Skip to content

Upload Malware

Subtechnique · ATTACK:enterprise:T1608.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1608.001",
  "title": "Upload Malware",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1608/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--3ee16395-03f0-4690-a32e-69ce9ada0f9e",
  "external_id": "T1608.001",
  "domain": "enterprise",
  "created": "2021-03-17T20:09:13.222Z",
  "modified": "2026-05-12T15:12:00.628Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "resource-development"
  ],
  "source_references": [
    {
      "source_name": "Datadog Security Labs Malicious PyPi Packages 2024",
      "url": "https://securitylabs.datadoghq.com/articles/malicious-pypi-package-targeting-highly-specific-macos-machines/"
    },
    {
      "source_name": "Volexity Ocean Lotus November 2020",
      "url": "https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/"
    },
    {
      "source_name": "Bleeping Computer Binance Smart Chain 2023",
      "url": "https://www.bleepingcomputer.com/news/security/hackers-use-binance-smart-chain-contracts-to-store-malicious-scripts/"
    },
    {
      "source_name": "Talos IPFS 2022",
      "url": "https://blog.talosintelligence.com/ipfs-abuse/"
    },
    {
      "source_name": "Guardio Etherhiding 2023",
      "url": "https://labs.guard.io/etherhiding-hiding-web2-malicious-code-in-web3-smart-contracts-65ea78efad16"
    }
  ]
}

Explicit source assertions (41)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--018ed869-7916-41c3-b60b-818bac4e6ce5

mandiant_apt44_unearthing_sandworm

ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03b02b8a-4f47-46ef-bdda-096c214ffcda

Proofpoint TA2541 February 2022 · Cisco Operation Layover September 2021

ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--061c7b3d-775a-403f-9fd6-af0962a2e25e

McAfee Lazarus Nov 2020 · ESET Lazarus Jun 2020 · McAfee Lazarus Jul 2020 · ClearSky Lazarus Aug 2020

ATTACK:enterprise:C0002 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a49a3af-973d-43ea-b4d4-8cc21c12dfc0

McAfee Night Dragon

ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e837480-f359-4bdc-875a-d953027d17b0

TrendMicro EarthLusca 2022

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--165b8698-8d09-4602-9385-c5002c3eb46e

Proofpoint TA416 Europe March 2022

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18ba352d-274c-4cb5-8916-d95035a2423c

Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G0090 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18e50c94-a566-4ef1-8660-c7e3cb561c90

Palo Alto Ashen Lepus DEC 2025

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1997b1ee-3028-4871-8f78-b55a840e5809

MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:C0011 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a28bcb2-fbac-4bc3-a42c-a254b3e9643e

Cisco Talos Transparent Tribe Education Campaign July 2022

ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f3caa29-45d7-4ae7-b407-c5a4cccb3998

Recorded Future RedDelta 2025

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ff37097-9ec1-42cd-bdd6-52d74ab8e3b5

Talos Kimsuky Nov 2021 · Securonix Kimsuky February 2025 · Mandiant APT43 March 2024

ATTACK:enterprise:G1020 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27d95bad-b939-43eb-a683-c3c3367cf728

SentinelOne SocGholish Infrastructure November 2022

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f19d354-898b-4c42-b3f2-dd45e52423dc

ClearSky OilRig Jan 2017

ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34f9ecb9-69ac-46a1-9d02-6d5bb0d746b9

CheckPoint_NimbusManticoreEurope_Sept2025 · CheckPoint_NimbusManticore_May2026 · Mandiant_UNC1549TTPsTools_Nov2025 · Mandiant_UNC1549_Feb2024

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35ca3779-c632-4a7e-a931-7472128fb10d

Lacework TeamTNT May 2021

ATTACK:enterprise:C0005 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3de46cc5-5049-4105-8fcc-ede3f51f30c5

ESET Operation Spalax Jan 2021

ATTACK:enterprise:G0140 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--424ae88f-7405-4cab-9065-4d1e024a25c8

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4973197d-b2b7-4da2-ad4f-245beca0b389

Microsoft Actinium February 2022 · Unit 42 Gamaredon February 2022

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--52f444aa-ef68-4c26-b0a4-3dbc568eae63

Google TAG COLDRIVER January 2024

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5beed1ca-321a-47b7-a16c-02905ad96364

Trend Micro DRBControl February 2020

ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c5d1d00-1a0a-4315-9da4-2beb5f00793b

MalwareBytes SideCopy Dec 2021

ATTACK:enterprise:C0010 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--634a14f9-e252-4f5e-851a-de8187de074e

Mandiant UNC3890 Aug 2022

ATTACK:enterprise:C0013 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68f0beb9-ce3e-44ae-af4d-516c22aa3cf4

McAfee Sharpshooter December 2018

ATTACK:enterprise:M1056 → mitigates → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--747e4a60-7460-4990-a8ce-d0c1af807dd7

ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75a91f69-93bc-40fd-a17c-ae675637c296

Korean FSI TA505 2020

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--828a7a9c-4ee2-4e63-80ae-e127a22f8b7d

Microsoft BlackByte 2023

ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85c85045-a030-435c-a353-6d89a1feacc0

Forcepoint BITTER Pakistan Oct 2016

ATTACK:enterprise:C0021 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--895ab8e5-8f5f-420f-b283-61ee0d7ac37a

FireEye APT29 Nov 2018 · Microsoft Unidentified Dec 2018

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ed7e90a-8034-48eb-8444-9ec29941a7b8

Volexity Ocean Lotus November 2020

ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3e07b45-b35d-4d02-a266-34366a57f557

ClearSky Siamesekitten August 2021

ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a40c6b38-6a1f-44fa-8f86-c38dcd03fc90

Palo Alto Unit 42 OutSteel SaintBot February 2022

ATTACK:enterprise:S9008 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b27d69e9-d7e0-4d06-88e4-942b42987028

Aikido Shai-Hulud September 2025 · Netskope Shai-Hulud November 2025 · Wiz Shai-Hulud September 2025 · Socket Shai-Hulud Trufflehog September 2025

ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c0aedaa7-158f-4f97-a49b-9e6420365f8a

Microsoft Moonstone Sleet 2024

ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c5ffbfc0-fd5d-409a-bc0c-e14a75d2c382

Sentinel One Contagious Interview ClickFix September 2025 · Validin Contagious Interview North Korea ClickFix January 2025 · Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024 · Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025 · Socket Contagious Interview NPM April 2025 · Socket BeaverTail XORIndex HexEval Contagious Interview July 2025 · Socket HexEval BeaverTail Contagious Interview June 2025 · ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · SecurityScorecard Contagious Interview October 2024 · Securonix Contagious Interview DEVPOPPER April 2024 · Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024 · PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023

ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6822435-d621-415c-8cb9-42473760fc33

Kaspersky BlindEagle AUG 2024 · LevelBlue Blind Eagle Proton66 JUN 2025

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d9a18216-bb4f-445a-92a9-abd99ba0609a

Mandiant FIN7 Apr 2022 · Cocomazzi FIN7 Reboot

ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db393f5e-8029-423c-bfbc-da48fc932cb0

Google EXOTIC LILY March 2022

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e601b4ad-f260-49a9-9642-4ed7c66e91b9

Mandiant APT42-charms

ATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e7d67335-ceea-4300-ab7c-af493013bbb0

Aqua Security Trivy Compromise MAR 2026

ATTACK:enterprise:T1608.001 → subtechnique-of → ATTACK:enterprise:T1608

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed3de8e8-e09c-4273-8f68-da5219a7e9ee

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.