LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0239: Bankshot

Bankshot is a remote access tool (RAT) that was first reported by the Department of Homeland Security in December of 2017. In 2018, Lazarus Group used the Bankshot implant in attacks against the Turkish financial sector. [1]

EnterpriseS0239MalwareObject v1.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Bankshot is a Windows remote access tool with ATT&CK-documented behaviors across execution, discovery, collection, command-and-control, exfiltration, and anti-forensics. For leaders, its value is as a coverage test: can the organization see a Windows host exploited through a client application, communicating over web-like traffic, collecting local files, exfiltrating over the same channel, and then deleting or altering artifacts?

Executive priority

Prioritize Bankshot as a defensive validation scenario for Windows endpoint visibility, egress monitoring, legacy client-application risk, and incident response evidence preservation. The official description notes historical use against the Turkish financial sector and a zero-day Adobe Flash execution path, so leaders should confirm whether vulnerable or obsolete client software has been removed and whether SOC/IR teams can prove coverage for data collection and C2-based exfiltration.

Technical view

ATT&CK maps Bankshot to Windows behaviors including command execution through cmd, process creation through Windows APIs, token-based process creation, Registry querying/modification, system/process/file/account/storage discovery, local and automated file collection, file upload/download, HTTP C2, non-standard encoded C2 commands, false TLS-handshake impersonation, exfiltration over C2, timestomping, and file/artifact deletion. Detection engineering should validate chained behavior rather than single indicators: suspicious client-app execution followed by new processes, discovery commands or API-driven enumeration, Registry activity around HKLM\SOFTWARE\Microsoft\Pniumj, recursive file listing or file access bursts, outbound HTTP-like traffic with unusual encoding or TLS impersonation, and subsequent deletion or timestamp manipulation.

Likely telemetry

  • Windows endpoint process creation and parent/child process lineage
  • Command-line telemetry for cmd and discovery utilities
  • Windows API/EDR events for process creation and token-based process creation
  • Registry query and write events, especially HKLM\SOFTWARE\Microsoft\Pniumj
  • File system enumeration, file read/access, upload/download, deletion, and pending-delete-on-reboot evidence

Detection direction

  • Build detections around behavior sequences: execution or process creation followed by host discovery, file discovery/collection, outbound web traffic, and cleanup activity.
  • Validate visibility for HTTP command-and-control that blends with normal web traffic, including encoded or gzip-like command content and traffic that appears to impersonate TLS behavior.
  • Monitor Registry access and modification tied to the documented Bankshot key, while avoiding overreliance on a single registry indicator.
  • Tune for recursive file listing and local file collection followed by outbound transfer over the same network channel.
  • Review detections for timestomping and file deletion; these are often forensic signals rather than high-fidelity real-time alerts by themselves.

Mitigation priorities

  • Remove or tightly control obsolete/vulnerable client software, especially where legacy Flash exposure may still exist.
  • Enforce timely vulnerability management for user-facing applications that can enable client-side execution.
  • Apply least privilege and restrict administrative rights needed for sensitive Registry modification, token abuse, and broader system manipulation.
  • Use egress controls, proxy policy, and network monitoring to limit and inspect unexpected outbound HTTP/TLS-like traffic from endpoints.
  • Ensure endpoint controls collect process, registry, file, and network context needed to reconstruct discovery, collection, exfiltration, and cleanup.
Additional notes and limits

Bankshot should be used as a multi-technique validation case for Windows RAT coverage rather than as a single-signature malware test. The supplied ATT&CK relationships emphasize C2 over HTTP, data collection/exfiltration, discovery, Registry activity, API-based execution, token-based process creation, and anti-forensic cleanup.

Official ATT&CK detection text is not provided for this malware object. This take is limited to the supplied STIX fields and relationships; local software inventory, endpoint logging depth, network architecture, and IR evidence sources are required to determine actual exposure or coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Bankshot

Bankshot is a remote access tool (RAT) that was first reported by the Department of Homeland Security in December of 2017. In 2018, Lazarus Group used the Bankshot implant in attacks against the Turkish financial sector. [1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

25 rows
DomainIDNameRelationship / procedure
EnterpriseT1071.001Web ProtocolsSub-technique

Bankshot uses HTTP for command and control communication.[1]

EnterpriseT1005Data from Local System

Bankshot collects files from the local system.[1]

EnterpriseT1070.004File DeletionSub-technique

Bankshot marks files to be deleted upon the next system reboot and uninstalls and removes itself from the system.[1]

EnterpriseT1083File and Directory Discovery

Bankshot searches for files on the victim's machine.[2]

EnterpriseT1070.006TimestompSub-technique

Bankshot modifies the time of a file as specified by the control server.[1]

EnterpriseT1203Exploitation for Client Execution

Bankshot leverages a known zero-day vulnerability in Adobe Flash to execute the implant into the victims’ machines.[1]

EnterpriseT1057Process Discovery

Bankshot identifies processes and collects the process ids.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

Bankshot decodes embedded XOR strings.[2]

EnterpriseT1082System Information Discovery

Bankshot gathers system information, network addresses, and the operation system version.[1][2]

EnterpriseT1543.003Windows ServiceSub-technique

Bankshot can terminate a specific process by its process id.[1][2]

EnterpriseT1106Native API

Bankshot creates processes using the Windows API calls: CreateProcessA() and CreateProcessAsUserA().[1]

EnterpriseT1012Query Registry

Bankshot searches for certain Registry keys to be configured before executing the payload.[2]

EnterpriseT1132.002Non-Standard EncodingSub-technique

Bankshot encodes commands from the control server using a range of characters and gzip.[1]

EnterpriseT1119Automated Collection

Bankshot recursively generates a list of files within a directory and sends them back to the control server.[1]

EnterpriseT1001.003Protocol or Service ImpersonationSub-technique

Bankshot generates a false TLS handshake using a public certificate to disguise C2 network communications.[3]

EnterpriseT1105Ingress Tool Transfer

Bankshot uploads files and secondary payloads to the victim's machine.[2]

EnterpriseT1087.001Local AccountSub-technique

Bankshot gathers domain and account names/information through process monitoring.[1]

EnterpriseT1087.002Domain AccountSub-technique

Bankshot gathers domain and account names/information through process monitoring.[1]

EnterpriseT1112Modify Registry

Bankshot writes data into the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Pniumj.[2]

EnterpriseT1134.002Create Process with TokenSub-technique

Bankshot grabs a user token using WTSQueryUserToken and then creates a process by impersonating a logged-on user.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

Bankshot uses the command-line interface to execute arbitrary commands.[1][2]

EnterpriseT1041Exfiltration Over C2 Channel

Bankshot exfiltrates data over its C2 channel.[1]

EnterpriseT1680Local Storage Discovery

Bankshot gathers disk type and disk free space.[1][2]

EnterpriseT1070Indicator Removal

Bankshot deletes all artifacts associated with the malware from the infected machine.[2]

EnterpriseT1571Non-Standard Port

Bankshot binds and listens on port 1058 for HTTP traffic while also utilizing a FakeTLS method.[2]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0032: Lazarus Group

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]

North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1070.006: TimestompEnterpriseuses · TechniqueT1203: Exploitation for Client ExecutionEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1132.002: Non-Standard EncodingEnterpriseuses · TechniqueT1119: Automated CollectionEnterpriseuses · TechniqueT1001.003: Protocol or Service ImpersonationEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1087.001: Local AccountEnterpriseuses · TechniqueT1087.002: Domain AccountEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1134.002: Create Process with TokenEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1680: Local Storage DiscoveryEnterpriseuses · TechniqueT1070: Indicator RemovalEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
cf6ce94f89db56bf...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.2Current bundlecf6ce94f89db…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  2. [2]
    US-CERT Bankshot Dec 2017

    US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.

    Open source URL
  3. [3]
    MAR10135536-B

    US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved August 15, 2024.

    Open source URL
  4. [4]
    Bankshot

    (Citation: McAfee Bankshot)

  5. [5]
    Bankshot

    (Citation: McAfee Bankshot)

  6. [6]
    Bankshot

    (Citation: McAfee Bankshot)

  7. [7]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  8. [8]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  9. [9]
    Trojan Manuscript

    (Citation: McAfee Bankshot)

  10. [10]
    Trojan Manuscript

    (Citation: McAfee Bankshot)

  11. [11]
    Trojan Manuscript

    (Citation: McAfee Bankshot)

  12. [12]
    mitre-attackS0239
    Open source URL
  13. [13]
    mitre-attackS0239
    Open source URL
  14. [14]
    mitre-attackS0239
    Open source URL
  15. [15]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  16. [16]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  17. [17]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  18. [18]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  19. [19]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  20. [20]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  21. [21]
    US-CERT Bankshot Dec 2017

    US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.

    Open source URL
  22. [22]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  23. [23]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  24. [24]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  25. [25]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  26. [26]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  27. [27]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  28. [28]
    US-CERT Bankshot Dec 2017

    US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.

    Open source URL
  29. [29]
    US-CERT Bankshot Dec 2017

    US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.

    Open source URL
  30. [30]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  31. [31]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  32. [32]
    US-CERT Bankshot Dec 2017

    US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.

    Open source URL
  33. [33]
    US-CERT Bankshot Dec 2017

    US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.

    Open source URL
  34. [34]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  35. [35]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  36. [36]
    US-CERT Bankshot Dec 2017

    US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.

    Open source URL
  37. [37]
    US-CERT Bankshot Dec 2017

    US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.

    Open source URL
  38. [38]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  39. [39]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  40. [40]
    US-CERT Bankshot Dec 2017

    US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.

    Open source URL
  41. [41]
    US-CERT Bankshot Dec 2017

    US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.

    Open source URL
  42. [42]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  43. [43]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  44. [44]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  45. [45]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  46. [46]
    MAR10135536-B

    US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved August 15, 2024.

    Open source URL
  47. [47]
    US-CERT Bankshot Dec 2017

    US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.

    Open source URL
  48. [48]
    US-CERT Bankshot Dec 2017

    US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.

    Open source URL
  49. [49]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  50. [50]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  51. [51]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  52. [52]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  53. [53]
    US-CERT Bankshot Dec 2017

    US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.

    Open source URL
  54. [54]
    US-CERT Bankshot Dec 2017

    US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.

    Open source URL
  55. [55]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  56. [56]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  57. [57]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  58. [58]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  59. [59]
    US-CERT Bankshot Dec 2017

    US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.

    Open source URL
  60. [60]
    US-CERT Bankshot Dec 2017

    US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.

    Open source URL
  61. [61]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  62. [62]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  63. [63]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  64. [64]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
  65. [65]
    US-CERT Bankshot Dec 2017

    US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.

    Open source URL
  66. [66]
    US-CERT Bankshot Dec 2017

    US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.

    Open source URL
  67. [67]
    US-CERT Bankshot Dec 2017

    US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.

    Open source URL
  68. [68]
    US-CERT Bankshot Dec 2017

    US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.

    Open source URL
  69. [69]
    McAfee Bankshot

    Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use