Skip to content

Local Storage Discovery

Technique · ATTACK:enterprise:T1680

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1680",
  "title": "Local Storage Discovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1680",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--f2514ae4-4e9b-4f26-a5ba-c4ae85fe93c3",
  "external_id": "T1680",
  "domain": "enterprise",
  "created": "2025-09-25T21:09:38.677Z",
  "modified": "2026-05-12T15:12:00.724Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "Volexity",
      "url": "https://www.volexity.com/blog/2023/06/28/charming-kitten-updates-powerstar-with-an-interplanetary-twist/"
    },
    {
      "source_name": "AWS docs describe volumes",
      "url": "https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html"
    },
    {
      "source_name": "azure az disk",
      "url": "https://learn.microsoft.com/en-us/cli/azure/disk?view=azure-cli-latest"
    },
    {
      "source_name": "GCP gcloud compute disks list",
      "url": "https://cloud.google.com/sdk/gcloud/reference/compute/disks/list"
    },
    {
      "source_name": "TrendMicro ESXI Ransomware",
      "url": "https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html"
    },
    {
      "source_name": "Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024",
      "url": "https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"
    },
    {
      "source_name": "TrendMicro",
      "url": "https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html"
    }
  ]
}

Explicit source assertions (103)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01183e54-1494-4fad-ab62-60834746cc32

ATT TeamTNT Chimaera September 2020 · Cisco Talos Intelligence Group

ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0160f1e4-76bd-4490-af74-bb80072cecae

CISA MAR SLOTHFULMEDIA October 2020

ATTACK:enterprise:S1151 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--029f82d6-72d9-43ac-a480-ae5169d20135

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1049 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02b6b3cc-ec40-410f-90e9-03c534dc1c12

Palo Alto MoonWind March 2017

ATTACK:enterprise:S0625 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--059a2b6f-2b77-4f71-acd4-a3c39c4c2da4

McAfee Cuba April 2021

ATTACK:enterprise:S0253 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--082a573f-d760-4bd8-a830-8c5a57b4ea44

McAfee Gold Dragon

ATTACK:enterprise:S0678 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b6312e1-2601-4bb3-ba21-ee1c488b3506

McAfee Lazarus Nov 2020

ATTACK:enterprise:S0248 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0da384db-9a5b-4256-81b4-19df05a4ceb8

ASERT Donot March 2018

ATTACK:enterprise:S1048 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f0b7154-b0d2-4aa1-b819-7d4e3dfe3bd1

SentinelLabs reversing run-only applescripts 2021

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--118cdbd1-12e5-4ac2-85a3-c574e7cfad91

ATTACK:enterprise:S0564 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11917102-46c9-4c12-964c-065ad6b2a14f

Microsoft GALLIUM December 2019

ATTACK:enterprise:S0472 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14de629c-9b49-4841-901a-85fab61f693b

Trend Micro Tick November 2019

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19dccc7d-03eb-45a4-88c1-1ed4ddcee7a3

Lunghi Iron Tiger Linux · Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0630 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22a699a2-ad75-470e-87c9-9ec8f9763e8e

Bitdefender Naikon April 2021

ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22b9eb17-686a-4cfe-b9a1-cffe22c7755f

Trend Micro KillDisk 1

ATTACK:enterprise:S1168 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b1b3740-cbf5-47cb-8a91-1b2c9a683342

ESET OilRig Downloaders DEC 2023

ATTACK:enterprise:S0351 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f59d9ec-a48d-4565-a8da-1377e06dfb3f

Unit42 Cannon Nov 2018 · Unit42 Sofacy Dec 2018

ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30437ed1-5cad-4656-9ae8-c4a06122b613

Eset PlugX Korplug Mustang Panda March 2022

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--350b8d90-f1ab-4bdf-a47e-8413751ed56c

Ensilo Darkgate 2018

ATTACK:enterprise:S0267 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3511b2ef-7012-4a7f-8b38-d6b7ba508b59

ESET GreyEnergy Oct 2018 · FireEye FELIXROOT July 2018

ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39ef8d48-fb74-412a-8c6d-b889e3fca644

Joint Cybersecurity Advisory LockBit 3.0 MAR 2023

ATTACK:enterprise:S1026 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a8eb909-108e-4d4c-b893-d76b585caa9b

SentinelOne Aoqin Dragon June 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c8805ff-7345-4763-9757-6a30acfe652c

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43ab17df-742f-4bc5-815a-7da2feed73f0

Telefonica Snip3 December 2021

ATTACK:enterprise:S0137 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44150544-030d-430c-bec8-6fb4373d484e

ATTACK:enterprise:S1147 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4c06f698-1d15-4758-a38f-d3476ac65fa8

ESET EvasivePanda 2024

ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4dfa38d4-a6e6-4fab-bff8-23cab8ffa9cd

ATTACKIQ MUSTANG PANDA TONESHELL March 2023

ATTACK:enterprise:S0667 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e204be0-a2f2-47e8-9b43-84cc2736784a

ESET Gelsemium June 2021

ATTACK:enterprise:S9038 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--501b58a3-5315-4415-8e4a-b2ee65db5013

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--514a384a-2b09-4b4f-9def-8e4007b49734

CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023 · Microsoft Volt Typhoon May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023

ATTACK:enterprise:S0208 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5bdc87b7-a975-4fd8-a4e3-131f769600f3

Symantec Pasam May 2012

ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68be315f-f84b-4790-892b-e284089658a8

Security Scorecard Medusa Ransomware January 2024

ATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68f0f623-b5f2-47a8-8206-eabfb472d7aa

Cybereason INC Ransomware November 2023

ATTACK:enterprise:S1027 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--69262212-bb89-43fc-8a80-ba492766e372

SentinelOne Aoqin Dragon June 2022

ATTACK:enterprise:S0238 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7224a7bb-225c-484a-9481-d3a0cb328b32

McAfee GhostSecret

ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77534dcc-4183-41b5-adbd-cc7e8ccaa3ec

Leonardo Turla Penquin May 2020

ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b30e00a-71c6-4ad8-b2a8-39f000156930

Medium KONNI Jan 2020 · Talos Konni May 2017 · Malwarebytes Konni Aug 2021

ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--800060e1-5bd0-475a-93d0-e0abc36e10d7

Microsoft BlackCat Jun 2022

ATTACK:enterprise:G0142 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8135fc16-4dda-4afb-bc35-d24c370b0c53

TrendMicro Confucius APT Aug 2021

ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81a857bb-4c36-4875-a62e-30e7b12eae12

Antiy CERT Ramsay April 2020 · Eset Ramsay May 2020

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83b9dc24-fc85-40dd-ad6e-f8eeededc53f

Palo Alto Lockbit 2.0 JUN 2022 · FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85e94a33-82be-46f4-b6e5-766f5f5e5a56

Halcyon Qilin.B OCT 2024

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88ae2900-c8c5-4943-8baa-7a8ba96dcef5

Kaspersky ToddyCat June 2022 · Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8cef7b12-80af-4bb1-bf72-8eccd835d423

Cyble Black Basta May 2022 · Minerva Labs Black Basta May 2022

ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--912fc001-4c47-42fb-a2c0-7abed4e620b1

Accenture SNAKEMACKEREL Nov 2018 · CISA Zebrocy Oct 2020 · ESET Zebrocy May 2019 · ESET Zebrocy Nov 2018 · Unit42 Cannon Nov 2018 · Unit42 Sofacy Dec 2018 · Palo Alto Sofacy 06-2018

ATTACK:enterprise:S1085 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--937b70c1-3024-4a39-95b0-5f76b8671a66

Bitdefender Sardonic Aug 2021

ATTACK:enterprise:S0376 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--937f8691-2941-4365-9a82-889d3b67a641

US-CERT HOPLIGHT Apr 2019

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--937febf9-bb30-4fcf-a208-e599693d4588

ESET InvisiMole June 2018 · ESET InvisiMole June 2020

ATTACK:enterprise:S0617 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98c69e3a-1fc1-4da2-adc5-a33723ab1be4

FireEye FiveHands April 2021

ATTACK:enterprise:S0446 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9cf32fea-16cd-41cf-93f3-a47c1388abbc

CrowdStrike Ryuk January 2019

ATTACK:enterprise:S0271 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e3f33db-5076-403b-b71e-71d898389e0b

US-CERT KEYMARBLE Aug 2018

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a1cb6aec-0f1c-491e-9648-b668014e3aee

TrendMicro TropicTrooper 2015 · TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:S0516 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a220cf94-7165-44ed-85da-014bc684e680

CISA SoreFang July 2016

ATTACK:enterprise:S1150 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2fbefb3-bbb7-4c98-8ef1-8440f4ee3bd6

Mandiant ROADSWEEP August 2022 · Microsoft Albanian Government Attacks September 2022

ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a38cfd4a-0ba2-49ae-98e9-df6c1f954148

Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024

ATTACK:enterprise:S1060 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a38fd59c-489b-4d3a-b3be-54fe89244c71

SentinelLabs Metador Sept 2022 · SentinelLabs Metador Technical Appendix Sept 2022

ATTACK:enterprise:S9052 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5f8752d-2df3-45b2-ab03-9e9261971bc6

CheckPoint_NimbusManticore_May2026

ATTACK:enterprise:S0491 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6b41bba-0b47-400d-9aa4-134b4f47994f

Talos Promethium June 2020

ATTACK:enterprise:S0471 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6c20b07-57ea-46dd-aa71-93849b6b66ca

Trend Micro Tick November 2019

ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a77ba502-576a-47cc-8718-c3f3dcc41b1e

Qualys Hermetic Wiper March 2022 · ESET Hermetic Wizard March 2022 · SentinelOne Hermetic Wiper February 2022 · Crowdstrike DriveSlayer February 2022

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--afa8a693-6e2f-40e8-a78d-2710e9683e4e

Novetta Blockbuster Destructive Malware · Novetta Blockbuster Loaders · Novetta Blockbuster · Lazarus APT January 2022 · McAfee Lazarus Resurfaces Feb 2018 · McAfee GhostSecret

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b16660dc-0675-462a-85fc-1902a751639e

Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:S1075 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b3bc70ea-4f9e-4933-81e7-eb8b19f89a3b

Mandiant Suspected Turla Campaign February 2023

ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b42354ae-384d-4885-96a0-1594ed6dd427

CheckPoint Bandook Nov 2020

ATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b4d35a40-e89f-453f-aeab-5e44dacbc1f8

Secureworks REvil September 2019 · Cylance Sodinokibi July 2019 · Group IB Ransomware May 2020 · Intel 471 REvil March 2020 · Kaspersky Sodin July 2019 · McAfee Sodinokibi October 2019 · Secureworks GandCrab and REvil September 2019

ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b5a1d3dd-89ea-442a-8695-1aea2cbccafa

Cisco Ukraine Wipers January 2022

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b64b605f-2677-47c3-ae4b-0b3db3573eae

Malwarebytes Higaisa 2020 · PTSecurity Higaisa 2020

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bdbd15f2-3c02-4f3a-b824-60f7f815c9c3

Cymmetria Patchwork · TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0672 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be4909b2-ff92-4dca-b835-09df2b10adb2

ATTACK:enterprise:S0353 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bea2bee1-a80c-40a0-9552-e9f49d4fe33b

Unit 42 NOKKI Sept 2018

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c08ad736-dcd5-465c-92b6-54213ab69614

GitHub SILENTTRINITY Modules July 2019

ATTACK:enterprise:S1089 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1004711-9899-4757-8338-428fe33c3411

MoustachedBouncer ESET August 2023

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c3556085-d0ed-41dc-9ed4-a0a0c65ee104

NCC Group Chimera January 2021

ATTACK:enterprise:S0488 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c42d1cc1-3685-4bd7-96ba-84a66cc6a287

CME Github September 2018

ATTACK:enterprise:S0259 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4dd3873-c9e7-4453-9acb-aeb868eef874

ASERT InnaputRAT April 2018

ATTACK:enterprise:S0520 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c80db47b-f1d6-4f62-aea0-d87edb778f5e

US-CERT BLINDINGCAN Aug 2020

ATTACK:enterprise:S0340 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8a336f0-300c-4c9a-a501-5d679f583048

Securelist Octopus Oct 2018

ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cac0eda3-7d8c-42e2-b397-8923cd05f0b8

ESET DazzleSpy Jan 2022

ATTACK:enterprise:S0181 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cca29cfc-4753-4d3e-a1c7-848a66f0a593

US-CERT FALLCHILL Nov 2017

ATTACK:enterprise:S0172 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf3ec188-0f5d-4f7b-837b-1bdb79508aa6

Palo Alto Reaver Nov 2017

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.