PowerShell Empire

ATTACK:enterprise:T1560.002 → subtechnique-of → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b8633ab-4fa5-4310-bd0f-80964ecfae41

ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3df9c843-4833-45f9-a1ae-f7231d8410c4

Cybereason Bumblebee August 2022

ATTACK:enterprise:S0515 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--423b6f97-96c5-47f3-aa9f-f27bf5cd1ba0

CISA WellMail July 2020

ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43b6c74f-57ee-4cf8-acf8-97cbaa85db38

Hunt.io TeamPCP Toolkit MAY 2026

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ad19c3f-54c6-4bc6-a6fc-95ffb6fe75be

Picus BlackByte 2022

ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ef8c5fb-1c73-4847-9aa0-0d83eec44993

ESET_MuddyWater_Dec2025

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--552ac18c-4fac-4cb0-aefc-811a10e1c320

Novetta Blockbuster Loaders · Novetta Blockbuster RATs · McAfee Lazarus Resurfaces Feb 2018

ATTACK:enterprise:S0454 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59ad51ee-bc2e-4428-be3f-ddf50cf0deb9

Symantec Chafer Dec 2015

ATTACK:enterprise:S1140 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60fd7b53-b65a-49d3-ba1c-40beb74e8088

Google TAG COLDRIVER January 2024

ATTACK:enterprise:S0395 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6259ae94-15ac-4343-9eb9-7315160bf58a

ESET LightNeuron May 2019

ATTACK:enterprise:S1196 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--630e90a1-6600-4017-8fdc-c13222b59ee4

S2W Troll Stealer 2024

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63ee7d80-372e-4841-87a4-825cb5dd7058

DOJ GRU Indictment Jul 2018

ATTACK:enterprise:T1560.001 → subtechnique-of → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a1d7178-8bad-42cc-81dd-cd74d949cede

ATTACK:enterprise:S0257 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b2770ca-bf5d-4994-8a7e-868c906f385a

Unit 42 VERMIN Jan 2018

ATTACK:enterprise:S9036 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6eb19d8a-2a57-4089-9cd2-ae9023a1a337

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S0445 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70af600c-ca7a-4ea3-8c03-3a166e2d88a7

FOX-IT May 2016 Mofang

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7723037f-0b2e-447b-811a-d18a109570bb

ESET OceanLotus Mar 2019

ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7bbd6131-24cd-437e-8057-02f84b357cbe

trendmicro xcsset xcode project 2020

ATTACK:enterprise:S0249 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ee9b1ad-7f7b-4ae7-8cf4-8ab97b6a74b8

McAfee Gold Dragon

ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--823fc0fa-1648-40ed-87a3-eec3138eb3dd

Malwarebytes Konni Aug 2021

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88d26308-c00d-4394-8074-7d80d3deeea5

Sekoia Raccoon2 2022

ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a2be44e-6a93-479f-ade9-7d49a1eb692a

Red Canary NETWIRE January 2020

ATTACK:enterprise:S1012 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b16a324-45f2-4e90-8c30-39229b352fb7

Cybereason PowerLess February 2022

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9076865a-8215-4536-bb31-60ab7fa20af6

Kaspersky Turla · Kaspersky Turla Aug 2014

ATTACK:enterprise:S0487 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9433ea0e-0bae-44b6-b32b-5290356f057b

ESET ForSSHe December 2018

ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--960accee-d5ea-4570-8697-84ada0cc266a

Securelist Sofacy Feb 2018 · ESET Zebrocy Nov 2018 · CISA Zebrocy Oct 2020

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98229d5a-fce3-442e-91cf-7ec7b7994248

FireEye FIN6 April 2016

ATTACK:enterprise:S0010 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--982d9af7-45bb-4cc0-9819-aaadb3304783

Villeneuve 2011

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--985066fb-7fbb-4147-a69d-b33d45cd3e7f

KISA Operation Muzabi

ATTACK:enterprise:S1206 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--99e5781a-104c-49a7-b0b0-9f00b804f536

Cisco Salt Typhoon FEB 2025

ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e0cc38c-17a0-4320-b9b4-dc8458a9bb79

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e8e158e-31a9-406e-8b58-68ef645b0cc8

Bitdefender LuminousMoth July 2021

ATTACK:enterprise:S0093 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a1dc7c15-bd44-43b3-a32b-8e4ea9856758

Symantec Dragonfly

ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4361a93-3ce2-4c35-a5d8-9a4fae2dc822

Volexity InkySquid BLUELIGHT August 2021

ATTACK:enterprise:S0267 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab62293d-8f89-46b5-bab1-f7b564f5996f

FireEye FELIXROOT July 2018

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab7eb363-c775-4065-a80d-1b324f22d0b8

Mandiant Operation Ke3chang November 2014

ATTACK:enterprise:S0375 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b516dc1a-69c7-4dd2-935a-b0b1dcee150f

Securelist Remexi Jan 2019

ATTACK:enterprise:S0253 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b997d866-0aef-4ba6-a812-cfa2fccb05af

McAfee Gold Dragon

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c254bf89-3726-4c56-aae5-700c59427daf

ESET Machete July 2019

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c48ff628-9276-492f-a61c-73989785b292

Talos Agent Tesla Oct 2018

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d80207ae-0b3c-4f5f-ac89-9caa8c2c9beb

Securelist Dtrack

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d844fdcc-a0d1-46b4-a4dc-f56063ef9584

DOJ APT10 Dec 2018 · District Court of NY APT10 Indictment December 2018

ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--df6c39fa-9d95-45ee-911b-0ca2fc167086

Symantec Tick Apr 2016

ATTACK:enterprise:T1560.003 → subtechnique-of → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2980209-0a3b-4d12-8a85-1984b8e1844b

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e37d3456-b3a0-4502-b502-a505f383cb4c

CISA AA21-200A APT40 July 2021

ATTACK:enterprise:S0279 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e898c937-29b0-4e30-aeed-017ac3bbc3ed

objsee mac malware 2017

ATTACK:enterprise:S0517 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--efea6d26-7372-45bb-81bb-1e300abd5b13

Trustwave Pillowmint June 2020

ATTACK:enterprise:S0456 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fa77baa1-a258-4059-aa84-6822fe023d70

CheckPoint Naikon May 2020

ATTACK:enterprise:S0113 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fada6223-ba24-4c26-aa89-3998f07604f9

ESET Operation Groundbait

ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff9e8d81-dc74-4494-a4aa-54f8039f9ad7

BiZone Lizar May 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.