Skip to content

Lateral Tool Transfer

Technique · ATTACK:enterprise:T1570

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1570",
  "title": "Lateral Tool Transfer",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1570",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--bf90d72c-c00b-45e3-b3aa-68560560d4c5",
  "external_id": "T1570",
  "domain": "enterprise",
  "created": "2020-03-11T21:01:00.959Z",
  "modified": "2026-09-03T19:46:52.112Z",
  "version": "1.4",
  "aliases": [

  ],
  "tactics": [
    "lateral-movement"
  ],
  "source_references": [
    {
      "source_name": "Dropbox Malware Sync",
      "url": "https://www.technologyreview.com/2013/08/21/83143/dropbox-and-similar-services-can-sync-malware/"
    },
    {
      "source_name": "Unit42 LockerGoga 2019",
      "url": "https://unit42.paloaltonetworks.com/born-this-way-origins-of-lockergoga/"
    }
  ]
}

Explicit source assertions (57)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--042c9210-4367-4dd5-8056-d4bd8d3ae92f

Broadcom Medusa Ransomware Medusa Group March 2025

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0694d72f-cf4b-4355-b485-ccbd8d3a22b2

Binary Defense Emotes Wi-Fi Spreader

ATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0788ef6e-c65f-481b-9d33-9ae7945bbc0e

Huntress INC Ransom Group August 2023

ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0bca4956-d4c5-4149-a493-c0596701dd9a

Microsoft BlackCat Jun 2022

ATTACK:enterprise:S1132 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d56fffa-b10e-4d5d-809b-7b2dc33b9939

SentinelOne Agrius 2021

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ecf4ac9-faad-4d2d-9a01-2618a7a54806

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G1007 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--287c3024-f58d-4fab-87a7-54d4b52f5a5c

SentinelOne Aoqin Dragon June 2022

ATTACK:enterprise:S0457 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2dd1c028-bebc-4631-b17b-3dd27a595c00

Sophos Netwalker May 2020

ATTACK:enterprise:S0190 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--338c0224-eb50-4027-925a-637ee765b187

Microsoft About BITS

ATTACK:enterprise:G0051 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33c8fb30-3515-4582-ad29-34fa0d7e15e5

FireEye FIN10 June 2017

ATTACK:enterprise:S0095 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--349bc11d-b377-410b-9232-2c5f0fbde031

Microsoft FTP · Linux FTP

ATTACK:enterprise:S0404 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b10d114-ce08-4c8f-b8c6-e2ed13e04912

LOLBAS Esentutl

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--405cbf25-6efb-4f58-90cf-609909be9a48

Cadet Blizzard emerges as novel threat actor

ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--427a272e-4500-4216-8816-a6c7d4492f3e

Unit 42 Lucifer June 2020

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4893fd0f-c256-4b74-a3d8-aef48794550a

Secureworks BRONZE SILHOUETTE May 2023

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48eca132-7473-451e-a4ec-b6658c0cb893

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f243ab6-812f-4fd3-9607-8d94409a94c1

CrowdStrike Grim Spider May 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56ad8893-2933-4b3b-a84d-026d9afb7dcb

ESET Turla PowerShell May 2019 · Symantec Waterbug Jun 2019

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--578433f2-d3d3-4434-8b6c-986c14204b92

Costa AvosLocker May 2022 · Cisco Talos Avos Jun 2022

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5bfce34b-83f6-429b-a1a6-cde8a7629054

CERT Polska · ESET DynoWiper Update JAN 2026 · ESET DynoWiper JAN 2026

ATTACK:enterprise:S1180 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61c4b285-ef0a-4cf6-ad8b-3599660211d4

Trustwave BlackByte 2021

ATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6485bfc6-53b5-43c1-9c52-6a35c3fc630d

Microsoft Preventing SMB

ATTACK:enterprise:C0025 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--698b7d6f-1198-4b8a-bc9c-8d0baa162b2b

Dragos Crashoverride 2018

ATTACK:enterprise:S0361 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6aa9250e-cbe8-4f47-9aef-bb178c2b6677

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6dc62107-cba2-4cf7-b788-3df0ef232966

Havoc Framework Documentation

ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f1f4c7b-dc86-44e3-9ff2-ea9451ea90ee

University of Birmingham C2

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--731fd895-2b35-4ac4-a16c-f85340543595

Cisco Talos Qilin Ransomware OCT 2025

ATTACK:enterprise:S9030 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73ad9e83-7e55-489d-ae44-deef090909b1

Check Point Wirte NOV 2024

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76eaadac-791f-41de-a105-9c29247c0b95

Picus BlackByte 2022

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--778297c2-55a2-4f80-8216-daa25bd148a9

NCC Group Chimera January 2021

ATTACK:enterprise:S0365 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e8101ce-f787-45f7-a593-62b664fbe08d

Talos Olympic Destroyer 2018

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--839d6bf7-6a63-48c0-8433-0d8d6c7ea61f

FoxIT Wocao December 2019

ATTACK:enterprise:C0034 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8746c331-10f7-4f7e-8fb9-8957ab3964bb

Mandiant-Sandworm-Ukraine-2022

ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89697f9e-cfd2-4273-a5d6-04354f0c3e7c

Microsoft GALLIUM December 2019

ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8ab5ee87-6fdf-447a-b622-0a68ed34e330

Palo Alto Shamoon Nov 2016

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9626a92f-a0f1-4bf1-9802-405bb6d46ccb

rapid7-email-bombing

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e0ca319-ad80-48f8-812e-fe7f9e0e77c4

DFIR Phosphorus November 2021

ATTACK:enterprise:G1032 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ecaf902-7633-4463-b5aa-3771a0ef08b7

Secureworks GOLD IONIC April 2024 · Huntress INC Ransom Group August 2023

ATTACK:enterprise:S0029 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9f5c68fe-a32e-405d-ae58-0965f04855cb

PsExec Russinovich

ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4283f85-04af-4174-85be-86ea6ed61cd1

Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023

ATTACK:enterprise:S0698 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8fb73d8-e4c0-4f3f-86e7-a13768fae22b

ESET Hermetic Wizard March 2022

ATTACK:enterprise:S0062 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad5f49b0-8b92-43d1-99f3-c691ccb7a8ac

ATTACK:enterprise:C0038 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--af2fe9ce-36bf-487c-bb71-7190aed28c55

CISA Iran Albanian Attacks September 2022

ATTACK:enterprise:S0357 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b58c89b5-cade-4622-b0bc-5d9a921afc60

Sygnia VelvetAnt 2024A

ATTACK:enterprise:S1217 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bf0531cd-410d-4b53-bd6d-61bb98dd5523

Google Cloud Threat Intelligence ESXi VIBs 2022

ATTACK:enterprise:S1218 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c29d57a2-ebda-40eb-9023-361e6a89610a

Google Cloud Threat Intelligence ESXi VIBs 2022

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c2d06b1b-823c-4f94-9b11-79892bca9f4e

Dragos Crashoverride 2018 · Mandiant-Sandworm-Ukraine-2022 · Microsoft Prestige ransomware October 2022

ATTACK:enterprise:C0028 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c39edafb-5a90-43a3-af9f-6865c5a6a71f

Booz Allen Hamilton

ATTACK:enterprise:S1017 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd9c7491-e0c8-4d98-8ac7-d7cccf77e98e

Palo Alto Unit 42 OutSteel SaintBot February 2022

ATTACK:enterprise:G1030 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cdcbf3ed-dff3-46e4-8d4a-a2197bd42392

CheckPoint Agrius 2023

ATTACK:enterprise:S0372 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d80bbf0c-2fb4-4272-a878-65662452d3ca

Unit42 LockerGoga 2019

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--da63f54a-e6a4-414b-9d54-404b0a63d2f6

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e7187197-205f-496f-b41c-34d57c52a997

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1598913-b99f-456a-84ae-17777091e2ef

Rostovcev APT41 2021

ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f725411c-c69a-47c5-b399-2bae53b4b559

Microsoft SharePoint Exploit JUL 2025

ATTACK:enterprise:S0106 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb866766-d3a5-46f6-9d0e-afc6bd1c7962

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fe78de3a-107f-4870-b5a1-c60289d68dec

LogRhythm WannaCry

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.