LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0615: SombRAT

SombRAT is a modular backdoor written in C++ that has been used since at least 2019 to download and execute malicious payloads, including FIVEHANDS ransomware.[1][2][3]

EnterpriseS0615MalwareObject v1.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

SombRAT matters because MITRE describes it as a Windows modular C++ backdoor used to download and execute additional payloads, including FIVEHANDS ransomware. For leaders, the decision point is not just “can we find SombRAT,” but whether endpoint, DNS, network, and incident-response processes can recognize a backdoor that performs discovery, stages and exfiltrates data, hides artifacts, and brings in follow-on tooling.

Executive priority

Prioritize SombRAT as a resilience and response-readiness scenario: a backdoor with collection, command-and-control, stealth, ingress tool transfer, and exfiltration behaviors can become the control point for broader intrusion activity. Executives should ask whether Windows endpoint visibility, DNS monitoring, egress controls, data-staging detection, and ransomware response playbooks are evidenced and tested—not assumed. The relationship to the CostaRicto campaign and references to FIVEHANDS make this especially relevant for organizations validating preparedness against financially motivated or espionage-linked intrusions, while avoiding any assumption of current exposure without local evidence.

Technical view

For SOC, detection engineering, and IR teams, validate coverage around the behaviors ATT&CK associates with SombRAT: Windows host discovery, process and service enumeration, file and directory discovery, user and system information discovery, local data collection/staging, custom archiving, C2 over DNS or non-application-layer protocols, proxy use, encrypted C2, DGA-style destination selection, ingress tool transfer, DLL injection, masquerading, argument spoofing, deobfuscation, and file deletion. Because MITRE provides no official detection text for this software, coverage should be behavior-led and correlated across endpoint process/memory telemetry, file activity, DNS/network logs, and egress events rather than dependent on a single malware signature.

Likely telemetry

  • Windows endpoint process creation and parent/child process relationships
  • Command-line and process argument telemetry, with awareness that argument spoofing may reduce reliability
  • DLL load, remote thread, memory allocation, and process injection indicators where available
  • Windows service, process, user, system, file, and directory discovery events
  • File creation, modification, staging, archiving, decoding/deobfuscation, and deletion activity

Detection direction

  • Build behavior chains rather than one-off alerts: discovery followed by local staging or archiving, then unusual egress is more decision-useful than any single command or file event.
  • Tune DNS analytics for high-volume, algorithmic, rare, or newly observed domains, while accounting for legitimate dynamic DNS, CDN, and security-product traffic.
  • Validate endpoint visibility for injection and masquerading behaviors, especially where process names, file paths, metadata, or command-line arguments appear benign but memory or load behavior is abnormal.
  • Correlate file deletion after payload transfer, collection, or staging as potential cleanup activity; avoid treating deletion alone as conclusive.
  • Hunt for unexpected encrypted outbound sessions or non-standard protocol usage from Windows endpoints that do not normally generate such traffic.

Mitigation priorities

  • Start with visibility: ensure Windows endpoint, DNS, network egress, and file activity telemetry are collected and retained long enough for intrusion reconstruction.
  • Constrain outbound communications with egress filtering, DNS governance, and proxy controls appropriate to business operations.
  • Harden endpoints against unauthorized payload execution and tool transfer through application control, least privilege, and controlled administrative pathways.
  • Improve detection and response for data staging, archiving, and exfiltration behaviors, including playbooks for rapid containment when C2 and collection are both observed.
  • Test ransomware-adjacent response processes because MITRE notes SombRAT has been used to download and execute payloads including FIVEHANDS ransomware.
Additional notes and limits

This take is based only on the supplied ATT&CK object, external references, and relationships. The most useful defender interpretation is behavior-centric: SombRAT is represented as a Windows backdoor with relationships spanning discovery, collection, stealth, command-and-control, ingress tool transfer, and exfiltration. The CostaRicto campaign relationship supplies historical context, not proof of current activity in any environment.

MITRE provides no official detection text, no explicit tactics on the malware object itself, and no local indicators, hashes, infrastructure, or prevalence data in the supplied fields. Technique relationships include platforms broader than SombRAT’s listed Windows platform; local validation should focus first on Windows while using the related techniques to guide behavior analytics. Any exposure, attribution, or active exploitation assessment requires environment-specific evidence.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

SombRAT

SombRAT is a modular backdoor written in C++ that has been used since at least 2019 to download and execute malicious payloads, including FIVEHANDS ransomware.[1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

24 rows
DomainIDNameRelationship / procedure
EnterpriseT1573.002Asymmetric CryptographySub-technique

SombRAT can SSL encrypt C2 traffic.[1][2][3]

EnterpriseT1124System Time Discovery

SombRAT can execute getinfo to discover the current time on a compromised host.[1][3]

EnterpriseT1057Process Discovery

SombRAT can use the getprocesslist command to enumerate processes on a compromised host.[1][2][3]

EnterpriseT1090Proxy

SombRAT has the ability to use an embedded SOCKS proxy in C2 communications.[3]

EnterpriseT1140Deobfuscate/Decode Files or Information

SombRAT can run upload to decrypt and upload files from storage.[1][3]

EnterpriseT1005Data from Local System

SombRAT has collected data and files from a compromised host.[1][3]

EnterpriseT1106Native API

SombRAT has the ability to respawn itself using ShellExecuteW and CreateProcessW.[1]

EnterpriseT1027Obfuscated Files or Information

SombRAT can encrypt strings with XOR-based routines and use a custom AES storage format for plugins, configuration, C2 domains, and harvested data.[1][2][3]

EnterpriseT1070.004File DeletionSub-technique

SombRAT has the ability to run cancel or closeanddeletestorage to remove all files from storage and delete the storage temp file on a compromised host.[1]

EnterpriseT1105Ingress Tool Transfer

SombRAT has the ability to download and execute additional payloads.[1][2][3]

EnterpriseT1095Non-Application Layer Protocol

SombRAT has the ability to use TCP sockets to send data and ICMP to ping the C2 server.[1][2]

EnterpriseT1564.010Process Argument SpoofingSub-technique

SombRAT has the ability to modify its process memory to hide process command-line arguments.[2]

EnterpriseT1033System Owner/User Discovery

SombRAT can execute getinfo to identify the username on a compromised host.[1][3]

EnterpriseT1560.003Archive via Custom MethodSub-technique

SombRAT has encrypted collected data with AES-256 using a hardcoded key.[1]

EnterpriseT1573.001Symmetric CryptographySub-technique

SombRAT has encrypted its C2 communications with AES.[1]

EnterpriseT1041Exfiltration Over C2 Channel

SombRAT has uploaded collected data and files from a compromised host to its C2 server.[1]

EnterpriseT1071.004DNSSub-technique

SombRAT can communicate over DNS with the C2 server.[1][2]

EnterpriseT1074.001Local Data StagingSub-technique

SombRAT can store harvested data in a custom database under the %TEMP% directory.[1]

EnterpriseT1568.002Domain Generation AlgorithmsSub-technique

SombRAT can use a custom DGA to generate a subdomain for C2.[1]

EnterpriseT1007System Service Discovery

SombRAT can enumerate services on a victim machine.[1]

EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

SombRAT can execute loadfromfile, loadfromstorage, and loadfrommem to inject a DLL from disk, storage, or memory respectively.[1]

EnterpriseT1083File and Directory Discovery

SombRAT can execute enum to enumerate files in storage on a compromised system.[1]

EnterpriseT1036Masquerading

SombRAT can use a legitimate process name to hide itself.[3]

EnterpriseT1082System Information Discovery

SombRAT can execute getinfo to enumerate the computer name and OS version of a compromised system.[1]

Associated objects

Groups, software, and campaigns

CampaignEnterprise

C0004: CostaRicto

CostaRicto was a suspected hacker-for-hire cyber espionage campaign that targeted multiple industries worldwide, with a large number being financial institutions. CostaRicto actors targeted organizations in Europe, the Americas, Asia, Australia, and Africa, with a large concentration in South Asia (especially India, Bangladesh, and Singapore), using custom malware, open source tools, and a complex network of proxies and SSH tunnels.[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1573.002: Asymmetric CryptographyEnterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1090: ProxyEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · CampaignC0004: CostaRictoEnterpriseuses · TechniqueT1095: Non-Application Layer ProtocolEnterpriseuses · TechniqueT1564.010: Process Argument SpoofingEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1560.003: Archive via Custom MethodEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1071.004: DNSEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterpriseuses · TechniqueT1568.002: Domain Generation AlgorithmsEnterpriseuses · TechniqueT1007: System Service DiscoveryEnterpriseuses · TechniqueT1055.001: Dynamic-link Library InjectionEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1036: MasqueradingEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
03901d19a120dad6...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.2Current bundle03901d19a120…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  2. [2]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  3. [3]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  4. [4]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  5. [5]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  6. [6]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  7. [7]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  8. [8]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  9. [9]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  10. [10]
    mitre-attackS0615
    Open source URL
  11. [11]
    mitre-attackS0615
    Open source URL
  12. [12]
    mitre-attackS0615
    Open source URL
  13. [13]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  14. [14]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  15. [15]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  16. [16]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  17. [17]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  18. [18]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  19. [19]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  20. [20]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  21. [21]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  22. [22]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  23. [23]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  24. [24]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  25. [25]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  26. [26]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  27. [27]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  28. [28]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  29. [29]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  30. [30]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  31. [31]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  32. [32]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  33. [33]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  34. [34]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  35. [35]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  36. [36]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  37. [37]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  38. [38]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  39. [39]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  40. [40]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  41. [41]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  42. [42]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  43. [43]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  44. [44]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  45. [45]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  46. [46]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  47. [47]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  48. [48]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  49. [49]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  50. [50]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  51. [51]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  52. [52]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  53. [53]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  54. [54]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  55. [55]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  56. [56]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  57. [57]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  58. [58]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  59. [59]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  60. [60]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  61. [61]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  62. [62]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  63. [63]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  64. [64]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  65. [65]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  66. [66]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  67. [67]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  68. [68]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  69. [69]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  70. [70]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  71. [71]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  72. [72]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  73. [73]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  74. [74]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  75. [75]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  76. [76]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  77. [77]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  78. [78]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  79. [79]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  80. [80]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  81. [81]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  82. [82]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  83. [83]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  84. [84]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  85. [85]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
  86. [86]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  87. [87]
    BlackBerry CostaRicto November 2020

    The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use