LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0023: CHOPSTICK

CHOPSTICK is a malware family of modular backdoors used by APT28. It has been used since at least 2012 and is usually dropped on victims as second-stage malware, though it has been used as first-stage malware in several cases. It has both Windows and Linux variants. [1] [2] [3] [4] It is tracked separately from the X-Agent for Android.

EnterpriseS0023MalwareObject v2.3Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

CHOPSTICK is a modular backdoor family associated in ATT&CK with APT28 and documented for Windows and Linux. Its decision value is that it represents post-compromise access with multiple ways to communicate, discover the environment, collect user data, and adapt around defenses. For leaders, this is less about one malware name and more about whether the organization can prove it would notice a cross-platform backdoor using ordinary-looking web, mail, encrypted, fallback, proxy, or removable-media channels.

Executive priority

Prioritize CHOPSTICK-relevant readiness where Windows/Linux endpoints, sensitive user workstations, disconnected environments, or regulated evidence requirements matter. The relationships show behaviors that can affect incident scope decisions: command-and-control resilience, credential collection through keylogging, screen capture, registry changes, removable media movement, tool transfer, and security software discovery. Executives should ask whether SOC coverage is based only on known indicators or whether it also validates the underlying behaviors across endpoint, DNS, proxy, mail, removable media, and registry telemetry.

Technical view

ATT&CK does not provide a detection section for CHOPSTICK, so defenders should validate coverage through its linked techniques rather than rely on a single signature. On Windows, focus on registry query/modify activity, removable media execution or file movement, command interpreter use, screen/keylogging-related host behavior, and security tooling discovery. On Linux, validate visibility into command execution, file and directory discovery, volatile or shared-memory storage locations, web/mail-based C2, encrypted C2, DGA-like DNS behavior, internal proxying, and removable-media communication. Because the object is described as a modular backdoor and often second-stage malware, IR teams should treat a confirmed finding as a prompt to search for initial access, staging, transferred tools, persistence, credential exposure, and alternate C2 paths.

Likely telemetry

  • Endpoint process creation and command-line telemetry on Windows and Linux
  • Windows Registry query and modification events
  • File system and directory enumeration activity
  • Removable media insertion, autorun, file copy, and execution events
  • DNS query logs suitable for identifying unusual or algorithmically generated domains

Detection direction

  • Map detections to the related ATT&CK techniques, especially fallback channels, web/mail protocols, DGA, encrypted C2, internal proxy, ingress tool transfer, registry activity, discovery, removable media, keylogging, and screen capture.
  • Do not depend solely on malware names, hashes, or static indicators; the supplied ATT&CK object provides no official detection logic and CHOPSTICK is described as modular.
  • Tune for combinations of behaviors: discovery followed by tool transfer, registry modification, unusual outbound communications, or removable-media activity is more decision-useful than isolated command execution.
  • Account for false positives from administrators, software deployment tools, backup agents, helpdesk remote support, and legitimate security tooling discovery.
  • Validate Linux visibility separately from Windows visibility; the object explicitly has both variants, and many organizations have weaker Linux endpoint telemetry.

Mitigation priorities

  • Establish baseline endpoint telemetry across Windows and Linux before relying on behavioral detections.
  • Restrict and monitor removable media use, especially for sensitive or disconnected environments.
  • Harden registry permissions and monitor high-risk registry changes on Windows systems.
  • Enforce least privilege and administrative control review to reduce the impact of registry modification, tool transfer, and persistence-related behaviors.
  • Strengthen egress governance: proxy enforcement, DNS monitoring, and review of unusual web, mail, encrypted, fallback, or proxy-like channels.
Additional notes and limits

The most useful defensive framing comes from the relationship set: CHOPSTICK uses techniques spanning command-and-control, discovery, collection, credential access, persistence/defense impairment, lateral movement, initial access, stealth, and execution. The object is related to APT28 in ATT&CK, but local incident handling should not assume attribution from malware name alone. Treat the name as a trigger for behavior-based scoping and evidence preservation.

ATT&CK provides no official detection text for this object, and the malware object itself lists tactics as not specified. The assessment is therefore derived from the supplied description, platforms, external references, and relationships. Local baselines, sensor coverage, logging policy, and environment-specific allowlists are required before judging exposure or detection confidence.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

CHOPSTICK

CHOPSTICK is a malware family of modular backdoors used by APT28. It has been used since at least 2012 and is usually dropped on victims as second-stage malware, though it has been used as first-stage malware in several cases. It has both Windows and Linux variants. [1] [2] [3] [4] It is tracked separately from the X-Agent for Android.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

19 rows
DomainIDNameRelationship / procedure
EnterpriseT1008Fallback Channels

CHOPSTICK can switch to a new C2 channel if the current one is broken.[2]

EnterpriseT1092Communication Through Removable Media

Part of APT28's operation involved using CHOPSTICK modules to copy itself to air-gapped machines, using files written to USB sticks to transfer data and command traffic.[1][2][5]

EnterpriseT1090.001Internal ProxySub-technique

CHOPSTICK used a proxy server between victims and the C2 server.[2]

EnterpriseT1059Command and Scripting Interpreter

CHOPSTICK is capable of performing remote command execution.[9][2]

EnterpriseT1071.003Mail ProtocolsSub-technique

Various implementations of CHOPSTICK communicate with C2 over SMTP and POP3.[2]

EnterpriseT1071.001Web ProtocolsSub-technique

Various implementations of CHOPSTICK communicate with C2 over HTTP.[2]

EnterpriseT1112Modify Registry

CHOPSTICK may modify Registry keys to store RC4 encrypted configuration information.[1]

EnterpriseT1497Virtualization/Sandbox Evasion

CHOPSTICK includes runtime checks to identify an analysis environment and prevent execution on it.[1]

EnterpriseT1113Screen Capture

CHOPSTICK has the capability to capture screenshots.[4]

EnterpriseT1105Ingress Tool Transfer

CHOPSTICK is capable of performing remote file transmission.[9]

EnterpriseT1518.001Security Software DiscoverySub-technique

CHOPSTICK checks for antivirus and forensics software.[1]

EnterpriseT1083File and Directory Discovery

An older version of CHOPSTICK has a module that monitors all mounted volumes for files with the extensions .doc, .docx, .pgp, .gpg, .m2f, or .m2o.[2]

EnterpriseT1027.011Fileless StorageSub-technique

CHOPSTICK may store RC4 encrypted configuration information in the Windows Registry.[1]

EnterpriseT1056.001KeyloggingSub-technique

CHOPSTICK is capable of performing keylogging.[9][2][4]

EnterpriseT1091Replication Through Removable Media

Part of APT28's operation involved using CHOPSTICK modules to copy itself to air-gapped machines and using files written to USB sticks to transfer data and command traffic.[1][5][8]

EnterpriseT1568.002Domain Generation AlgorithmsSub-technique

CHOPSTICK can use a DGA for Fallback Channels, domains are generated by concatenating words from lists.[10]

EnterpriseT1573.001Symmetric CryptographySub-technique

CHOPSTICK encrypts C2 communications with RC4.[2]

EnterpriseT1573.002Asymmetric CryptographySub-technique

CHOPSTICK encrypts C2 communications with TLS.[2]

EnterpriseT1012Query Registry

CHOPSTICK provides access to the Windows Registry, which can be used to gather information.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0007: APT28

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]

APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.

Relationship explorer

All related ATT&CK context

uses · TechniqueT1008: Fallback ChannelsEnterpriseuses · TechniqueT1092: Communication Through Removable MediaEnterpriseuses · GroupG0007: APT28Enterpriseuses · TechniqueT1090.001: Internal ProxyEnterpriseuses · TechniqueT1059: Command and Scripting InterpreterEnterpriseuses · TechniqueT1071.003: Mail ProtocolsEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1497: Virtualization/Sandbox EvasionEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1027.011: Fileless StorageEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1091: Replication Through Removable MediaEnterpriseuses · TechniqueT1568.002: Domain Generation AlgorithmsEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1573.002: Asymmetric CryptographyEnterpriseuses · TechniqueT1012: Query RegistryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.3
Created
Modified
Raw hash
cf98a4d31aaa9622...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.3Current bundlecf98a4d31aaa…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  2. [2]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  3. [3]
    FireEye APT28 January 2017

    FireEye iSIGHT Intelligence. (2017, January 11). APT28: At the Center of the Storm. Retrieved November 17, 2024.

    Open source URL
  4. [4]
    DOJ GRU Indictment Jul 2018

    Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved November 17, 2024.

    Open source URL
  5. [5]
    Microsoft SIR Vol 19

    Anthe, C. et al. (2015, October 19). Microsoft Security Intelligence Report Volume 19. Retrieved December 23, 2015.

  6. [6]
    Kaspersky Sofacy

    Kaspersky Lab's Global Research and Analysis Team. (2015, December 4). Sofacy APT hits high profile targets with updated toolset. Retrieved December 10, 2015.

    Open source URL
  7. [7]
    Securelist Sofacy Feb 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, February 20). A Slice of 2017 Sofacy Activity. Retrieved November 27, 2018.

    Open source URL
  8. [8]
    Secureworks IRON TWILIGHT Active Measures March 2017

    Secureworks CTU. (2017, March 30). IRON TWILIGHT Supports Active Measures. Retrieved February 28, 2022.

    Open source URL
  9. [9]
    Crowdstrike DNC June 2016

    Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016.

    Open source URL
  10. [10]
    ESET Sednit 2017 Activity

    ESET. (2017, December 21). Sednit update: How Fancy Bear Spent the Year. Retrieved February 18, 2019.

    Open source URL
  11. [11]
    Backdoor.SofacyX

    (Citation: Symantec APT28 Oct 2018)

  12. [12]
    Backdoor.SofacyX

    (Citation: Symantec APT28 Oct 2018)

  13. [13]
    Backdoor.SofacyX

    (Citation: Symantec APT28 Oct 2018)

  14. [14]
    CHOPSTICK

    (Citation: FireEye APT28) (Citation: ESET Sednit Part 2) (Citation: FireEye APT28 January 2017)

  15. [15]
    CHOPSTICK

    (Citation: FireEye APT28) (Citation: ESET Sednit Part 2) (Citation: FireEye APT28 January 2017)

  16. [16]
    CHOPSTICK

    (Citation: FireEye APT28) (Citation: ESET Sednit Part 2) (Citation: FireEye APT28 January 2017)

  17. [17]
    DOJ GRU Indictment Jul 2018

    Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved November 17, 2024.

    Open source URL
  18. [18]
    DOJ GRU Indictment Jul 2018

    Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved November 17, 2024.

    Open source URL
  19. [19]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  20. [20]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  21. [21]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  22. [22]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  23. [23]
    FireEye APT28 January 2017

    FireEye iSIGHT Intelligence. (2017, January 11). APT28: At the Center of the Storm. Retrieved November 17, 2024.

    Open source URL
  24. [24]
    FireEye APT28 January 2017

    FireEye iSIGHT Intelligence. (2017, January 11). APT28: At the Center of the Storm. Retrieved November 17, 2024.

    Open source URL
  25. [25]
    SPLM

    (Citation: ESET Sednit Part 2) (Citation: FireEye APT28 January 2017)

  26. [26]
    SPLM

    (Citation: ESET Sednit Part 2) (Citation: FireEye APT28 January 2017)

  27. [27]
    SPLM

    (Citation: ESET Sednit Part 2) (Citation: FireEye APT28 January 2017)

  28. [28]
    Symantec APT28 Oct 2018

    Symantec Security Response. (2018, October 04). APT28: New Espionage Operations Target Military and Government Organizations. Retrieved November 14, 2018.

    Open source URL
  29. [29]
    Symantec APT28 Oct 2018

    Symantec Security Response. (2018, October 04). APT28: New Espionage Operations Target Military and Government Organizations. Retrieved November 14, 2018.

    Open source URL
  30. [30]
    Symantec APT28 Oct 2018

    Symantec Security Response. (2018, October 04). APT28: New Espionage Operations Target Military and Government Organizations. Retrieved November 14, 2018.

    Open source URL
  31. [31]
    X-Agent

    (Citation: ESET Sednit Part 2) (Citation: FireEye APT28 January 2017)

  32. [32]
    X-Agent

    (Citation: ESET Sednit Part 2) (Citation: FireEye APT28 January 2017)

  33. [33]
    X-Agent

    (Citation: ESET Sednit Part 2) (Citation: FireEye APT28 January 2017)

  34. [34]
    Xagent

    (Citation: ESET Sednit Part 2) (Citation: FireEye APT28 January 2017)

  35. [35]
    Xagent

    (Citation: ESET Sednit Part 2) (Citation: FireEye APT28 January 2017)

  36. [36]
    Xagent

    (Citation: ESET Sednit Part 2) (Citation: FireEye APT28 January 2017)

  37. [37]
    mitre-attackS0023
    Open source URL
  38. [38]
    mitre-attackS0023
    Open source URL
  39. [39]
    mitre-attackS0023
    Open source URL
  40. [40]
    webhp

    (Citation: FireEye APT28 January 2017)

  41. [41]
    webhp

    (Citation: FireEye APT28 January 2017)

  42. [42]
    webhp

    (Citation: FireEye APT28 January 2017)

  43. [43]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  44. [44]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  45. [45]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  46. [46]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  47. [47]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  48. [48]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  49. [49]
    Microsoft SIR Vol 19

    Anthe, C. et al. (2015, October 19). Microsoft Security Intelligence Report Volume 19. Retrieved December 23, 2015.

  50. [50]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  51. [51]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  52. [52]
    Kaspersky Sofacy

    Kaspersky Lab's Global Research and Analysis Team. (2015, December 4). Sofacy APT hits high profile targets with updated toolset. Retrieved December 10, 2015.

    Open source URL
  53. [53]
    Securelist Sofacy Feb 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, February 20). A Slice of 2017 Sofacy Activity. Retrieved November 27, 2018.

    Open source URL
  54. [54]
    Secureworks IRON TWILIGHT Active Measures March 2017

    Secureworks CTU. (2017, March 30). IRON TWILIGHT Supports Active Measures. Retrieved February 28, 2022.

    Open source URL
  55. [55]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  56. [56]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  57. [57]
    Crowdstrike DNC June 2016

    Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016.

    Open source URL
  58. [58]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  59. [59]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  60. [60]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  61. [61]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  62. [62]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  63. [63]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  64. [64]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  65. [65]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  66. [66]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  67. [67]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  68. [68]
    DOJ GRU Indictment Jul 2018

    Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved November 17, 2024.

    Open source URL
  69. [69]
    DOJ GRU Indictment Jul 2018

    Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved November 17, 2024.

    Open source URL
  70. [70]
    Crowdstrike DNC June 2016

    Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016.

    Open source URL
  71. [71]
    Crowdstrike DNC June 2016

    Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016.

    Open source URL
  72. [72]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  73. [73]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  74. [74]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  75. [75]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  76. [76]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  77. [77]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  78. [78]
    Crowdstrike DNC June 2016

    Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016.

    Open source URL
  79. [79]
    Crowdstrike DNC June 2016

    Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016.

    Open source URL
  80. [80]
    DOJ GRU Indictment Jul 2018

    Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved November 17, 2024.

    Open source URL
  81. [81]
    DOJ GRU Indictment Jul 2018

    Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved November 17, 2024.

    Open source URL
  82. [82]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  83. [83]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  84. [84]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  85. [85]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  86. [86]
    Microsoft SIR Vol 19

    Anthe, C. et al. (2015, October 19). Microsoft Security Intelligence Report Volume 19. Retrieved December 23, 2015.

  87. [87]
    Microsoft SIR Vol 19

    Anthe, C. et al. (2015, October 19). Microsoft Security Intelligence Report Volume 19. Retrieved December 23, 2015.

  88. [88]
    Secureworks IRON TWILIGHT Active Measures March 2017

    Secureworks CTU. (2017, March 30). IRON TWILIGHT Supports Active Measures. Retrieved February 28, 2022.

    Open source URL
  89. [89]
    Secureworks IRON TWILIGHT Active Measures March 2017

    Secureworks CTU. (2017, March 30). IRON TWILIGHT Supports Active Measures. Retrieved February 28, 2022.

    Open source URL
  90. [90]
    ESET Sednit 2017 Activity

    ESET. (2017, December 21). Sednit update: How Fancy Bear Spent the Year. Retrieved February 18, 2019.

    Open source URL
  91. [91]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  92. [92]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  93. [93]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use