LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G1018: TA2541

TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.[1][2]

EnterpriseG1018GroupObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

TA2541 matters because MITRE describes it as a cybercriminal group targeting aviation, aerospace, transportation, manufacturing, and defense since at least 2017, using high-volume campaigns, commodity remote access tools, crypters, and aviation/travel-themed lures. For leaders, the practical issue is not a novel zero-day profile; it is whether email, endpoint, logging, and response processes can handle repeated, obfuscated commodity RAT delivery attempts against operationally important sectors.

Executive priority

Prioritize validation where business operations depend on aviation, transportation, manufacturing, or defense workflows, or where staff are likely to receive travel- or logistics-themed messages. This object supports executive questions such as: can the organization prove it inspects high-volume email threats, detects commodity RAT execution and persistence, and preserves enough endpoint/network evidence for incident response? Because the relationship set includes obfuscation, user execution, PowerShell, WMI, scheduled tasks, process injection, and tool transfer, coverage should be treated as a layered resilience and audit-evidence issue rather than a single malware-signature problem.

Technical view

MITRE provides no official detection text for TA2541, so SOC and detection teams should validate coverage through the related software and techniques. The relationship set points to commodity RATs and spyware including NETWIRE, jRAT, Agent Tesla, Revenge RAT, njRAT, Imminent Monitor, WarzoneRAT, AsyncRAT, and the Snip3 crypter. Detection engineering should focus on the chain implied by the relationships: user interaction with malicious links or files, obfuscated or compressed payloads, execution through PowerShell/Visual Basic/WMI, persistence or execution via scheduled tasks, process injection or hollowing, basic host and internet connectivity discovery, and ingress transfer of additional tools.

Likely telemetry

  • Email security and mail gateway logs for high-volume themed lures, links, attachments, and delivery outcomes
  • Endpoint process creation, command-line, parent-child process, script, and module/load telemetry
  • PowerShell, WMI, Visual Basic, and scheduled task creation or execution logs
  • Endpoint detection telemetry for packed, encoded, compressed, or otherwise obfuscated files
  • Memory/process behavior telemetry relevant to process injection and process hollowing

Detection direction

  • Do not rely only on static signatures; the supplied relationships include crypter use, software packing, encrypted/encoded files, and compression.
  • Tune detections around suspicious execution chains after a user opens a file or clicks a link, especially when followed by scripting, WMI, scheduled tasks, or unexpected external connections.
  • Map coverage for each related commodity RAT family where feasible, but treat family naming as secondary to behaviors such as remote access tooling, persistence, discovery, and ingress tool transfer.
  • Review false positives carefully for administrative tools such as PowerShell, WMI, and scheduled tasks; prioritize unusual parent processes, user context, timing, destinations, and file locations.
  • Validate cross-platform visibility where related software or techniques indicate Linux, macOS, Android, ESXi, IaaS, network device, or container relevance, while noting the TA2541 object itself does not specify platforms.

Mitigation priorities

  • Strengthen email and web controls around malicious links, attachments, and high-volume social engineering themes relevant to aviation, transportation, and travel.
  • Harden endpoint execution controls for script interpreters, WMI, scheduled tasks, and untrusted files, with special attention to Windows because many related software entries and techniques identify Windows support.
  • Ensure endpoint protection and response tooling can inspect or at least surface packed, encoded, compressed, and crypter-obfuscated payload behavior.
  • Restrict and monitor unnecessary outbound connectivity and file transfer paths so RAT command-and-control and ingress tool transfer are easier to detect and contain.
  • Prepare incident response playbooks for commodity RAT intrusions, including host isolation, credential review where appropriate, persistence removal, and evidence preservation.
Additional notes and limits

This take is based on the supplied MITRE ATT&CK group object, external references, and relationship context only. The most decision-relevant facts are the targeted industries, high-volume campaign description, aviation/transportation/travel themes, commodity RAT usage, and obfuscation through crypters. The relationship set provides practical behavior anchors for detection and response even though the group object itself has no tactics, platforms, or official detection guidance.

ATT&CK does not provide official detection text, platforms, or tactics on the TA2541 group object. Some platform and tactic guidance comes from related software and technique objects, not from a direct TA2541 platform declaration. Local mail flow, endpoint operating systems, logging maturity, and observed incident evidence are required before assessing exposure or detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

TA2541

TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

28 rows
DomainIDNameRelationship / procedure
EnterpriseT1608.001Upload MalwareSub-technique

TA2541 has uploaded malware to various platforms including Google Drive, Pastetext, Sharetext, and GitHub.[1][2]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

TA2541 has placed VBS files in the Startup folder and used Registry run keys to establish persistence for malicious payloads.[1]

EnterpriseT1573.002Asymmetric CryptographySub-technique

TA2541 has used TLS encrypted C2 communications including for campaigns using AsyncRAT.[2]

EnterpriseT1105Ingress Tool Transfer

TA2541 has used malicious scripts and macros with the ability to download additional payloads.[2]

EnterpriseT1568Dynamic Resolution

TA2541 has used dynamic DNS services for C2 infrastructure.[1]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

TA2541 has used file names to mimic legitimate Windows files or system functionality.[1]

EnterpriseT1518.001Security Software DiscoverySub-technique

TA2541 has used tools to search victim systems for security products such as antivirus and firewall software.[1]

EnterpriseT1053.005Scheduled TaskSub-technique

TA2541 has used scheduled tasks to establish persistence for installed tools.[1]

EnterpriseT1027.002Software PackingSub-technique

TA2541 has used a .NET packer to obfuscate malicious files.[2]

EnterpriseT1082System Information Discovery

TA2541 has collected system information prior to downloading malware on the targeted host.[1]

EnterpriseT1685Disable or Modify Tools

TA2541 has attempted to disable built-in security protections such as Windows AMSI. [1]

EnterpriseT1588.001MalwareSub-technique

TA2541 has used multiple strains of malware available for purchase on criminal forums or in open-source repositories.[1]

EnterpriseT1218.005MshtaSub-technique

TA2541 has used `mshta` to execute scripts including VBS.[2]

EnterpriseT1588.002ToolSub-technique

TA2541 has used commodity remote access tools.[2]

EnterpriseT1204.001Malicious LinkSub-technique

TA2541 has used malicious links to cloud and web services to gain execution on victim machines.[1][4]

EnterpriseT1583.001DomainsSub-technique

TA2541 has registered domains often containing the keywords “kimjoy,” “h0pe,” and “grace,” using domain registrars including Netdorm and No-IP DDNS, and hosting providers including xTom GmbH and Danilenko, Artyom.[1][2]

EnterpriseT1055Process Injection

TA2541 has injected malicious code into legitimate .NET related processes including regsvcs.exe, msbuild.exe, and installutil.exe.[1][2]

EnterpriseT1059.001PowerShellSub-technique

TA2541 has used PowerShell to download files and to inject into various Windows processes.[1]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

TA2541 has used compressed and char-encoded scripts in operations.[2]

EnterpriseT1016.001Internet Connection DiscoverySub-technique

TA2541 has run scripts to check internet connectivity from compromised hosts. [2]

EnterpriseT1055.012Process HollowingSub-technique

TA2541 has used process hollowing to execute CyberGate malware.[2]

EnterpriseT1047Windows Management Instrumentation

TA2541 has used WMI to query targeted systems for security products.[1]

EnterpriseT1204.002Malicious FileSub-technique

TA2541 has used macro-enabled MS Word documents to lure victims into executing malicious payloads.[1][2][5]

EnterpriseT1059.005Visual BasicSub-technique

TA2541 has used VBS files to execute or establish persistence for additional payloads, often using file names consistent with email themes or mimicking system functionality.[1][2]

EnterpriseT1566.002Spearphishing LinkSub-technique

TA2541 has used spearphishing e-mails with malicious links to deliver malware. [1][5]

EnterpriseT1027.015CompressionSub-technique

TA2541 has used compressed and char-encoded scripts in operations.[2]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

TA2541 has sent phishing emails with malicious attachments for initial access including MS Word documents.[1][2]

EnterpriseT1583.006Web ServicesSub-technique

TA2541 has hosted malicious files on various platforms including Google Drive, OneDrive, Discord, PasteText, ShareText, and GitHub.[1]

Associated objects

Groups, software, and campaigns

MalwareEnterprise

S0283: jRAT

jRAT is a cross-platform, Java-based backdoor originally available for purchase in 2012. Variants of jRAT have been distributed via a software-as-a-service platform, similar to an online subscription model.[1] [2]

LinuxWindowsmacOS
MalwareEnterprise

S0670: WarzoneRAT

WarzoneRAT is a malware-as-a-service remote access tool (RAT) written in C++ that has been publicly available for purchase since at least late 2018.[1][2]

Windows
ToolEnterprise

S0434: Imminent Monitor

Imminent Monitor was a commodity remote access tool (RAT) offered for sale from 2012 until 2019, when an operation was conducted to take down the Imminent Monitor infrastructure. Various cracked versions and variations of this RAT are still in circulation.[1]

Windows
ToolEnterprise

S1087: AsyncRAT

AsyncRAT is an open-source remote access tool originally available through the NYANxCAT Github repository that has been used in malicious campaigns.[1][2][3]

Windows
MalwareEnterprise

S0198: NETWIRE

NETWIRE is a publicly available, multiplatform remote administration tool (RAT) that has been used by criminal and APT groups since at least 2012.[1][2][3]

WindowsLinuxmacOS
MalwareEnterprise

S0385: njRAT

njRAT is a remote access tool (RAT) that was first observed in 2012. It has been used by threat actors in the Middle East.[1]

Windows
Relationship explorer

All related ATT&CK context

uses · TechniqueT1608.001: Upload MalwareEnterpriseuses · MalwareS1086: Snip3Enterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1573.002: Asymmetric CryptographyEnterpriseuses · MalwareS0379: Revenge RATEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1568: Dynamic ResolutionEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1027.002: Software PackingEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1685: Disable or Modify ToolsEnterpriseuses · MalwareS0283: jRATEnterpriseuses · TechniqueT1588.001: MalwareEnterpriseuses · MalwareS0670: WarzoneRATEnterpriseuses · TechniqueT1218.005: MshtaEnterpriseuses · TechniqueT1588.002: ToolEnterpriseuses · TechniqueT1204.001: Malicious LinkEnterpriseuses · TechniqueT1583.001: DomainsEnterpriseuses · TechniqueT1055: Process InjectionEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1016.001: Internet Connection DiscoveryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
4e43a137d0344204...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundle4e43a137d034…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  2. [2]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  3. [3]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  4. [4]
    FireEye NETWIRE March 2019

    Maniath, S. and Kadam P. (2019, March 19). Dissecting a NETWIRE Phishing Campaign's Usage of Process Hollowing. Retrieved January 7, 2021.

    Open source URL
  5. [5]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  6. [6]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  7. [7]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  8. [8]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  9. [9]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  10. [10]
    mitre-attackG1018
    Open source URL
  11. [11]
    mitre-attackG1018
    Open source URL
  12. [12]
    mitre-attackG1018
    Open source URL
  13. [13]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  14. [14]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  15. [15]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  16. [16]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  17. [17]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  18. [18]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  19. [19]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  20. [20]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  21. [21]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  22. [22]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  23. [23]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  24. [24]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  25. [25]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  26. [26]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  27. [27]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  28. [28]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  29. [29]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  30. [30]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  31. [31]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  32. [32]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  33. [33]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  34. [34]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  35. [35]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  36. [36]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  37. [37]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  38. [38]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  39. [39]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  40. [40]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  41. [41]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  42. [42]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  43. [43]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  44. [44]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  45. [45]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  46. [46]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  47. [47]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  48. [48]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  49. [49]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  50. [50]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  51. [51]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  52. [52]
    FireEye NETWIRE March 2019

    Maniath, S. and Kadam P. (2019, March 19). Dissecting a NETWIRE Phishing Campaign's Usage of Process Hollowing. Retrieved January 7, 2021.

    Open source URL
  53. [53]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  54. [54]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  55. [55]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  56. [56]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  57. [57]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  58. [58]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  59. [59]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  60. [60]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  61. [61]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  62. [62]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  63. [63]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  64. [64]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  65. [65]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  66. [66]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  67. [67]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  68. [68]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  69. [69]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  70. [70]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  71. [71]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  72. [72]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  73. [73]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  74. [74]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  75. [75]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  76. [76]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  77. [77]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  78. [78]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  79. [79]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  80. [80]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  81. [81]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  82. [82]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  83. [83]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  84. [84]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  85. [85]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  86. [86]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  87. [87]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  88. [88]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  89. [89]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  90. [90]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  91. [91]
    Morphisec Snip3 May 2021

    Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.

    Open source URL
  92. [92]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  93. [93]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  94. [94]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  95. [95]
    Telefonica Snip3 December 2021

    Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.

    Open source URL
  96. [96]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  97. [97]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  98. [98]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  99. [99]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  100. [100]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  101. [101]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  102. [102]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  103. [103]
    FireEye NETWIRE March 2019

    Maniath, S. and Kadam P. (2019, March 19). Dissecting a NETWIRE Phishing Campaign's Usage of Process Hollowing. Retrieved January 7, 2021.

    Open source URL
  104. [104]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  105. [105]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  106. [106]
    Cisco Operation Layover September 2021

    Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.

    Open source URL
  107. [107]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use