S0516: SoreFang

Glexia publishes ATT&CK takes only after source-hash and schema validation. Until then, use the official MITRE definition below and the defensive relationship context on this page.

Official MITRE ATT&CK definition

SoreFang

SoreFang is first stage downloader used by APT29 for exfiltration and to load other malware.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques14 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1105	Ingress Tool Transfer	SoreFang can download additional payloads from C2.[2][1]
Enterprise	T1087.002	Domain AccountSub-technique	SoreFang can enumerate domain accounts via `net.exe user /domain`.[2]
Enterprise	T1057	Process Discovery	SoreFang can enumerate processes on a victim machine through use of Tasklist.[2]
Enterprise	T1083	File and Directory Discovery	SoreFang has the ability to list directories.[2]
Enterprise	T1071.001	Web ProtocolsSub-technique	SoreFang can use HTTP in C2 communications.[2][1]
Enterprise	T1190	Exploit Public-Facing Application	SoreFang can gain access by exploiting a Sangfor SSL VPN vulnerability that allows for the placement and delivery of malicious update binaries.[2]
Enterprise	T1053.005	Scheduled TaskSub-technique	SoreFang can gain persistence through use of scheduled tasks.[2]
Enterprise	T1082	System Information Discovery	SoreFang can collect the hostname, operating system configuration, and product ID on victim machines by executing Systeminfo.[2]
Enterprise	T1087.001	Local AccountSub-technique	SoreFang can collect usernames from the local system via `net.exe user`.[2]
Enterprise	T1069.002	Domain GroupsSub-technique	SoreFang can enumerate domain groups by executing `net.exe group /domain`.[2]
Enterprise	T1016	System Network Configuration Discovery	SoreFang can collect the TCP/IP, DNS, DHCP, and network adapter configuration on a compromised host via `ipconfig.exe /all`.[2]
Enterprise	T1680	Local Storage Discovery	SoreFang can collect disk space information on victim machines by executing Systeminfo.[2]
Enterprise	T1027	Obfuscated Files or Information	SoreFang has the ability to encode and RC6 encrypt data sent to C2.[2]
Enterprise	T1140	Deobfuscate/Decode Files or Information	SoreFang can decode and decrypt exfiltrated data sent to C2.[2]

Associated objects

Groups, software, and campaigns

G0016: APT29

APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).[1][2] They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015.[3][4][5][6]

In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes.[7][8] Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.[9][10][11][12][13][14]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 20.0
Object version: 1.1
Created: Sep 29, 2020, 19:33 UTC (UTC+00:00)
Modified: Oct 22, 2025, 02:39 UTC (UTC+00:00)
Raw hash: 471ee3c54f0a0d5b...

Imported snapshots across ATT&CK releases(3)

Release	Bundle imported	Object version	Modified	Status	Raw hash
20.0	Oct 18, 2026, 20:39 UTC (UTC+00:00)	1.1	Oct 22, 2025, 02:39 UTC (UTC+00:00)	Current bundle	`471ee3c54f0a…`
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.1	Oct 22, 2025, 02:39 UTC (UTC+00:00)	Older bundle	`471ee3c54f0a…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.1	Oct 22, 2025, 02:39 UTC (UTC+00:00)	Older bundle	`471ee3c54f0a…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
NCSC APT29 July 2020
National Cyber Security Centre. (2020, July 16). Advisory: APT29 targets COVID-19 vaccine development. Retrieved September 29, 2020.
Open source URL
[2]
CISA SoreFang July 2016
CISA. (2020, July 16). MAR-10296782-1.v1 – SOREFANG. Retrieved September 29, 2020.
Open source URL
[3]
mitre-attackS0516
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use