LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0662: RCSession

RCSession is a backdoor written in C++ that has been in use since at least 2018 by Mustang Panda and by Threat Group-3390 (Type II Backdoor).[1][2][3]

EnterpriseS0662MalwareObject v1.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

RCSession matters because ATT&CK describes it as a Windows C++ backdoor associated with post-compromise access, collection, discovery, persistence, privilege escalation, defense evasion, and command-and-control behaviors. For leaders, the practical issue is not the malware name alone; it is whether Windows endpoint, registry, process, and network evidence would let the organization recognize and investigate a backdoor that can blend into normal administration and web traffic.

Executive priority

Treat RCSession as a validation case for Windows intrusion readiness. The ATT&CK relationships connect it to groups that have targeted government, diplomatic, NGO, defense, technology, energy, manufacturing, aerospace, and related sectors, but local risk depends on your environment and threat model. Executives should ask whether SOC coverage can reconstruct endpoint execution, persistence, C2, credential-collection risk, and data-access activity quickly enough to support containment, legal/compliance evidence, and business continuity decisions.

Technical view

RCSession is listed for Windows, with no official ATT&CK detection text. Defensive validation should therefore be built from the related techniques: command shell and native API execution, process hollowing, DLL abuse, msiexec proxy execution, registry modification and Run Key persistence, UAC bypass, masquerading, file deletion, local data collection, user/process/system discovery, keylogging, screen capture, ingress tool transfer, web-protocol C2, non-application-layer C2, encrypted channels, compression, and fileless storage. SOC and IR teams should confirm they can correlate these behaviors on Windows hosts rather than relying on a single malware signature.

Likely telemetry

  • Windows endpoint process creation, command-line, parent/child process, integrity level, and signed binary execution data
  • Registry write events, especially Run Keys, startup locations, and unusual registry-backed storage patterns
  • Module load and DLL search/path telemetry relevant to DLL abuse or side-loading investigations
  • Memory and process tampering signals consistent with process hollowing where available
  • File creation, compression/archive activity, tool transfer, and file deletion evidence

Detection direction

  • Build behavior-based detections around chains: suspicious execution followed by registry persistence, discovery, file collection, and outbound network activity.
  • Tune Windows detections for living-off-the-land abuse, especially msiexec.exe and cmd.exe, because legitimate administrative and software deployment activity can create false positives.
  • Hunt for registry modifications and startup persistence made by unusual users, unsigned or oddly located binaries, or processes with suspicious ancestry.
  • Validate visibility for process hollowing and DLL abuse; many environments log process creation but lack memory, module-load, or image-path context needed to investigate these techniques.
  • Correlate outbound HTTP/S or other protocol use with endpoint events; encrypted or web-like traffic alone is usually too noisy without host context.

Mitigation priorities

  • Prioritize Windows endpoint hardening and monitoring for execution, persistence, privilege elevation, and registry abuse.
  • Restrict unnecessary local administrator rights and validate UAC-related controls, since the related behavior includes UAC bypass and privilege-escalation patterns.
  • Use application control or execution policy where feasible to reduce abuse of unsigned, unexpected, or user-writable-path binaries and DLLs.
  • Constrain and monitor administrative utilities such as cmd.exe and msiexec.exe without disrupting approved software deployment workflows.
  • Apply egress filtering, proxy logging, and network monitoring to make C2 over web protocols or other channels easier to investigate.
Additional notes and limits

ATT&CK identifies RCSession as a C++ backdoor in use since at least 2018 by Mustang Panda and Threat Group-3390, with relationships to multiple ATT&CK techniques. The object itself has no specified tactics and no official detection guidance, so this take converts the supplied relationships into defensive validation priorities rather than asserting a specific indicator set.

This assessment is limited to the supplied ATT&CK STIX fields, external references, and relationships. It does not establish current activity, customer exposure, guaranteed detection coverage, or indicators of compromise. Local telemetry, asset criticality, sector exposure, and intelligence requirements are needed to determine priority and coverage gaps.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

RCSession

RCSession is a backdoor written in C++ that has been in use since at least 2018 by Mustang Panda and by Threat Group-3390 (Type II Backdoor).[1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

22 rows
DomainIDNameRelationship / procedure
EnterpriseT1573Encrypted Channel

RCSession can use an encrypted beacon to check in with C2.[1]

EnterpriseT1055.012Process HollowingSub-technique

RCSession can launch itself from a hollowed svchost.exe process.[1][3][4]

EnterpriseT1057Process Discovery

RCSession can identify processes based on PID.[4]

EnterpriseT1218.007MsiexecSub-technique

RCSession has the ability to execute inside the msiexec.exe process.[4]

EnterpriseT1113Screen Capture

RCSession can capture screenshots from a compromised host.[4]

EnterpriseT1056.001KeyloggingSub-technique

RCSession has the ability to capture keystrokes on a compromised host.[3][4]

EnterpriseT1105Ingress Tool Transfer

RCSession has the ability to drop additional files to an infected machine.[4]

EnterpriseT1106Native API

RCSession can use WinSock API for communication including WSASend and WSARecv.[4]

EnterpriseT1071.001Web ProtocolsSub-technique

RCSession can use HTTP in C2 communications.[3][4]

EnterpriseT1033System Owner/User Discovery

RCSession can gather system owner information, including user and administrator privileges.[4]

EnterpriseT1070.004File DeletionSub-technique

RCSession can remove files from a targeted system.[4]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

RCSession has the ability to modify a Registry Run key to establish persistence.[3][4]

EnterpriseT1027.015CompressionSub-technique

RCSession can compress and obfuscate its strings to evade detection on a compromised host.[3]

EnterpriseT1005Data from Local System

RCSession can collect data from a compromised host.[4][3]

EnterpriseT1095Non-Application Layer Protocol

RCSession has the ability to use TCP and UDP in C2 communications.[3][4]

EnterpriseT1082System Information Discovery

RCSession can gather system information from a compromised host.[4]

EnterpriseT1027.011Fileless StorageSub-technique

RCSession can store its obfuscated configuration file in the Registry under `HKLM\SOFTWARE\Plus` or `HKCU\SOFTWARE\Plus`.[3][4]

EnterpriseT1036Masquerading

RCSession has used a file named English.rtf to appear benign on victim hosts.[1][3]

EnterpriseT1112Modify Registry

RCSession can write its configuration file to the Registry.[3][4]

EnterpriseT1574.001DLLSub-technique

RCSession can be installed via DLL side-loading.[1][3][4]

EnterpriseT1059.003Windows Command ShellSub-technique

RCSession can use `cmd.exe` for execution on compromised hosts.[3]

EnterpriseT1548.002Bypass User Account ControlSub-technique

RCSession can bypass UAC to escalate privileges.[3]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0027: Threat Group-3390

Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.[1] The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.[2][3][4]

GroupEnterprise

G0129: Mustang Panda

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. [1][2][3][4][5][6][7][8][9][10][11][12][13]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1573: Encrypted ChannelEnterpriseuses · TechniqueT1055.012: Process HollowingEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1218.007: MsiexecEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · GroupG0027: Threat Group-3390Enterpriseuses · TechniqueT1027.015: CompressionEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1095: Non-Application Layer ProtocolEnterpriseuses · GroupG0129: Mustang PandaEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1027.011: Fileless StorageEnterpriseuses · TechniqueT1036: MasqueradingEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1574.001: DLLEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1548.002: Bypass User Account ControlEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
8abb8941f3632ff6...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.2Current bundle8abb8941f363…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Secureworks BRONZE PRESIDENT December 2019

    Counter Threat Unit Research Team. (2019, December 29). BRONZE PRESIDENT Targets NGOs. Retrieved April 13, 2021.

    Open source URL
  2. [2]
    Trend Micro Iron Tiger April 2021

    Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.

    Open source URL
  3. [3]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  4. [4]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  5. [5]
    Secureworks BRONZE PRESIDENT December 2019

    Counter Threat Unit Research Team. (2019, December 29). BRONZE PRESIDENT Targets NGOs. Retrieved April 13, 2021.

    Open source URL
  6. [6]
    Secureworks BRONZE PRESIDENT December 2019

    Counter Threat Unit Research Team. (2019, December 29). BRONZE PRESIDENT Targets NGOs. Retrieved April 13, 2021.

    Open source URL
  7. [7]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  8. [8]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  9. [9]
    Trend Micro Iron Tiger April 2021

    Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.

    Open source URL
  10. [10]
    Trend Micro Iron Tiger April 2021

    Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.

    Open source URL
  11. [11]
    mitre-attackS0662
    Open source URL
  12. [12]
    mitre-attackS0662
    Open source URL
  13. [13]
    mitre-attackS0662
    Open source URL
  14. [14]
    Secureworks BRONZE PRESIDENT December 2019

    Counter Threat Unit Research Team. (2019, December 29). BRONZE PRESIDENT Targets NGOs. Retrieved April 13, 2021.

    Open source URL
  15. [15]
    Secureworks BRONZE PRESIDENT December 2019

    Counter Threat Unit Research Team. (2019, December 29). BRONZE PRESIDENT Targets NGOs. Retrieved April 13, 2021.

    Open source URL
  16. [16]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  17. [17]
    Secureworks BRONZE PRESIDENT December 2019

    Counter Threat Unit Research Team. (2019, December 29). BRONZE PRESIDENT Targets NGOs. Retrieved April 13, 2021.

    Open source URL
  18. [18]
    Secureworks BRONZE PRESIDENT December 2019

    Counter Threat Unit Research Team. (2019, December 29). BRONZE PRESIDENT Targets NGOs. Retrieved April 13, 2021.

    Open source URL
  19. [19]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  20. [20]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  21. [21]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  22. [22]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  23. [23]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  24. [24]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  25. [25]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  26. [26]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  27. [27]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  28. [28]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  29. [29]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  30. [30]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  31. [31]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  32. [32]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  33. [33]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  34. [34]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  35. [35]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  36. [36]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  37. [37]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  38. [38]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  39. [39]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  40. [40]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  41. [41]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  42. [42]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  43. [43]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  44. [44]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  45. [45]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  46. [46]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  47. [47]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  48. [48]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  49. [49]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  50. [50]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  51. [51]
    Trend Micro Iron Tiger April 2021

    Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.

    Open source URL
  52. [52]
    Trend Micro Iron Tiger April 2021

    Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.

    Open source URL
  53. [53]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  54. [54]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  55. [55]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  56. [56]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  57. [57]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  58. [58]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  59. [59]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  60. [60]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  61. [61]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  62. [62]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  63. [63]
    Secureworks BRONZE PRESIDENT December 2019

    Counter Threat Unit Research Team. (2019, December 29). BRONZE PRESIDENT Targets NGOs. Retrieved April 13, 2021.

    Open source URL
  64. [64]
    Secureworks BRONZE PRESIDENT December 2019

    Counter Threat Unit Research Team. (2019, December 29). BRONZE PRESIDENT Targets NGOs. Retrieved April 13, 2021.

    Open source URL
  65. [65]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  66. [66]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  67. [67]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  68. [68]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  69. [69]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  70. [70]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  71. [71]
    Secureworks BRONZE PRESIDENT December 2019

    Counter Threat Unit Research Team. (2019, December 29). BRONZE PRESIDENT Targets NGOs. Retrieved April 13, 2021.

    Open source URL
  72. [72]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  73. [73]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  74. [74]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  75. [75]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  76. [76]
    Secureworks BRONZE PRESIDENT December 2019

    Counter Threat Unit Research Team. (2019, December 29). BRONZE PRESIDENT Targets NGOs. Retrieved April 13, 2021.

    Open source URL
  77. [77]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  78. [78]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  79. [79]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use