T1080: Taint Shared Content
Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
A directory share pivot is a variation on this technique that uses several other techniques to propagate malware when users access a shared network directory. It uses Shortcut Modification of directory .LNK files that use Masquerading to look like the real directories, which are hidden through Hidden Files and Directories. The malicious .LNK-based directories have an embedded command that executes the hidden malware file in the directory and then opens the real intended directory so that the user's expected action still occurs. When used with frequently used network directories, the technique may result in frequent reinfections and broad access to systems and potentially to new and higher privileged accounts. [1]
Adversaries may also compromise shared network directories through binary infections by appending or prepending its code to the healthy binary on the shared network directory. The malware may modify the original entry point (OEP) of the healthy binary to ensure that it is executed before the legitimate code. The infection could continue to spread via the newly infected file when it is executed by a remote system. These infections may target both binary and non-binary formats that end with extensions including, but not limited to, .EXE, .DLL, .SCR, .BAT, and/or .VBS.
Analyst context for executives and security teams
Taint Shared Content matters because shared drives, SaaS workspaces, code repositories, NAS locations, and office document libraries are trusted by users and often broadly accessible. If an adversary can add or modify content there, normal business collaboration can become a lateral movement path: users open what looks like legitimate shared content and execute attacker-controlled code. The business risk is not just malware execution; it is the abuse of trusted collaboration workflows that may repeatedly expose users, privileged accounts, and remote systems.
Executive priority
Prioritize this technique where the organization depends on shared storage, internal repositories, office suites, or network shares for daily operations. Leaders should ask whether write access to shared locations is tightly governed, whether execution from shared paths is restricted, and whether SOC teams can prove they see suspicious file creation or modification in those locations. This is also relevant for audit evidence around least privilege, change control, malware prevention, and incident containment because a single tainted shared location can create repeated reinfection risk until the underlying permissions and files are remediated.
Technical view
ATT&CK maps T1080 to lateral movement across Windows, Linux, macOS, SaaS, and Office Suite environments. The supplied object highlights malicious programs, scripts, exploit code, shortcut-based directory share pivots, hidden files/directories, masquerading, and binary infection of files such as EXE, DLL, SCR, BAT, and VBS. There is no official MITRE detection text, but the related detection strategy DET0471 is focused on detecting tainted content written to shared storage. SOC and IR teams should validate visibility into writes, modifications, renames, hidden attributes, shortcut creation, and execution events originating from or targeting shared locations, then correlate those events with user identity, host, repository/share path, and subsequent process execution.
Likely telemetry
- File creation, modification, rename, and deletion events on shared storage locations
- Access control and permission changes on shared directories, repositories, SaaS workspaces, and office content stores
- Endpoint process execution where the image, script, shortcut, or document originated from a shared path
- File metadata such as extension, hash, signer, owner, timestamps, hidden attributes, and original entry point or binary integrity indicators where available
- Authentication and user activity logs showing who wrote to or executed content from shared locations
Detection direction
- Inventory high-use shared locations and confirm whether DET0471-style detection of suspicious content written to shared storage is implemented and producing reviewable evidence.
- Tune for unusual executable, script, shortcut, or macro-capable content added to shared locations, especially where many users commonly browse or open files.
- Correlate file write events with later execution by other users or hosts to distinguish routine collaboration from lateral movement behavior.
- Watch for shortcut-based directory patterns, hidden files, masquerading, and content that preserves expected user workflow while launching additional code, as described in the ATT&CK object.
- Baseline legitimate administrative and developer activity to reduce false positives from software distribution shares, build repositories, logon scripts, and approved automation.
Mitigation priorities
- Start with M1022: restrict file and directory permissions so only required users, groups, or processes can write to sensitive or widely used shared locations.
- Apply least privilege and remove unnecessary write permissions from shared directories, internal repositories, and office content stores that are broadly read by users.
- Use M1038 execution prevention to reduce the chance that unauthorized code, scripts, or binaries can run from shared locations.
- Maintain M1049 antivirus/antimalware coverage across endpoints and systems that access shared content, with attention to scanning files stored on shared repositories or file shares.
- Use M1050 exploit protection where shared documents or files may contain exploit code targeting client applications.
Analyst notes and limits
The relationship context shows use of this technique by multiple ATT&CK groups and software entries, including Darkhotel, Gamaredon Group, BRONZE BUTLER, Cinnamon Tempest, RedCurl, H1N1, Miner-C, InvisiMole, Ursnif, Ramsay, Conti, and Stuxnet. This supports treating the behavior as broadly relevant across espionage, malware, ransomware, and cyber-physical contexts, but it does not by itself indicate current activity against any specific organization. The cyber-physical relevance is limited to the supplied Stuxnet relationship and Windows platform context, so local ICS/OT exposure should be validated before elevating that risk.
MITRE provides no official detection text for this object, so detection guidance is derived from the technique description and the related DET0471 detection strategy name. The supplied fields do not provide specific log sources, analytic logic, thresholds, or vendor coverage. Local architecture, share usage patterns, SaaS audit capabilities, endpoint telemetry, and permission models are required to determine actual risk and coverage.
Taint Shared Content
Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
A directory share pivot is a variation on this technique that uses several other techniques to propagate malware when users access a shared network directory. It uses Shortcut Modification of directory .LNK files that use Masquerading to look like the real directories, which are hidden through Hidden Files and Directories. The malicious .LNK-based directories have an embedded command that executes the hidden malware file in the directory and then opens the real intended directory so that the user's expected action still occurs. When used with frequently used network directories, the technique may result in frequent reinfections and broad access to systems and potentially to new and higher privileged accounts. [1]
Adversaries may also compromise shared network directories through binary infections by appending or prepending its code to the healthy binary on the shared network directory. The malware may modify the original entry point (OEP) of the healthy binary to ensure that it is executed before the legitimate code. The infection could continue to spread via the newly infected file when it is executed by a remote system. These infections may target both binary and non-binary formats that end with extensions including, but not limited to, .EXE, .DLL, .SCR, .BAT, and/or .VBS.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Groups, software, and campaigns
G0012: Darkhotel
Darkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. Darkhotel has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks.[1][2][3]
G1039: RedCurl
RedCurl is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks.[1] RedCurl is allegedly a Russian-speaking threat actor.[1][2] The group’s operations typically start with spearphishing emails to gain initial access, then the group executes discovery and collection commands and scripts to find corporate data. The group concludes operations by exfiltrating files to the C2 servers.
G0047: Gamaredon Group
Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.[1][2][3][4][5]
In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. [6][5]
G0060: BRONZE BUTLER
BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.[1][2][3]
G1021: Cinnamon Tempest
Cinnamon Tempest is a China-based threat group that has been active since at least 2021 deploying multiple strains of ransomware based on the leaked Babuk source code. Cinnamon Tempest does not operate their ransomware on an affiliate model or purchase access but appears to act independently in all stages of the attack lifecycle. Based on victimology, the short lifespan of each ransomware variant, and use of malware attributed to government-sponsored threat groups, Cinnamon Tempest may be motivated by intellectual property theft or cyberespionage rather than financial gain.[1][2][3][4]
S0132: H1N1
S0458: Ramsay
S0260: InvisiMole
InvisiMole is a modular spyware program that has been used by the InvisiMole Group since at least 2013. InvisiMole has two backdoor modules called RC2FM and RC2CL that are used to perform post-exploitation activities. It has been discovered on compromised victims in the Ukraine and Russia. Gamaredon Group infrastructure has been used to download and execute InvisiMole against a small number of victims.[1][2]
S0575: Conti
Conti is a Ransomware-as-a-Service (RaaS) that was first observed in December 2019. Conti has been deployed via TrickBot and used against major corporations and government agencies, particularly those in North America. As with other ransomware families, actors using Conti steal sensitive files and information from compromised networks, and threaten to publish this data unless the ransom is paid.[1][2][3]
S0133: Miner-C
S0603: Stuxnet
Stuxnet was the first publicly reported malware to specifically target industrial control systems devices. Stuxnet is a large and complex malware that utilized multiple behaviors, including numerous zero-day vulnerabilities, a sophisticated Windows rootkit, and network infection routines.[1][2][3][4] Stuxnet was discovered in 2010, with some components being used as early as November 2008.[1]
S0386: Ursnif
Ursnif is a banking trojan and variant of the Gozi malware observed being spread through various automated exploit kits, Spearphishing Attachments, and malicious links.[1][2] Ursnif is associated primarily with data theft, but variants also include components (backdoors, spyware, file injectors, etc.) capable of a wide variety of behaviors.[3]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.6 | Current bundle | f87eed4e312a… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Retwin Directory Share Pivot
Routin, D. (2017, November 13). Abusing network shares for efficient lateral movements and privesc (DirSharePivot). Retrieved April 12, 2018.
Open source URL -
[2]
mitre-attack T1080Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.