LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0439: Okrum

Okrum is a Windows backdoor that has been seen in use since December 2016 with strong links to Ke3chang.[1]

EnterpriseS0439MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Okrum is a Windows backdoor documented by ATT&CK with strong links to Ke3chang. Its decision value is not just the malware name; the mapped behaviors show a backdoor that can support credential access, discovery, persistence through scheduled tasks, command execution, covert command-and-control, tool transfer, and exfiltration over its C2 channel. For leaders, this makes Okrum relevant to questions about how quickly the organization can detect and contain a compromised Windows endpoint before credentials, internal topology, and data access are used for follow-on activity.

Executive priority

Prioritize validation of Windows endpoint visibility, credential-theft defenses, and network monitoring for disguised web/C2 traffic. The relationship to Ke3chang is relevant for threat intelligence and risk briefings, especially for organizations in sectors or regions named in ATT&CK’s Ke3chang description, but local exposure should be confirmed with internal intelligence and telemetry. This object is also useful for audit and resilience discussions: can the organization prove it monitors scheduled tasks, LSASS access, command shell execution, suspicious discovery, file deletion, and outbound web traffic that may carry encoded or obfuscated data?

Technical view

ATT&CK does not provide an official detection section for Okrum, so SOC and detection engineering should pivot from the malware-to-technique relationships. Validate Windows coverage for scheduled task creation or modification, cmd.exe execution, LSASS memory access, cached credential access attempts, token impersonation indicators, keylogging-related behavior, file and directory discovery, user and system discovery, network configuration and connection discovery, file deletion, tool ingress, and outbound C2 over web protocols. Network detections should account for protocol/service impersonation, standard encoding, data obfuscation, external proxy use, steganography-related content handling, and exfiltration over the same C2 channel.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry
  • Windows scheduled task creation, modification, and execution logs
  • Security events and EDR signals for LSASS access, token impersonation, cached credential access, and keylogging-like behavior
  • File creation, deletion, rename, and directory enumeration telemetry
  • User, host, system time, network configuration, and network connection discovery evidence

Detection direction

  • Build behavior-based detections around the related ATT&CK techniques rather than relying on an Okrum-specific signature, because no official ATT&CK detection text is provided.
  • Tune Windows scheduled task detections to distinguish administrative automation from unusual task names, locations, or execution chains consistent with masquerading.
  • Correlate command shell execution with discovery commands, credential access signals, file deletion, and outbound network activity to reduce false positives from routine administration.
  • Review outbound web traffic analytics for unusual destinations, encoded payload patterns, protocol or service impersonation, proxy chaining, and possible C2/exfiltration over established channels.
  • Validate that EDR or equivalent telemetry can observe sensitive access to LSASS and token impersonation attempts; absence of this telemetry is a material blind spot for this behavior set.

Mitigation priorities

  • Harden Windows endpoints first: restrict unnecessary administrative privileges, protect credential material, and monitor or limit access to LSASS where operationally feasible.
  • Control persistence paths by governing scheduled task creation and regularly reviewing task names, descriptions, authors, and execution targets for masquerading.
  • Improve egress control and monitoring for web protocols, external proxy use, and outbound connections that can carry C2 or exfiltrated data.
  • Strengthen least privilege and identity monitoring so credential theft or token abuse does not automatically become broad lateral access.
  • Ensure incident response playbooks collect endpoint, credential, scheduled task, and network artifacts quickly enough to assess discovery, exfiltration, and cleanup behavior.
Additional notes and limits

This take is based on ATT&CK S0439, its official description, the ESET external reference, and supplied relationships showing Okrum uses multiple ATT&CK techniques. The malware object itself has no ATT&CK tactics listed and no official detection guidance, so the practical guidance is relationship-driven and should be validated against local Windows architecture, logging maturity, and business risk.

No active exploitation, current campaign activity, customer exposure, or guaranteed detection coverage is stated in the supplied fields. ATT&CK provides only a high-level Okrum description and relationship mappings here; local telemetry, malware analysis, and incident evidence are required for confident detection, scoping, and attribution.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Okrum

Okrum is a Windows backdoor that has been seen in use since December 2016 with strong links to Ke3chang.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

34 rows
DomainIDNameRelationship / procedure
EnterpriseT1003.005Cached Domain CredentialsSub-technique

Okrum was seen using modified Quarks PwDump to perform credential dumping.[1]

EnterpriseT1547.009Shortcut ModificationSub-technique

Okrum can establish persistence by creating a .lnk shortcut to itself in the Startup folder.[1]

EnterpriseT1560.001Archive via UtilitySub-technique

Okrum was seen using a RAR archiver tool to compress/decompress data.[1]

EnterpriseT1497.001System ChecksSub-technique

Okrum's loader can check the amount of physical memory and terminates itself if the host has less than 1.5 Gigabytes of physical memory in total.[1]

EnterpriseT1497.002User Activity Based ChecksSub-technique

Okrum loader only executes the payload after the left mouse button has been pressed at least three times, in order to avoid being executed within virtualized or emulated environments.[1]

EnterpriseT1105Ingress Tool Transfer

Okrum has built-in commands for uploading, downloading, and executing files to the system.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

Okrum's backdoor has used cmd.exe to execute arbitrary commands as well as batch scripts to update itself to a newer version.[1]

EnterpriseT1497.003Time Based ChecksSub-technique

Okrum's loader can detect presence of an emulator by using two calls to GetTickCount API, and checking whether the time has been accelerated.[1]

EnterpriseT1543.003Windows ServiceSub-technique

To establish persistence, Okrum can install itself as a new service named NtmSsvc.[1]

EnterpriseT1016System Network Configuration Discovery

Okrum can collect network information, including the host IP address, DNS, and proxy information.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

Okrum uses HTTP for communication with its C2.[1]

EnterpriseT1001Data Obfuscation

Okrum leverages the HTTP protocol for C2 communication, while hiding the actual messages in the Cookie and Set-Cookie headers of the HTTP requests.[1]

EnterpriseT1053.005Scheduled TaskSub-technique

Okrum's installer can attempt to achieve persistence by creating a scheduled task.[1]

EnterpriseT1027.003SteganographySub-technique

Okrum's payload is encrypted and embedded within its loader, or within a legitimate PNG file.[1]

EnterpriseT1036.004Masquerade Task or ServiceSub-technique

Okrum can establish persistence by adding a new service NtmsSvc with the display name Removable Storage to masquerade as a legitimate Removable Storage Manager.[1]

EnterpriseT1033System Owner/User Discovery

Okrum can collect the victim username.[1]

EnterpriseT1082System Information Discovery

Okrum can collect computer name, locale information, and information about the OS and architecture.[1]

EnterpriseT1041Exfiltration Over C2 Channel

Data exfiltration is done by Okrum using the already opened channel with the C2 server.[1]

EnterpriseT1132.001Standard EncodingSub-technique

Okrum has used base64 to encode C2 communication.[1]

EnterpriseT1569.002Service ExecutionSub-technique

Okrum's loader can create a new service named NtmsSvc to execute the payload.[1]

EnterpriseT1134.001Token Impersonation/TheftSub-technique

Okrum can impersonate a logged-on user's security context using a call to the ImpersonateLoggedOnUser API.[1]

EnterpriseT1083File and Directory Discovery

Okrum has used DriveLetterView to enumerate drive information.[1]

EnterpriseT1564.001Hidden Files and DirectoriesSub-technique

Before exfiltration, Okrum's backdoor has used hidden files to store logs and outputs from backdoor commands.[1]

EnterpriseT1090.002External ProxySub-technique

Okrum can identify proxy servers configured and used by the victim, and use it to make HTTP requests to C2 its server.[1]

EnterpriseT1573.001Symmetric CryptographySub-technique

Okrum uses AES to encrypt network traffic. The key can be hardcoded or negotiated with the C2 server in the registration phase. [1]

EnterpriseT1140Deobfuscate/Decode Files or Information

Okrum's loader can decrypt the backdoor code, embedded within the loader or within a legitimate PNG file. A custom XOR cipher or RC4 is used for decryption.[1]

EnterpriseT1070.004File DeletionSub-technique

Okrum's backdoor deletes files after they have been successfully uploaded to C2 servers.[1]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Okrum establishes persistence by creating a .lnk shortcut to itself in the Startup folder.[1]

EnterpriseT1049System Network Connections Discovery

Okrum was seen using NetSess to discover NetBIOS sessions.[1]

EnterpriseT1560.003Archive via Custom MethodSub-technique

Okrum has used a custom implementation of AES encryption to encrypt collected data.[1]

EnterpriseT1056.001KeyloggingSub-technique

Okrum was seen using a keylogger tool to capture keystrokes. [1]

EnterpriseT1124System Time Discovery

Okrum can obtain the date and time of the compromised system.[1]

EnterpriseT1003.001LSASS MemorySub-technique

Okrum was seen using MimikatzLite to perform credential dumping.[1]

EnterpriseT1001.003Protocol or Service ImpersonationSub-technique

Okrum leverages the HTTP protocol for C2 communication, while hiding the actual messages in the Cookie and Set-Cookie headers of the HTTP requests.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0004: Ke3chang

Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.[1][2][3][4]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1003.005: Cached Domain CredentialsEnterpriseuses · TechniqueT1547.009: Shortcut ModificationEnterpriseuses · TechniqueT1560.001: Archive via UtilityEnterpriseuses · GroupG0004: Ke3changEnterpriseuses · TechniqueT1497.001: System ChecksEnterpriseuses · TechniqueT1497.002: User Activity Based ChecksEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1497.003: Time Based ChecksEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1001: Data ObfuscationEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1027.003: SteganographyEnterpriseuses · TechniqueT1036.004: Masquerade Task or ServiceEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1569.002: Service ExecutionEnterpriseuses · TechniqueT1134.001: Token Impersonation/TheftEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1564.001: Hidden Files and DirectoriesEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
c0f051c7ee8422c4...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundlec0f051c7ee84…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  2. [2]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  3. [3]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  4. [4]
    mitre-attackS0439
    Open source URL
  5. [5]
    mitre-attackS0439
    Open source URL
  6. [6]
    mitre-attackS0439
    Open source URL
  7. [7]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  8. [8]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  9. [9]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  10. [10]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  11. [11]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  12. [12]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  13. [13]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  14. [14]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  15. [15]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  16. [16]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  17. [17]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  18. [18]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  19. [19]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  20. [20]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  21. [21]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  22. [22]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  23. [23]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  24. [24]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  25. [25]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  26. [26]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  27. [27]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  28. [28]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  29. [29]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  30. [30]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  31. [31]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  32. [32]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  33. [33]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  34. [34]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  35. [35]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  36. [36]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  37. [37]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  38. [38]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  39. [39]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  40. [40]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  41. [41]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  42. [42]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  43. [43]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  44. [44]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  45. [45]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  46. [46]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  47. [47]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  48. [48]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  49. [49]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  50. [50]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  51. [51]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  52. [52]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  53. [53]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  54. [54]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  55. [55]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  56. [56]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  57. [57]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  58. [58]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  59. [59]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  60. [60]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  61. [61]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  62. [62]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  63. [63]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  64. [64]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  65. [65]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  66. [66]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  67. [67]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  68. [68]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  69. [69]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  70. [70]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  71. [71]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  72. [72]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
  73. [73]
    ESET Okrum July 2019

    Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use