Skip to content

Asymmetric Cryptography

Subtechnique · ATTACK:enterprise:T1573.002

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1573.002",
  "title": "Asymmetric Cryptography",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1573/002",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--bf176076-b789-408e-8cba-7275e81c0ada",
  "external_id": "T1573.002",
  "domain": "enterprise",
  "created": "2020-03-16T15:48:33.882Z",
  "modified": "2026-09-11T19:44:43.501Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [
    {
      "source_name": "What is asymmetric encryption",
      "url": "https://www.ibm.com/think/topics/asymmetric-encryption"
    },
    {
      "source_name": "Symmetric vs Asymmetric Cryptography",
      "url": "https://www.keyfactor.com/blog/symmetric-vs-asymmetric-cryptography-whats-the-difference-and-when-to-use-each/"
    }
  ]
}

Explicit source assertions (102)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0615 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00192a5f-9dc0-445a-b010-d77bd08aac93

BlackBerry CostaRicto November 2020 · FireEye FiveHands April 2021 · CISA AR21-126A FIVEHANDS May 2021

ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--049eebb5-0686-4891-9cf7-cbf906cacdd8

Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0766fe91-a8d9-42bd-8023-f2134b280211

NCSC Cyclops Blink February 2022

ATTACK:enterprise:S1219 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08e8cbfd-7d63-41c0-8440-0be23dc9c6b9

Google Cloud Mandiant UNC3886 2024 · Mandiant Fortinet Zero Day

ATTACK:enterprise:S1123 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09d73bf3-4cf6-4822-9b0f-4d6dc33a2cc6

Mandiant Cutting Edge Part 3 February 2024

ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b51c002-4a22-413c-9d6d-ffd7fd625736

Cisco Operation Layover September 2021

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f8086c2-5432-455f-8012-201aed337725

FoxIT Wocao December 2019

ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--104334fa-4d32-48ab-a55d-c481ce7c4cd3

Medium Metamorfo Apr 2020

ATTACK:enterprise:S0018 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10c33088-630e-456d-ad0f-8a63be4d3946

ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1495ec37-a51f-4a50-8c01-427d7c4bb009

Zscaler Bazar September 2020

ATTACK:enterprise:S0668 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16d07e92-1026-4d2f-ad4d-a1cb664d1278

Talos TinyTurla September 2021

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ce64576-d10f-4ea6-b818-801436d8cc39

Google_SHOracle_Jun2026

ATTACK:enterprise:S1141 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20cef366-c091-415f-b53e-7dba033f324d

ESET Turla Lunar toolset May 2024

ATTACK:enterprise:S0627 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20eb2a85-e9f0-41cc-a26a-d66989c476f8

Securelist APT10 March 2021

ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--217ad0a6-f693-416e-9ae4-bcc0c533ce9f

ESET ComRAT May 2020 · CISA ComRAT Oct 2020

ATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26dcd489-5bd7-4f33-a920-79535c42082c

Kaspersky Sodin July 2019

ATTACK:enterprise:S0168 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2709cd56-6a75-487d-9b24-d931c053324a

ESET Gazer Aug 2017 · Securelist WhiteBear Aug 2017

ATTACK:enterprise:S0556 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27fb153f-0d50-4d95-b0e2-05bb520e33a7

Check Point Pay2Key November 2020

ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2843712c-cf5a-45f0-9e08-444665e0d479

IBM Grandoreiro April 2020

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d90749b-525e-4aa2-9df0-1d5677be0b25

ATTACK:enterprise:S9023 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2eae4409-f8ae-45dd-91f4-6d1d4e386178

Trend Micro Earth Kasha NOV 2024

ATTACK:enterprise:S0382 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35bfe5a4-84ca-4601-82d8-073b1e384115

Proofpoint TA505 Jan 2019

ATTACK:enterprise:S0699 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3843a4eb-cf3b-4cf9-91db-5a481ce3f32d

Mythc Documentation

ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f1ab899-077c-4f89-81ed-98683ac8753e

Group IB GrimAgent July 2021

ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44de534a-f105-4016-b7a4-2e7fce8a203e

ESET Attor Oct 2019

ATTACK:enterprise:S1224 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--461489b5-effd-4ed1-8cdd-e73268ea9969

Mandiant Fortinet Zero Day

ATTACK:enterprise:T1573.002 → subtechnique-of → ATTACK:enterprise:T1573

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4fcc0674-fe6d-4977-9259-1832282a3997

ATTACK:enterprise:S0600 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--521ca9cf-4ed0-4e24-a18a-b14252283d23

Intezer Doki July 20

ATTACK:enterprise:S1169 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--561e422a-ee84-4925-8c35-a36478abdead

ESET OilRig Campaigns Sep 2023

ATTACK:enterprise:S1203 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58470078-7abc-4c09-b304-e49cc515d412

Lumen J-Magic JAN 2025

ATTACK:enterprise:S9017 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59e256fe-638f-4b1f-81d0-3329b05a1443

Zscaler BlindEagle DEC 2025

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--67cb9148-b324-424f-9e16-de3a91e23e4a

Sygnia VelvetAnt 2024A

ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68c412d7-9b6e-4a0e-a29f-69c1d8065156

Kaspersky Dridex May 2017

ATTACK:enterprise:S0514 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--69d3a1fc-f72f-4fd9-aa89-c6a471791421

PWC WellMess July 2020 · PWC WellMess C2 August 2020 · CISA WellMess July 2020 · NCSC APT29 July 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a8356c2-5a79-40b7-bb8e-b7d9dffbe523

TrendMicro Tropic Trooper Mar 2018 · TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d146e81-301d-43ed-bd5a-90675caddd49

Fortinet Remcos Campaign NOV 2024

ATTACK:enterprise:S1035 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e83dba5-a1ea-4a65-bc14-541bd89955a7

DHS CISA AA22-055A MuddyWater February 2022

ATTACK:enterprise:C0039 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e9ed705-5f77-418b-b108-9320d1449272

Lumen Versa 2024

ATTACK:enterprise:S1121 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71b61f0c-3a56-456f-9e82-5252e243ae38

Mandiant Cutting Edge Part 3 February 2024

ATTACK:enterprise:S9015 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--732d6f62-11b7-412d-a458-33c0269d2933

CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025 · CISA BRICKSTORM UNC5221 AR25-338A February 2026 · Picus Security BRICKSTORM UNC5221 October 2025 · Resecurity UNC5221 BRICKSTORM F5 Big-IP October 2025

ATTACK:enterprise:S0335 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--732e753e-49c2-4af4-8b3b-c81e577d7a42

Accenture HyperStack October 2020

ATTACK:enterprise:S9019 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73e1f789-978f-4ab7-be88-137d89423215

Zscaler PureCrypter JUN 2022

ATTACK:enterprise:S0183 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74486fa3-a5b8-49b2-82b7-0c453b4baf12

Dingledine Tor The Second-Generation Onion Router

ATTACK:enterprise:S1144 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7728a470-8019-4120-b7a3-59bdcf5f472d

ATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7962fea5-a94d-4bb3-b951-fb8726bc4f67

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c593b6a-6426-4d8e-b98b-db02d1ec1025

GitHub Sliver Encryption · Cybereason Sliver Undated · Bishop Fox Sliver Framework August 2019 · Microsoft Sliver 2022 · Cybersecurity Advisory SVR TTP May 2021

ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f1a8581-a028-4c0e-8445-cb25295bbb3a

Splunk LAMEHUG SEP 2025

ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8707de5d-5fcf-4e1a-a794-27cc3c64e1bf

Aqua Security Trivy Compromise MAR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026 · Sysdig TeamPCP MAR 2026

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8880820c-e8c7-4dc5-9399-e9d619e38bfa

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:S1184 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88e6ab9b-6804-46be-8080-7e92bd076761

Google Cloud BOLDMOVE 2023

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8989ead1-c778-4645-8d95-2d42d875788b

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1163 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8eda3673-bd94-44cd-9275-a5836537f02a

PWC Sea Turtle 2023

ATTACK:enterprise:S0342 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f56f7af-962a-4d2f-89db-7c1d89b79a32

ESET GreyEnergy Oct 2018

ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--922d5db0-2588-46d9-9a91-e5d4ccc3c84c

Gigamon BADHATCH Jul 2019

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--92dc3823-559b-422a-b801-4669d53f0135

Prevailion DarkWatchman 2021

ATTACK:enterprise:S1105 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--94bd660a-4e4c-4482-8062-2469075e3974

NCSC-NL COATHANGER Feb 2024

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95faa9d3-5d41-4f2e-8383-93b72ab43b45

CISA Medusa Group Medusa Ransomware March 2025

ATTACK:enterprise:G1042 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--961a3c3d-fe0d-46f8-919e-e344d3479199

RecordedFuture RedEcho 2021

ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--96bf1608-d1fc-477f-be54-0dba2efd0038

Secureworks Karagany July 2019

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--99686b3a-1ca4-4b36-ad4d-a8876d8c65ba

FireEye APT34 Webinar Dec 2017

ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ce465d9-921b-4d6d-8863-b1ffc63f0e8e

Leonardo Turla Penquin May 2020

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2ed58c0-7bd3-4a94-99b3-f2ff94dea408

Cylance Machete Mar 2017

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3aa78fe-28c9-44e8-a0a3-0f84c087b5e0

Talos Cobalt Strike September 2020

ATTACK:enterprise:S0180 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a49ed7b1-8160-48ae-a65f-feeb4747c522

US-CERT Volgmer Nov 2017

ATTACK:enterprise:S0087 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5d7526f-2b1f-4a69-abc7-926b22bc402b

ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a601c8b3-4d54-42d9-a2fd-61455a5dff4a

ATTACK:enterprise:S0491 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a624f944-5f3e-4713-9e89-9964ae82c677

Talos Promethium June 2020

ATTACK:enterprise:S0448 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aee478b7-c5f5-4d31-8df7-bd44fca1d677

Bleeping Computer Op Sharpshooter March 2019

ATTACK:enterprise:S0150 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b380ad90-2f3b-4f98-ae23-3dfdba448e0a

FireEye POSHSPY April 2017

ATTACK:enterprise:S0117 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b3973baa-0185-45a1-934d-2b29f742a2df

Invincea XTunnel · ESET Sednit Part 2

ATTACK:enterprise:C0043 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b5943a06-bad2-4ffe-b086-d4f948148947

RecordedFuture RedEcho 2021

ATTACK:enterprise:S1210 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b5e74642-26b7-4e11-a7dc-706cf543ea69

Symantec Bilbug 2022

ATTACK:enterprise:C0021 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba18c3d0-049b-40c0-b65f-fe0463b3a9d6

FireEye APT29 Nov 2018

ATTACK:enterprise:S1051 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba9380c1-1d2e-4161-8c46-9fc9f793cbd3

ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--baeff271-0885-4c44-a9d6-c03411ca9bb0

FireEye MuddyWater Mar 2018

ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bcb137f0-e92d-47b5-912f-ba8d4f9ff15c

ESET Zebrocy Nov 2018 · ESET Zebrocy May 2019 · CISA Zebrocy Oct 2020

ATTACK:enterprise:M1020 → mitigates → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bfb8c372-82f0-4bdb-8083-5fae8b8ef185

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c2fce712-7e7e-428b-a17e-bd46a3f24f68

Cyfirma_Vidar_June2024

ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c46db015-9917-4c7b-8152-c6ad1394baf7

Talos PoetRAT April 2020

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cfb7e335-e7a3-4dc3-91b8-70381a888222

Group IB Cobalt Aug 2017

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.