Protocol Tunneling
Technique · ATTACK:enterprise:T1572
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1572",
"title": "Protocol Tunneling",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1572",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--4fe28b27-b13c-453e-a386-c2ef362a573b",
"external_id": "T1572",
"domain": "enterprise",
"created": "2020-03-15T16:03:39.082Z",
"modified": "2026-09-03T19:46:46.553Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"command-and-control"
],
"source_references": [
{
"source_name": "Sygnia Abyss Locker 2025",
"url": "https://www.sygnia.co/blog/abyss-locker-ransomware-attack-analysis/"
},
{
"source_name": "University of Birmingham C2",
"url": "https://arxiv.org/pdf/1408.1136"
},
{
"source_name": "BleepingComp Godlua JUL19",
"url": "https://www.bleepingcomputer.com/news/security/new-godlua-malware-evades-traffic-monitoring-via-dns-over-https/"
},
{
"source_name": "SSH Tunneling",
"url": "https://www.ssh.com/ssh/tunneling"
}
]
}Explicit source assertions (46)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--002e561a-5500-4293-a876-01e8205a67c8
Crowdstrike TELCO BPO Campaign December 2022ATTACK:enterprise:S1189 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06eb54e8-74fb-4e63-b94e-c38dd6a57410
GitHub Neo-reGeorg 2019ATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0927eb00-4a08-4ed1-8678-84d6e1e87b98
ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0a42601e-8bee-4d4d-bce4-50e8e71307b3
AI-Mexico-Govt-BreachATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d357a8d-c053-44f0-8777-0e8f8f7bc9a8
Sygnia Elephant Beetle Jan 2022ATTACK:enterprise:C0032 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16ee3365-01c3-4ae3-a96c-dd1c5f05a93c
FireEye TRITON 2019ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17639fa3-3f77-4481-b24f-9df82fcbf324
ATTACK:enterprise:S1027 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19539764-3fe2-42c1-bf25-9e61c21469b4
SentinelOne Aoqin Dragon June 2022ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19bef554-d625-49f9-a521-c6a8ed773083
DFIR Phosphorus November 2021ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20c7d1a2-be94-4f58-83a9-7eb9e05c4449
FireEye FIN6 April 2016ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--28d1f706-c879-4916-8591-dcf475029362
Cisco Salt Typhoon FEB 2025ATTACK:enterprise:S1187 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3197ebd2-365b-4537-8627-600defd2044d
Fortinet reGeorg MAR 2019 · Mandiant APT29 Eye Spy Email Nov 22 · Cadet Blizzard emerges as novel threat actorATTACK:enterprise:S1141 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a8ff308-9a5d-4b59-8508-157a41323765
ESET Turla Lunar toolset May 2024ATTACK:enterprise:S0038 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--48f74ebb-3a7e-4b65-8e87-04d3bfe02914
Symantec W32.DuquATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c0cf71d-c000-46c5-a232-ea0e41a4b48a
BlackBerry_FIN7_April2024ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c637450-dd7b-4f6a-b59d-628d8258e0cd
CISA SPAWNCHIMERA RESURGE February 2026 · Google UNC5221 Ivanti January 2025 · Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024ATTACK:enterprise:S1044 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d7080b8-a3e0-4122-b0c9-c1d9c2ba6890
Bitdefender FunnyDream Campaign November 2020ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--50b91e01-e769-4164-a01e-57951e2e8348
CISA GRU29155 2024ATTACK:enterprise:S1020 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ee6a7c8-a9a5-4445-8173-408caab5bcbc
Kaspersky Lyceum October 2021ATTACK:enterprise:S9061 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--649e00df-7657-4134-a484-29b327975ed5
Mandiant_UNC1549_Feb2024ATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--69a744c7-a971-4e21-b305-335801c539d1
Dragos Crashoverride 2017ATTACK:enterprise:S1144 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ad38475-9375-4c8e-a15d-1a2f5ec6d4b7
FRP GitHubATTACK:enterprise:C0034 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6cde759a-8c53-4b6e-a110-09fd8ad3759f
Mandiant-Sandworm-Ukraine-2022ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8121e11c-6bd7-4b4a-8072-bb9622e6627c
Palo Alto Brute Ratel July 2022 · Trend Micro Black Basta October 2022ATTACK:enterprise:S9015 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--867a8718-5f12-42db-8fa7-667d51d868be
CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025 · CISA BRICKSTORM UNC5221 AR25-338A February 2026 · Picus Security BRICKSTORM UNC5221 October 2025 · Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024 · NVISO BRICKSTORM April 2025 · Resecurity UNC5221 BRICKSTORM F5 Big-IP October 2025 · Google BRICKSTORM September 2025ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b769a4e-8898-4995-adc1-4334dc0ec0f7
NCC Group Chimera January 2021ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8c8ac729-e986-4503-a1c8-5696e78f4bdc
Microsoft SharePoint Exploit JUL 2025ATTACK:enterprise:S1015 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93066a4a-0181-48cb-a2c3-3daa7ae5fefd
Kaspersky Lyceum October 2021ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9978b502-d1c2-4673-8df5-878f3184fe4e
Mandiant Cutting Edge Part 2 January 2024ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b4645fc7-ed61-46d8-a793-ce0e8e43b64a
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6c44630-d1d0-467c-a84d-83564a3a0639
FireEye APT34 July 2019 · FireEye APT34 Webinar Dec 2017 · Symantec Crambus OCT 2023 · Unit42 OilRig Playbook 2023ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6f52beb-1be0-4607-86a6-977d34fabe54
cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bdaf3340-0580-4e89-9cdc-e0af5a91ed85
CrowdStrike PIONEER KITTEN August 2020 · CISA AA20-259A Iran-Based Actor September 2020 · ClearSky Pay2Kitten December 2020ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c50f75fe-e7a9-4190-9ca8-a28187955669
Talos Cobalt Group July 2018 · PTSecurity Cobalt Dec 2016 · Group IB Cobalt Aug 2017ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8cae681-d480-4b85-ba37-d3d3265c98c2
Sygnia Emperor Dragonfly October 2022ATTACK:enterprise:S0508 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca56b2a6-39a7-4449-9017-fa8ce4285ed5
Trend Micro Ngrok September 2020 · Cyware Ngrok May 2019 · FireEye Maze May 2020 · MalwareBytes Ngrok February 2020ATTACK:enterprise:S0699 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d0228817-aba0-46c8-9449-de757f9238ac
Mythc DocumentationATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc6d99c1-b20e-448b-a6ed-7d5412bf24d3
Check Point VOID MANTICORE Handala Hack March 2026ATTACK:enterprise:C0004 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dfd947d6-60c1-4cb1-90ff-0111ccaddd1a
BlackBerry CostaRicto November 2020ATTACK:enterprise:S0173 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3b79cfa-6ea8-4e7a-85f8-9862702d466a
Mandiant FIN5 GrrCON Oct 2016ATTACK:enterprise:S9023 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e5345f9b-d673-417e-86f4-dd2f1b9b2047
Trend Micro Earth Kasha Updates APR 2025ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e67a8b60-ef9c-484b-91b4-0594a7b60eb2
Unit42 Chinese VSCode 06 September 2024ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9f04e42-2c14-406a-9ddf-ce93f91beab7
CrowdStrike Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea904c7f-f3a7-4e47-884f-bc13e38b09c6
Kaspersky QakBot September 2021ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f3b71f03-f6d5-4ae2-a8e8-a6263550e5a5
Trend Micro Cyclops Blink March 2022ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f71fa9f5-7a3c-43a7-8ca3-2e3c8996bde8
CISA AA21-200A APT40 July 2021