T1027.003: Steganography
Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files.
Duqu was an early example of malware that used steganography. It encrypted the gathered information from a victim's system and hid it within an image before exfiltrating the image to a C2 server.[1]
By the end of 2017, a threat group used Invoke-PSImage to hide PowerShell commands in an image file (.png) and execute the code on a victim's system. In this particular case the PowerShell code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary.[2]
Security context for executives and security teams
Steganography matters because it lets adversaries hide commands or stolen information inside ordinary-looking media files such as images, audio, video, or text. For leaders, the practical risk is not the image file itself; it is that normal business content and web traffic can become a carrier for malware execution, command retrieval, or exfiltration while avoiding simple file-type or signature checks.
Executive priority
Treat this as a coverage-validation issue for SOC visibility, incident response readiness, and data protection controls across Windows, macOS, and Linux. Ask whether teams can investigate suspicious media files in email, web downloads, endpoint activity, and outbound traffic, especially when those files are linked to script execution or unusual command-and-control behavior. Because ATT&CK lists multiple campaigns, groups, and malware families using this technique, it should influence detection engineering and threat-informed control testing, but it should not be treated as proof of current exposure without local evidence.
Technical view
ATT&CK defines Steganography as sub-technique T1027.003 under Obfuscated Files or Information, aligned to the stealth tactic. The supplied examples include hiding encrypted victim data in an image before exfiltration and using Invoke-PSImage to embed PowerShell commands in a PNG that can be executed on a victim system. SOC and IR teams should validate investigation paths that connect media-file acquisition or transfer with script execution, suspicious child processes, unusual network destinations, or data staging/exfiltration patterns. There is no official MITRE detection text provided, but ATT&CK includes a related detection strategy: DET0119, Detection Strategy for Steganographic Abuse in File & Script Execution.
Likely telemetry
- Endpoint process creation and parent-child process relationships, especially script interpreters such as PowerShell launched from documents, macros, downloaded content, or unusual file paths
- File creation, modification, and access telemetry for images, audio, video, and text files in user-writable locations
- Email and web gateway records for media-file attachments or downloads associated with later execution activity
- Network proxy, DNS, and outbound connection logs showing media-file retrieval or upload followed by suspicious execution or C2-like behavior
- EDR file metadata and content-inspection signals, including mismatched extensions, anomalous file sizes, entropy, or embedded payload indicators where available
Detection direction
- Prioritize behavior chains over standalone media-file alerts: media file downloaded or opened, script interpreter execution, secondary payload retrieval, and outbound communication.
- Tune detections for Invoke-PSImage-like patterns where PowerShell content is embedded in or retrieved from image files, while avoiding assumptions that every image file is malicious.
- Use the DET0119 relationship as a prompt to test whether file-and-script execution analytics exist and are producing usable evidence in the local environment.
- Account for false positives from legitimate creative, marketing, engineering, or media workflows that routinely move large or unusual media files.
- Look for gaps where encrypted web traffic, limited endpoint logging, lack of script-block visibility, or weak file telemetry prevents analysts from linking the carrier file to execution or exfiltration.
Mitigation priorities
- Harden and monitor script execution controls, especially PowerShell usage, macro-driven execution paths, and execution from user-writable directories.
- Improve attachment and download handling for documents and media files through content inspection, sandboxing where appropriate, and user-risk-based controls.
- Ensure EDR, proxy, DNS, email, and data-transfer logs are retained long enough to correlate file arrival, execution, and outbound movement during incident response.
- Apply least privilege and application control where feasible so hidden payloads embedded in benign-looking files cannot easily transition into code execution.
- Use threat-informed testing based on T1027.003 and related software examples to validate controls without assuming vendor tools will detect steganography by default.
Additional notes and limits
ATT&CK links this technique to numerous groups, campaigns, and software entries, including Operation Spalax, Operation Ghost, BRONZE BUTLER, Leviathan, APT37, MuddyWater, Tropic Trooper, APT-C-36, TA551, Andariel, Earth Lusca, PowerDuke, Invoke-PSImage, Bandook, Okrum, Ramsay, ABK, BBK, build_downer, Avenger, IcedID, and RDAT. These relationships show repeated documented use across the ATT&CK corpus, but they do not by themselves establish current targeting of any specific organization.
The official ATT&CK object provides no detection guidance, so defensive recommendations are derived from the official description, platforms, tactic, sub-technique relationship, external references, and the listed DET0119 detection-strategy relationship. Local telemetry, business workflows, and incident history are required to determine actual risk and coverage.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Steganography
Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files.
Duqu was an early example of malware that used steganography. It encrypted the gathered information from a victim's system and hid it within an image before exfiltrating the image to a C2 server.[1]
By the end of 2017, a threat group used Invoke-PSImage to hide PowerShell commands in an image file (.png) and execute the code on a victim's system. In this particular case the PowerShell code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary.[2]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1027 | Obfuscated Files or Information | This object subtechnique of Obfuscated Files or Information. |
Groups, software, and campaigns
G1006: Earth Lusca
Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some Earth Lusca operations may be financially motivated.[1]
Earth Lusca has used malware commonly used by other Chinese threat groups, including APT41 and the Winnti Group cluster, however security researchers assess Earth Lusca's techniques and infrastructure are separate.[1]
G0067: APT37
APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018.[1][2][3]
North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.
G0127: TA551
G0065: Leviathan
Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.[1] Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.[1][2][3][4]
G0069: MuddyWater
MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).[1] Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. [2][3][4][5][6][7][8][9][10][11][12][13]
G0099: APT-C-36
APT-C-36 is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. APT-C-36 has targeted government institutions and entities in the financial, energy, and professional manufacturing sectors across Colombia and other Latin American countries.[1][2][3][4]
G0138: Andariel
Andariel is a North Korean state-sponsored threat group that has been active since at least 2009. Andariel has primarily focused its operations--which have included destructive attacks--against South Korean government agencies, military organizations, and a variety of domestic companies; they have also conducted cyber financial operations against ATMs, banks, and cryptocurrency exchanges. Andariel's notable activity includes Operation Black Mine, Operation GoldenAxe, and Campaign Rifle.[1][2][3][4][5]
Andariel is considered a sub-set of Lazarus Group, and has been attributed to North Korea's Reconnaissance General Bureau.[6]
North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.
G0081: Tropic Trooper
Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.[1][2][3]
G0060: BRONZE BUTLER
BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.[1][2][3]
S0495: RDAT
S0139: PowerDuke
S0513: LiteDuke
S0470: BBK
BBK is a downloader that has been used by BRONZE BUTLER since at least 2019.[1]
S0511: RegDuke
S0471: build_downer
build_downer is a downloader that has been used by BRONZE BUTLER since at least 2019.[1]
S0439: Okrum
S0234: Bandook
Bandook is a commercially available RAT, written in Delphi and C++, that has been available since at least 2007. It has been used against government, financial, energy, healthcare, education, IT, and legal organizations in the US, South America, Europe, and Southeast Asia. Bandook has been used by Dark Caracal, as well as in a separate campaign referred to as "Operation Manul".[1][2][3]
S0659: Diavol
Diavol is a ransomware variant first observed in June 2021 that is capable of prioritizing file types to encrypt based on a pre-configured list of extensions defined by the attacker. The Diavol Ransomware-as-a Service (RaaS) program is managed by Wizard Spider and it has been observed being deployed by Bazar.[1][2][3][4]
S0458: Ramsay
S0644: ObliqueRAT
ObliqueRAT is a remote access trojan, similar to Crimson, that has been in use by Transparent Tribe since at least 2020.[1][2]
S0483: IcedID
C0005: Operation Spalax
Operation Spalax was a campaign that primarily targeted Colombian government organizations and private companies, particularly those associated with the energy and metallurgical industries. The Operation Spalax threat actors distributed commodity malware and tools using generic phishing topics related to COVID-19, banking, and law enforcement action. Security researchers noted indicators of compromise and some infrastructure overlaps with other campaigns dating back to April 2018, including at least one separately attributed to APT-C-36, however identified enough differences to report this as separate, unattributed activity.[1]
C0023: Operation Ghost
Operation Ghost was an APT29 campaign starting in 2013 that included operations against ministries of foreign affairs in Europe and the Washington, D.C. embassy of a European Union country. During Operation Ghost, APT29 used new families of malware and leveraged web services, steganography, and unique C2 infrastructure for each victim.[1]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 2.0 | Current bundle | 7841936d223e… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Wikipedia Duqu
Wikipedia. (2017, December 29). Duqu. Retrieved April 10, 2018.
Open source URL - [2]McAfee Malicious Doc Targets Pyeongchang Olympics
Saavedra-Morales, J., Sherstobitoff, R. (2018, January 6). Malicious Document Targets Pyeongchang Olympics. Retrieved April 10, 2018.
Open source URL - [3]TrendMicro EarthLusca 2022
Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.
Open source URL - [4]Unit42 RDAT July 2020
Falcone, R. (2020, July 22). OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory. Retrieved July 28, 2020.
Open source URL - [5]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [6]ESET Operation Spalax Jan 2021
M. Porolli. (2021, January 21). Operation Spalax: Targeted malware attacks in Colombia. Retrieved September 16, 2022.
Open source URL - [7]Talos Group123
Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.
Open source URL - [8]Securelist ScarCruft May 2019
GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.
Open source URL - [9]ESET Dukes October 2019
Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
Open source URL - [10]Trend Micro Tick November 2019
Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.
Open source URL - [11]ESET Okrum July 2019
Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.
Open source URL - [12]CheckPoint Bandook Nov 2020
Check Point. (2020, November 26). Bandook: Signed & Delivered. Retrieved May 31, 2021.
Open source URL - [13]Unit 42 TA551 Jan 2021
Duncan, B. (2021, January 7). TA551: Email Attack Campaign Switches from Valak to IcedID. Retrieved March 17, 2021.
Open source URL - [14]Fortinet Diavol July 2021
Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021.
Open source URL - [15]CISA AA21-200A APT40 July 2021
CISA. (2021, July 19). (AA21-200A) Joint Cybersecurity Advisory – Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department. Retrieved August 12, 2021.
Open source URL - [16]Antiy CERT Ramsay April 2020
Antiy CERT. (2020, April 20). Analysis of Ramsay components of Darkhotel's infiltration and isolation network. Retrieved March 24, 2021.
Open source URL - [17]Talos Oblique RAT March 2021
Malhotra, A. (2021, March 2). ObliqueRAT returns with new campaign using hijacked websites. Retrieved September 2, 2021.
Open source URL - [18]Juniper IcedID June 2020
Kimayong, P. (2020, June 18). COVID-19 and FMLA Campaigns used to install new IcedID banking malware. Retrieved July 14, 2020.
Open source URL - [19]Zscaler Pikabot 2023
Brett Stone-Gross & Nikolaos Pantazopoulos. (2023, May 24). Technical Analysis of Pikabot. Retrieved July 12, 2024.
Open source URL - [20]Group IB Ransomware September 2020
Group IB. (2020, September). LOCK LIKE A PRO. Retrieved November 17, 2024.
Open source URL - [21]ClearSky MuddyWater Nov 2018
ClearSky Cyber Security. (2018, November). MuddyWater Operations in Lebanon and Oman: Using an Israeli compromised domain for a two-stage campaign. Retrieved November 29, 2018.
Open source URL - [22]GitHub Invoke-PSImage
Adams, B. (2017, December 17). Invoke-PSImage. Retrieved April 10, 2018.
Open source URL - [23]Symantec RAINDROP January 2021
Symantec Threat Hunter Team. (2021, January 18). Raindrop: New Malware Discovered in SolarWinds Investigation. Retrieved January 19, 2021.
Open source URL - [24]Kaspersky BlindEagle AUG 2024
Global Research & Analysis Team, Kaspersky. (2024, August 19). BlindEagle flying high in Latin America. Retrieved April 16, 2026.
Open source URL - [25]Recorded Future TAG-144 AUG 2025
Insikt Group. (2025, August 26). TAG-144’s Persistent Grip on South American Organizations. Retrieved April 16, 2026.
Open source URL - [26]Zscaler BlindEagle DEC 2025
Pellegrino, G. (2025, December 16). BlindEagle Targets Colombian Government Agency with Caminho and DCRAT. Retrieved April 16, 2026.
Open source URL - [27]MalwareBytes Lazarus-Andariel Conceals Code April 2021
Jazi, H. (2021, April 19). Lazarus APT conceals malicious code within BMP image to drop its RAT . Retrieved September 29, 2021.
Open source URL - [28]Kaspersky Andariel Ransomware June 2021
Park, S. (2021, June 15). Andariel evolves to target South Korea with ransomware. Retrieved September 29, 2021.
Open source URL - [29]TrendMicro Tropic Trooper May 2020
Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.
Open source URL - [30]McAfee Malicious Doc Targets Pyeongchang Olympics
Saavedra-Morales, J., Sherstobitoff, R. (2018, January 6). Malicious Document Targets Pyeongchang Olympics. Retrieved April 10, 2018.
Open source URL - [31]McAfee Malicious Doc Targets Pyeongchang Olympics
Saavedra-Morales, J., Sherstobitoff, R. (2018, January 6). Malicious Document Targets Pyeongchang Olympics. Retrieved April 10, 2018.
Open source URL - [32]Wikipedia Duqu
Wikipedia. (2017, December 29). Duqu. Retrieved April 10, 2018.
Open source URL - [33]Wikipedia Duqu
Wikipedia. (2017, December 29). Duqu. Retrieved April 10, 2018.
Open source URL - [34]mitre-attackT1027.003Open source URL
- [35]mitre-attackT1027.003Open source URL
- [36]mitre-attackT1027.003Open source URL
- [37]TrendMicro EarthLusca 2022
Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.
Open source URL - [38]Unit42 RDAT July 2020
Falcone, R. (2020, July 22). OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory. Retrieved July 28, 2020.
Open source URL - [39]Volexity PowerDuke November 2016
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
Open source URL - [40]ESET Operation Spalax Jan 2021
M. Porolli. (2021, January 21). Operation Spalax: Targeted malware attacks in Colombia. Retrieved September 16, 2022.
Open source URL - [41]Securelist ScarCruft May 2019
GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.
Open source URL - [42]Talos Group123
Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.
Open source URL - [43]ESET Dukes October 2019
Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
Open source URL - [44]Trend Micro Tick November 2019
Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.
Open source URL - [45]ESET Dukes October 2019
Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
Open source URL - [46]ESET Dukes October 2019
Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
Open source URL - [47]Trend Micro Tick November 2019
Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.
Open source URL - [48]Trend Micro Tick November 2019
Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.
Open source URL - [49]ESET Okrum July 2019
Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.
Open source URL - [50]CheckPoint Bandook Nov 2020
Check Point. (2020, November 26). Bandook: Signed & Delivered. Retrieved May 31, 2021.
Open source URL - [51]Unit 42 TA551 Jan 2021
Duncan, B. (2021, January 7). TA551: Email Attack Campaign Switches from Valak to IcedID. Retrieved March 17, 2021.
Open source URL - [52]Fortinet Diavol July 2021
Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021.
Open source URL - [53]CISA AA21-200A APT40 July 2021
CISA. (2021, July 19). (AA21-200A) Joint Cybersecurity Advisory – Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department. Retrieved August 12, 2021.
Open source URL - [54]Antiy CERT Ramsay April 2020
Antiy CERT. (2020, April 20). Analysis of Ramsay components of Darkhotel's infiltration and isolation network. Retrieved March 24, 2021.
Open source URL - [55]Talos Oblique RAT March 2021
Malhotra, A. (2021, March 2). ObliqueRAT returns with new campaign using hijacked websites. Retrieved September 2, 2021.
Open source URL - [56]Juniper IcedID June 2020
Kimayong, P. (2020, June 18). COVID-19 and FMLA Campaigns used to install new IcedID banking malware. Retrieved July 14, 2020.
Open source URL - [57]Zscaler Pikabot 2023
Brett Stone-Gross & Nikolaos Pantazopoulos. (2023, May 24). Technical Analysis of Pikabot. Retrieved July 12, 2024.
Open source URL - [58]Trend Micro Tick November 2019
Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.
Open source URL - [59]Trend Micro Tick November 2019
Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.
Open source URL - [60]Group IB Ransomware September 2020
Group IB. (2020, September). LOCK LIKE A PRO. Retrieved November 17, 2024.
Open source URL - [61]ClearSky MuddyWater Nov 2018
ClearSky Cyber Security. (2018, November). MuddyWater Operations in Lebanon and Oman: Using an Israeli compromised domain for a two-stage campaign. Retrieved November 29, 2018.
Open source URL - [62]GitHub Invoke-PSImage
Adams, B. (2017, December 17). Invoke-PSImage. Retrieved April 10, 2018.
Open source URL - [63]ESET Dukes October 2019
Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
Open source URL - [64]ESET Dukes October 2019
Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
Open source URL - [65]Symantec RAINDROP January 2021
Symantec Threat Hunter Team. (2021, January 18). Raindrop: New Malware Discovered in SolarWinds Investigation. Retrieved January 19, 2021.
Open source URL - [66]Trend Micro Tick November 2019
Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.
Open source URL - [67]Trend Micro Tick November 2019
Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.
Open source URL - [68]Kaspersky BlindEagle AUG 2024
Global Research & Analysis Team, Kaspersky. (2024, August 19). BlindEagle flying high in Latin America. Retrieved April 16, 2026.
Open source URL - [69]Recorded Future TAG-144 AUG 2025
Insikt Group. (2025, August 26). TAG-144’s Persistent Grip on South American Organizations. Retrieved April 16, 2026.
Open source URL - [70]Zscaler BlindEagle DEC 2025
Pellegrino, G. (2025, December 16). BlindEagle Targets Colombian Government Agency with Caminho and DCRAT. Retrieved April 16, 2026.
Open source URL - [71]Kaspersky Andariel Ransomware June 2021
Park, S. (2021, June 15). Andariel evolves to target South Korea with ransomware. Retrieved September 29, 2021.
Open source URL - [72]MalwareBytes Lazarus-Andariel Conceals Code April 2021
Jazi, H. (2021, April 19). Lazarus APT conceals malicious code within BMP image to drop its RAT . Retrieved September 29, 2021.
Open source URL - [73]ESET Dukes October 2019
Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
Open source URL - [74]Trend Micro Tick November 2019
Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.