Web Services
Subtechnique · ATTACK:enterprise:T1583.006
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1583.006",
"title": "Web Services",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1583/006",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--88d31120-5bc7-4ce3-a9c0-7cf147be8e54",
"external_id": "T1583.006",
"domain": "enterprise",
"created": "2020-10-01T00:50:29.936Z",
"modified": "2026-09-18T00:31:18.339Z",
"version": "1.3",
"aliases": [
],
"tactics": [
"resource-development"
],
"source_references": [
{
"source_name": "Hacker News GitHub Abuse 2024",
"url": "https://thehackernews.com/expert-insights/2024/05/github-abuse-flaw-shows-why-we-cant.html"
},
{
"source_name": "FireEye APT29",
"url": "https://services.google.com/fh/files/misc/rpt-apt29-hammertoss-stealthy-tactics-define-en.pdf"
},
{
"source_name": "ThreatConnect Infrastructure Dec 2020",
"url": "https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/"
}
]
}Explicit source assertions (36)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0167e4ad-b828-4813-88bf-f5b03b4d3268
TrendMicro EarthLusca 2022ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--079eaba3-fdea-4551-b126-6e824136e6f5
Microsoft HAFNIUM March 2020ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c98c9a9-a0e4-4f8f-b444-4ba7c3bd38a5
Sentinel One Contagious Interview ClickFix September 2025 · Sekoia ClickFake 2025 · Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025 · Socket Contagious Interview NPM April 2025 · Socket BeaverTail XORIndex HexEval Contagious Interview July 2025 · Socket HexEval BeaverTail Contagious Interview June 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13dac934-b216-4e70-8435-93c86cad9ccf
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1909eab3-597b-4f10-9652-d8a563fb57e1
2022 November_TrendMicro_Earth Preta_Toneshell_PubloadATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a51277b-0f14-4d8a-88cb-6616da7b4a98
ESET Crutch December 2020ATTACK:enterprise:G0128 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c44fd69-456d-43af-ae85-73239e295ff0
Google Election Threats October 2020 · Zscaler APT31 Covid-19 October 2020ATTACK:enterprise:G0025 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--41ca57db-9736-4adf-ac5d-ea2be2ab4860
FireEye APT17ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47987857-8c6b-40d2-a294-860b8a4dec58
ESET_MuddyWater_Dec2025 · Anomali Static Kitten February 2021 · Proofpoint TA450 Phishing March 2024 · Trend Micro Muddy Water March 2021ATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5065baaf-7a17-47b4-9880-73c834029e69
Aqua Security Blog Trivy Compromise APR 2026 · Aikido TeamPCP Telnyx MAR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz Mini Shai-Hulud MAY 2026 · Trend Micro TeamPCP MAY 2026ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--511e186f-2a71-4fb2-9a54-12fd80e2cd50
Google TAG Ukraine Threat Landscape March 2022ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--53a6a12f-04f2-445b-b733-8392ade1a7e5
FireEye APT29 · MSTIC NOBELIUM May 2021ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--540768f8-311c-4b43-8afa-d29a614ed27b
Check Point Blind Eagle MAR 2025 · Kaspersky BlindEagle AUG 2024 · Recorded Future TAG-144 AUG 2025 · Zscaler BlindEagle DEC 2025ATTACK:enterprise:C0046 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54396e12-d7af-4ecf-ba29-ab9798bcdef8
Cisco ArcaneDoor 2024ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b7a26f7-8580-429b-91c2-9cf10c88e29e
AI-Mexico-Govt-BreachATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d2b6dc4-4c57-41ef-bcf3-8cae67590e50
Microsoft Axios Compromise APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64f76b74-cafc-4cf5-9c86-f7305fbaf61c
Mandiant FIN7 Apr 2022ATTACK:enterprise:C0013 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7396416a-39cf-4a41-b04b-79172bd032b0
McAfee Sharpshooter December 2018ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7835c871-eb21-4790-ae9f-4d8af0436886
Check Point VOID MANTICORE Handala Hack March 2026 · SPECOPS Outpost24 Handala Hack Stryker March 2026 · Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78a7e89b-4560-4105-adfb-47393c39625b
ClearSky Lazarus Aug 2020ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e2b9c63-69ac-4050-b057-2fe16ef1d355
CISA AppleJeus Feb 2021ATTACK:enterprise:M1056 → mitigates → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--90a11110-2124-4d1f-92b7-1d5525e3ba8d
ATTACK:enterprise:G0142 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c070a22-d1cc-4565-918f-e0b85fe4bab3
TrendMicro Confucius APT Feb 2018ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f41dd16-b4c0-445d-b298-5a56621dfcf1
SymantecCarbonBlack_ShuckwormUSB_Apr2025ATTACK:enterprise:G0136 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a000579c-9149-4696-942f-e115d98eb96f
HackerNews IndigoZebra July 2021 · Checkpoint IndigoZebra July 2021ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2284f0a-630a-45a3-b823-919b3485fda3
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a83255d3-38a5-49a0-998d-ba4720e28678
CERT PolskaATTACK:enterprise:G1005 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ba747d29-53c9-4841-bbbe-93527c789e63
Microsoft POLONIUM June 2022ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c16c1ef2-2356-4987-bd9e-2cdaa007281a
Volexity Ocean Lotus November 2020ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ccc79ae5-de3c-4955-8179-2c4aa652613d
Talos Kimsuky Nov 2021 · Securonix Kimsuky February 2025ATTACK:enterprise:G1038 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d93afa70-d5ce-41f4-a6ff-f953e2de998a
Latrodectus APR 2024ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e0ef0f63-9418-4258-8f0a-f752e4b4b1a0
Proofpoint TA2541 February 2022ATTACK:enterprise:T1583.006 → subtechnique-of → ATTACK:enterprise:T1583
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e134a00e-8d72-4c3d-a5b1-3f9c6e1bd330
ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e6449c83-38cd-4af9-b3d9-a5fb939c9a52
CheckPoint_NimbusManticoreEurope_Sept2025 · CheckPoint_NimbusManticore_May2026 · Mandiant_UNC1549TTPsTools_Nov2025 · Mandiant_UNC1549_Feb2024ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f1caf188-3c6b-4b5c-82a5-38a37149f1b1
Check Point APT35 CharmPower January 2022ATTACK:enterprise:G0140 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff9932dc-6afa-4aa6-834b-4ff1ac6d96bb
MalwareBytes LazyScripter Feb 2021