LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0284: More_eggs

More_eggs is a JScript backdoor used by Cobalt Group and FIN6. Its name was given based on the variable "More_eggs" being present in its code. There are at least two different versions of the backdoor being used, version 2.0 and version 4.4. [1][2]

EnterpriseS0284MalwareObject v3.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

More_eggs is a Windows JScript backdoor associated in ATT&CK with financially motivated groups including FIN6, Cobalt Group, and Evilnum. Its business significance is not just “malware exists”; the mapped behaviors show a backdoor that can discover host, user, network, and security-tool context, communicate over web protocols, transfer additional tools, and use obfuscation or trusted Windows components such as Regsvr32 to make response harder.

Executive priority

Prioritize this as a validation scenario for Windows endpoint resilience, payment/financial operations exposure, and SOC readiness. The related groups are described by ATT&CK as financially motivated, with FIN6 linked to payment card theft and PoS compromise, and Cobalt Group linked to financial institution targeting. Leaders should ask whether critical Windows environments have enough endpoint, process, file, and network evidence to reconstruct discovery, C2, tool transfer, and cleanup activity if a More_eggs-like backdoor is found.

Technical view

ATT&CK provides no official detection text for More_eggs, so defenders should validate coverage through its mapped behaviors rather than a single malware signature. On Windows, focus on JScript/backdoor execution context, command-shell activity, Regsvr32 proxy execution, system/user/network/security software discovery, encoded or encrypted artifacts, web-protocol C2 patterns, ingress tool transfer, and file deletion. Because several related techniques are broader than Windows in ATT&CK, scope testing to the object-supported platform first: Windows.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry, especially cmd.exe and regsvr32.exe activity
  • Script execution evidence relevant to JScript-based malware
  • File creation, modification, deletion, and encoded/encrypted artifact observations
  • Network connection and web proxy/DNS logs for outbound HTTP/S or other web-protocol communications
  • Host discovery command output or execution traces for system, user, network, and security software enumeration

Detection direction

  • Do not rely only on static malware names; tune detections around the ATT&CK-mapped behaviors: discovery, Windows command shell execution, Regsvr32 abuse, web-protocol C2, standard encoding, symmetric cryptography indicators, ingress tool transfer, and file deletion.
  • Correlate short sequences: script execution or Regsvr32 activity followed by discovery commands, outbound web traffic, file downloads, and cleanup. This sequence-based view can reduce false positives from legitimate administration.
  • Baseline legitimate Regsvr32, cmd.exe, and web traffic patterns on critical Windows systems before using high-severity alerts, because these tools and protocols may be used legitimately.
  • Validate whether security software discovery is visible; gaps here matter because the mapped behavior indicates adversaries may check installed defensive tooling before follow-on actions.
  • Preserve enough proxy, DNS, endpoint, and file telemetry for incident response, since encoded/encrypted traffic and file deletion can reduce post-incident evidence.

Mitigation priorities

  • Ensure critical Windows endpoints are covered by endpoint logging and response controls capable of recording process, script, file, and network activity.
  • Restrict and monitor abuse-prone native utilities such as Regsvr32 and command shell where business operations allow.
  • Harden egress controls and web proxy inspection for unusual outbound web-protocol communications from endpoints that should not initiate them.
  • Improve control validation for discovery behavior: user, system, network configuration, and security software enumeration should be observable and triaged in context.
  • Maintain incident response playbooks for backdoor findings that include host isolation, evidence preservation, review of downloaded tools, cleanup verification, and scoping across payment or financial operations where relevant.
Additional notes and limits

The most useful defensive framing is behavior-chain validation. More_eggs is described as a JScript backdoor with at least versions 2.0 and 4.4, and ATT&CK relationships map it to discovery, execution, command-and-control, stealth, and defense-impairment techniques. The FIN6, Cobalt Group, and Evilnum relationships justify financial-risk prioritization, but local exposure depends on the organization’s Windows estate and telemetry quality.

MITRE does not provide official detection guidance in the supplied object, and the object itself lists no tactics. Technique relationships provide defensive direction, but they do not prove activity in any specific environment. No active exploitation, customer exposure, or guaranteed detection coverage should be inferred from this object alone.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

More_eggs

More_eggs is a JScript backdoor used by Cobalt Group and FIN6. Its name was given based on the variable "More_eggs" being present in its code. There are at least two different versions of the backdoor being used, version 2.0 and version 4.4. [1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

15 rows
DomainIDNameRelationship / procedure
EnterpriseT1105Ingress Tool Transfer

More_eggs can download and launch additional payloads.[1][2]

EnterpriseT1016.001Internet Connection DiscoverySub-technique

More_eggs has used HTTP GET requests to check internet connectivity.[2]

EnterpriseT1140Deobfuscate/Decode Files or Information

More_eggs will decode malware components that are then dropped to the system.[2]

EnterpriseT1082System Information Discovery

More_eggs has the capability to gather the OS version and computer name.[1][2]

EnterpriseT1071.001Web ProtocolsSub-technique

More_eggs uses HTTPS for C2.[1][2]

EnterpriseT1573.001Symmetric CryptographySub-technique

More_eggs has used an RC4-based encryption method for its C2 communications.[2]

EnterpriseT1059.003Windows Command ShellSub-technique

More_eggs has used cmd.exe for execution.[2][3]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

More_eggs's payload has been encrypted with a key that has the hostname and processor family information appended to the end.[3]

EnterpriseT1070.004File DeletionSub-technique

More_eggs can remove itself from a system.[1][2]

EnterpriseT1016System Network Configuration Discovery

More_eggs has the capability to gather the IP address from the victim's machine.[1]

EnterpriseT1132.001Standard EncodingSub-technique

More_eggs has used basE91 encoding, along with encryption, for C2 communication.[2]

EnterpriseT1518.001Security Software DiscoverySub-technique

More_eggs can obtain information on installed anti-malware programs.[1]

EnterpriseT1553.002Code SigningSub-technique

More_eggs has used a signed binary shellcode loader and a signed Dynamic Link Library (DLL) to create a reverse shell.[2]

EnterpriseT1218.010Regsvr32Sub-technique

More_eggs has used regsvr32.exe to execute the malicious DLL.[2]

EnterpriseT1033System Owner/User Discovery

More_eggs has the capability to gather the username from the victim's machine.[1][2]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0037: FIN6

FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.[1][2]

GroupEnterprise

G0080: Cobalt Group

Cobalt Group is a financially motivated threat group that has primarily targeted financial institutions since at least 2016. The group has conducted intrusions to steal money via targeting ATM systems, card processing, payment systems and SWIFT systems. Cobalt Group has mainly targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. The group has been known to target organizations in order to use their access to then compromise additional victims.[1][2][3][4][5][6][7] Reporting indicates there may be links between Cobalt Group and both the malware Carbanak and the group Carbanak.[8]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1016.001: Internet Connection DiscoveryEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · GroupG0120: EvilnumEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · GroupG0037: FIN6Enterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · GroupG0080: Cobalt GroupEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · TechniqueT1553.002: Code SigningEnterpriseuses · TechniqueT1218.010: Regsvr32Enterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
3.1
Created
Modified
Raw hash
bc783d3d9f6ceebc...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.13.1Current bundlebc783d3d9f6c…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  2. [2]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  3. [3]
    ESET EvilNum July 2020

    Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.

    Open source URL
  4. [4]
    Visa FIN6 Feb 2019

    Visa Public. (2019, February). FIN6 Cybercrime Group Expands Threat to eCommerce Merchants. Retrieved September 16, 2019.

    Open source URL
  5. [5]
    Crowdstrike GTR2020 Mar 2020

    Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.

    Open source URL
  6. [6]
    Crowdstrike GTR2020 Mar 2020

    Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.

    Open source URL
  7. [7]
    Crowdstrike GTR2020 Mar 2020

    Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.

    Open source URL
  8. [8]
    ESET EvilNum July 2020

    Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.

    Open source URL
  9. [9]
    ESET EvilNum July 2020

    Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.

    Open source URL
  10. [10]
    More_eggs

    (Citation: Talos Cobalt Group July 2018)(Citation: ESET EvilNum July 2020)

  11. [11]
    More_eggs

    (Citation: Talos Cobalt Group July 2018)(Citation: ESET EvilNum July 2020)

  12. [12]
    More_eggs

    (Citation: Talos Cobalt Group July 2018)(Citation: ESET EvilNum July 2020)

  13. [13]
    SKID

    (Citation: Crowdstrike GTR2020 Mar 2020)

  14. [14]
    SKID

    (Citation: Crowdstrike GTR2020 Mar 2020)

  15. [15]
    SKID

    (Citation: Crowdstrike GTR2020 Mar 2020)

  16. [16]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  17. [17]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  18. [18]
    SpicyOmelette

    (Citation: Security Intelligence More Eggs Aug 2019)

  19. [19]
    SpicyOmelette

    (Citation: Security Intelligence More Eggs Aug 2019)

  20. [20]
    SpicyOmelette

    (Citation: Security Intelligence More Eggs Aug 2019)

  21. [21]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  22. [22]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  23. [23]
    Terra Loader

    (Citation: Security Intelligence More Eggs Aug 2019)(Citation: Visa FIN6 Feb 2019)

  24. [24]
    Terra Loader

    (Citation: Security Intelligence More Eggs Aug 2019)(Citation: Visa FIN6 Feb 2019)

  25. [25]
    Terra Loader

    (Citation: Security Intelligence More Eggs Aug 2019)(Citation: Visa FIN6 Feb 2019)

  26. [26]
    Visa FIN6 Feb 2019

    Visa Public. (2019, February). FIN6 Cybercrime Group Expands Threat to eCommerce Merchants. Retrieved September 16, 2019.

    Open source URL
  27. [27]
    Visa FIN6 Feb 2019

    Visa Public. (2019, February). FIN6 Cybercrime Group Expands Threat to eCommerce Merchants. Retrieved September 16, 2019.

    Open source URL
  28. [28]
    mitre-attackS0284
    Open source URL
  29. [29]
    mitre-attackS0284
    Open source URL
  30. [30]
    mitre-attackS0284
    Open source URL
  31. [31]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  32. [32]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  33. [33]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  34. [34]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  35. [35]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  36. [36]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  37. [37]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  38. [38]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  39. [39]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  40. [40]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  41. [41]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  42. [42]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  43. [43]
    ESET EvilNum July 2020

    Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.

    Open source URL
  44. [44]
    ESET EvilNum July 2020

    Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.

    Open source URL
  45. [45]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  46. [46]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  47. [47]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  48. [48]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  49. [49]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  50. [50]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  51. [51]
    ESET EvilNum July 2020

    Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.

    Open source URL
  52. [52]
    ESET EvilNum July 2020

    Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.

    Open source URL
  53. [53]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  54. [54]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  55. [55]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  56. [56]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  57. [57]
    Visa FIN6 Feb 2019

    Visa Public. (2019, February). FIN6 Cybercrime Group Expands Threat to eCommerce Merchants. Retrieved September 16, 2019.

    Open source URL
  58. [58]
    Visa FIN6 Feb 2019

    Visa Public. (2019, February). FIN6 Cybercrime Group Expands Threat to eCommerce Merchants. Retrieved September 16, 2019.

    Open source URL
  59. [59]
    ESET EvilNum July 2020

    Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.

    Open source URL
  60. [60]
    ESET EvilNum July 2020

    Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.

    Open source URL
  61. [61]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  62. [62]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  63. [63]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  64. [64]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  65. [65]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  66. [66]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  67. [67]
    Crowdstrike GTR2020 Mar 2020

    Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.

    Open source URL
  68. [68]
    Crowdstrike GTR2020 Mar 2020

    Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.

    Open source URL
  69. [69]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  70. [70]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  71. [71]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  72. [72]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  73. [73]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  74. [74]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  75. [75]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  76. [76]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  77. [77]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  78. [78]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  79. [79]
    Security Intelligence More Eggs Aug 2019

    Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.

    Open source URL
  80. [80]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use