Skip to content

Delay Execution

Technique · ATTACK:enterprise:T1678

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1678",
  "title": "Delay Execution",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1678",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--a1df809c-7d0e-459f-8fe5-25474bab770b",
  "external_id": "T1678",
  "domain": "enterprise",
  "created": "2025-09-24T18:03:15.021Z",
  "modified": "2026-09-11T19:52:38.458Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "Joe Sec Nymaim",
      "url": "https://www.joesecurity.org/blog/3660886847485093803"
    },
    {
      "source_name": "Joe Sec Trickbot",
      "url": "https://www.joesecurity.org/blog/498839998833561473"
    },
    {
      "source_name": "Revil Independence Day",
      "url": "https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/"
    },
    {
      "source_name": "Netskope Nitol",
      "url": "https://www.netskope.com/blog/nitol-botnet-makes-resurgence-evasive-sandbox-analysis-technique"
    }
  ]
}

Explicit source assertions (25)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01354b67-5cc4-4701-9dbf-e750076c5d5d

Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--016d4e5d-6b8c-45cc-a50b-a79f0a68ddaf

Gen Digital Kimsuky HTTPTroy October 2025 · Aryaka Kimsuky July 2025

ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--105235ae-d06d-47ed-8eea-8237bd1d7397

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15fed5d5-3e2b-43c6-808d-5198af11f1e6

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21a662a2-7eb9-4cc3-b2d1-984239f8c9a1

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026 · TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21f43802-8abd-459f-83e3-d9fd3fdd5bfa

CISA SPAWNCHIMERA RESURGE February 2026

ATTACK:enterprise:S9008 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24ccb55f-1e6a-48be-a222-aa0faf1272c3

Palo Alto Unit 42 Shai-Hulud November 2025

ATTACK:enterprise:S9063 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--253ab349-abb6-48de-8679-c7a9a702c58a

Mandiant_UNC1549_Nov2025

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28c7f7cf-1490-4f78-9d5b-a26fd86198a1

MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3426458d-9dcc-48b3-8bfc-24cf82377656

Eset PlugX Korplug Mustang Panda March 2022 · Sophos PlugX September 2022

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e6dde99-59d7-4ebe-81cc-db84596ec7a2

Logpoint_StealerMalwareFamilies_2024

ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f715d2b-8353-408f-9e2b-d68bbd8b50f0

Mandiant_UNC1549TTPsTools_Nov2025

ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--416a4073-3236-461c-ab0f-6c1e50d0a9f9

Koi Glassworm New Tricks December 2025

ATTACK:enterprise:S9014 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b6f9849-261f-4b4a-9455-d526da22fb8e

Google UNC5221 Ivanti January 2025

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--681e2011-de1d-45ab-8168-329a3095338f

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--69e9e6bb-df32-4261-a8fc-4b81fca67990

Unit42 3cx supply chain 2023

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95c85b70-64f6-410f-82fd-c9dc1c154a4f

SophosGnGal_SystemBC_Dec2020

ATTACK:enterprise:S1230 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a23252dd-d807-4247-b9c7-539e6f30c2ec

2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024

ATTACK:enterprise:S9015 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac12a059-4777-4f73-933d-832605de696e

Picus Security BRICKSTORM UNC5221 October 2025 · NVISO BRICKSTORM April 2025 · Google BRICKSTORM September 2025

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba59907a-1a0c-4150-93a6-53581bffd08d

Trend Micro Agenda Ransomware OCT 2025

ATTACK:enterprise:S9033 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cbb83538-3a5b-4dcc-a2df-b960dde3d36e

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S9038 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dd737a22-2390-4ffd-9ab7-4c9574fedfd7

CERT Polska · ESET DynoWiper Update JAN 2026

ATTACK:enterprise:S0275 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed3cec58-c1b7-4222-9b0d-609793f86d1e

Trend Micro Earth Kasha Anel NOV 2024 · Trend Micro Earth Kasha Updates APR 2025

ATTACK:enterprise:S9019 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f5039faf-3fa9-4d37-8dae-db7a081ecf56

Zscaler PureCrypter JUN 2022

ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fdf235f6-3ecc-4b78-bc6b-90dc0e922efd

Palo Alto Ashen Lepus DEC 2025

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.