LiveActive security incident?Get immediate response
MITRE ATT&CK® Technique

T1027.009: Embedded Payloads

Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content. In some cases, embedded payloads may also enable adversaries to Subvert Trust Controls by not impacting execution controls such as digital signatures and notarization tickets.[1]

Adversaries may embed payloads in various file formats to hide payloads.[2] This is similar to Steganography, though does not involve weaving malicious content into specific bytes and patterns related to legitimate digital media formats.[3]

For example, adversaries have been observed embedding payloads within or as an overlay of an otherwise benign binary.[4] Adversaries have also been observed nesting payloads (such as executables and run-only scripts) inside a file of the same format.[5]

Embedded content may also be used as Process Injection payloads used to infect benign system processes.[6] These embedded then injected payloads may be used as part of the modules of malware designed to provide specific features such as encrypting C2 communications in support of an orchestrator module. For example, an embedded module may be injected into default browsers, allowing adversaries to then communicate via the network.[7]

EnterpriseT1027.009Sub-techniqueObject v2.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Embedded Payloads matter because malicious content can be hidden inside files that look acceptable to users, tools, or trust controls. For leaders, the risk is not the file format itself; it is whether endpoint, malware analysis, and incident response processes can reveal what a file carries and what it loads or injects at runtime across Windows, macOS, and Linux environments.

Executive priority

Prioritize this as a defense-evasion control validation issue. The ATT&CK relationships show use across multiple campaigns, groups, and malware families, including examples involving supply chain compromise, ransomware, wipers, spyware, backdoors, and macOS AppleScript nesting. Executives should ask whether signed, notarized, or otherwise trusted-looking files receive enough behavioral scrutiny, and whether SOC and IR teams can preserve and analyze suspicious parent files, embedded content, and runtime behavior as audit-ready evidence.

Technical view

This is a sub-technique of T1027 Obfuscated Files or Information under the stealth tactic. ATT&CK lists Linux, macOS, and Windows platforms and describes payloads embedded in scripts, executables, overlays, same-format nested files, images, shortcut-related structures, and modules later used for process injection. Because no official ATT&CK detection text is provided for this object, defenders should validate coverage through the related DET0214 detection strategy, endpoint behavior prevention, antimalware analysis, and runtime telemetry that connects unusual file structure to execution, script interpretation, process injection, or network activity.

Likely telemetry

  • Endpoint file creation, modification, and execution events for scripts, executables, shortcuts, images, and other carrier files
  • Antivirus/antimalware and endpoint behavior-prevention alerts, including heuristic or behavioral findings
  • File metadata and static-analysis evidence such as overlays, appended data, nested same-format content, anomalous sections, or embedded resources
  • Script interpreter activity, including PowerShell and AppleScript where present in the environment
  • Process lineage showing a benign-looking file leading to interpreter execution, module loading, process injection, or browser/process abuse

Detection direction

  • Validate DET0214-aligned analytics against both static indicators of embedded content and behavioral evidence after execution; static file inspection alone may miss payloads that only emerge at runtime.
  • Tune detections around suspicious parent-child process chains, embedded payload extraction, interpreter launch, process injection, and unexpected network activity from otherwise benign-looking files.
  • Treat trusted-looking files, signed binaries, notarized macOS content, or common document/image/script containers as detection blind spots if controls only rely on reputation or signatures.
  • Use relationship context to test visibility across Windows, macOS, and Linux rather than assuming coverage from one operating system generalizes to another.
  • Manage false positives by baselining legitimate installers, packagers, scripts, and enterprise software that may contain appended or embedded resources, then requiring suspicious execution or behavioral context for escalation.

Mitigation priorities

  • Ensure antivirus/antimalware coverage is deployed, updated, and configured to inspect suspicious files and behaviors across supported endpoint platforms.
  • Prioritize M1040 Behavior Prevention on Endpoint controls that can block suspicious process behavior, script execution patterns, API activity, and runtime anomalies rather than relying only on known signatures.
  • Require suspicious carrier files to be retained for analysis so IR teams can extract and compare embedded payloads with observed process and network behavior.
  • Review trust-control assumptions: signed, notarized, or approved-looking files should still be subject to behavioral monitoring when they spawn interpreters, inject into processes, or initiate unusual communications.
  • Use this technique in detection engineering and tabletop exercises for supply chain, ransomware, wiper, spyware, and backdoor scenarios reflected in the ATT&CK relationship set.
Additional notes and limits

The most useful defensive question is whether the organization can connect three pieces of evidence: the carrier file, the hidden or appended payload, and the runtime behavior that payload produces. The relationship set is broad, including C0021, the 3CX Supply Chain Attack, Lazarus Group, Moonstone Sleet, TA577, and software such as Uroburos, ComRAT, Invoke-PSImage, Emotet, Netwalker, IcedID, Dtrack, SMOKEDHAM, macOS.OSAMiner, DEADEYE, BADHATCH, DEADWOOD, MultiLayer Wiper, Moneybird, and Pikabot. Use that context for defensive validation, not as proof of local exposure.

ATT&CK provides no official detection text for this object, so detection recommendations are derived from the official description and supplied relationships, especially DET0214, M1040, and M1049. Local file types, operating systems, EDR depth, script logging, memory visibility, and malware-analysis capability will determine practical coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Embedded Payloads

Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content. In some cases, embedded payloads may also enable adversaries to Subvert Trust Controls by not impacting execution controls such as digital signatures and notarization tickets.[1]

Adversaries may embed payloads in various file formats to hide payloads.[2] This is similar to Steganography, though does not involve weaving malicious content into specific bytes and patterns related to legitimate digital media formats.[3]

For example, adversaries have been observed embedding payloads within or as an overlay of an otherwise benign binary.[4] Adversaries have also been observed nesting payloads (such as executables and run-only scripts) inside a file of the same format.[5]

Embedded content may also be used as Process Injection payloads used to infect benign system processes.[6] These embedded then injected payloads may be used as part of the modules of malware designed to provide specific features such as encrypting C2 communications in support of an orchestrator module. For example, an embedded module may be injected into default browsers, allowing adversaries to then communicate via the network.[7]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
DomainIDNameRelationship / procedure
EnterpriseT1027Obfuscated Files or InformationThis object subtechnique of Obfuscated Files or Information.
Associated objects

Groups, software, and campaigns

GroupEnterprise

G0032: Lazarus Group

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]

North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]

GroupEnterprise

G1036: Moonstone Sleet

Moonstone Sleet is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, Lazarus Group, but has differentiated its tradecraft since 2023. Moonstone Sleet is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game.[1]

MalwareEnterprise

S1137: Moneybird

Moneybird is a ransomware variant written in C++ associated with Agrius operations. The name "Moneybird" is contained in the malware's ransom note and as strings in the executable.[1]

Windows
MalwareEnterprise

S1052: DEADEYE

DEADEYE is a malware launcher that has been used by APT41 since at least May 2021. DEADEYE has variants that can either embed a payload inside a compiled binary (DEADEYE.EMBED) or append it to the end of a file (DEADEYE.APPEND).[1]

Windows
MalwareEnterprise

S1081: BADHATCH

BADHATCH is a backdoor that has been utilized by FIN8 since at least 2019. BADHATCH has been used to target the insurance, retail, technology, and chemical industries in the United States, Canada, South Africa, Panama, and Italy.[1][2]

Windows
MalwareEnterprise

S1134: DEADWOOD

DEADWOOD is wiper malware written in C++ using Boost libraries. DEADWOOD was first observed in an unattributed wiping event in Saudi Arabia in 2019, and has since been incorporated into Agrius operations.[1]

Windows
MalwareEnterprise

S0367: Emotet

Emotet is a modular malware variant which is primarily used as a downloader for other malware variants such as TrickBot and IcedID. Emotet first emerged in June 2014, initially targeting the financial sector, and has expanded to multiple verticals over time.[1]

Windows
MalwareEnterprise

S1048: macOS.OSAMiner

macOS.OSAMiner is a Monero mining trojan that was first observed in 2018; security researchers assessed macOS.OSAMiner may have been circulating since at least 2015. macOS.OSAMiner is known for embedding one run-only AppleScript into another, which helped the malware evade full analysis for five years due to a lack of Apple event (AEVT) analysis tools.[1][2]

macOS
MalwareEnterprise

S0567: Dtrack

Dtrack is spyware that was discovered in 2019 and has been used against Indian financial institutions, research facilities, and the Kudankulam Nuclear Power Plant. Dtrack shares similarities with the DarkSeoul campaign, which was attributed to Lazarus Group. [1][2][3][4][5]

Windows
MalwareEnterprise

S0483: IcedID

IcedID is a modular banking malware designed to steal financial information that has been observed in the wild since at least 2017. IcedID has been downloaded by Emotet in multiple campaigns.[1][2]

Windows
MalwareEnterprise

S0649: SMOKEDHAM

SMOKEDHAM is a Powershell-based .NET backdoor that was first reported in May 2021; it has been used by at least one ransomware-as-a-service affiliate.[1][2]

Windows
CampaignEnterprise

C0057: 3CX Supply Chain Attack

The 3CX Supply Chain Attack was the first publicly reported case of one supply chain compromise triggering another, leading to a cascading, two-stage intrusion. The initial supply chain attack began when a 3CX employee downloaded and executed a trojanized, end-of-life version of the X_Trader trading software from Trading Technologies. This provided UNC4736, a threat cluster associated with AppleJeus, access to the 3CX environment. From there UNC4736 compromised the Windows and macOS build environments used to distribute the 3CX desktop application to their customers.[1] While 3CX serves more than 600,000 customers and 12 million users, only a subset of systems were affected. Subsequent targeting focused on victims in the defense and cryptocurrency sectors, where attackers deployed secondary payloads such as Gopuram for credential theft and persistence.[2] The campaign began in late 2022 and was disrupted after security vendors publicly reported the compromise in March 2023.[3][4]

CampaignEnterprise

C0021: C0021

C0021 was a spearphishing campaign conducted in November 2018 that targeted public sector institutions, non-governmental organizations (NGOs), educational institutions, and private-sector corporations in the oil and gas, chemical, and hospitality industries. The majority of targets were located in the US, particularly in and around Washington D.C., with other targets located in Europe, Hong Kong, India, and Canada. C0021's technical artifacts, tactics, techniques, and procedures (TTPs), and targeting overlap with previous suspected APT29 activity.[1][2]

Relationship explorer

All related ATT&CK context

uses · MalwareS1137: MoneybirdEnterprisesubtechnique of · TechniqueT1027: Obfuscated Files or InformationEnterprisemitigates · MitigationM1049: Antivirus/AntimalwareEnterpriseuses · MalwareS1052: DEADEYEEnterpriseuses · GroupG0032: Lazarus GroupEnterpriseuses · MalwareS1081: BADHATCHEnterpriseuses · MalwareS1149: CHIMNEYSWEEPEnterpriseuses · MalwareS1134: DEADWOODEnterpriseuses · MalwareS0367: EmotetEnterpriseuses · MalwareS1048: macOS.OSAMinerEnterprisedetects · Detection StrategyDET0214: Detection Strategy for Embedded PayloadsEnterpriseuses · MalwareS0567: DtrackEnterpriseuses · MalwareS0483: IcedIDEnterpriseuses · MalwareS0457: NetwalkerEnterpriseuses · MalwareS1135: MultiLayer WiperEnterpriseuses · MalwareS0649: SMOKEDHAMEnterpriseuses · MalwareS1145: PikabotEnterprisemitigates · MitigationM1040: Behavior Prevention on EndpointEnterpriseuses · CampaignC0057: 3CX Supply Chain AttackEnterpriseuses · GroupG1037: TA577Enterpriseuses · MalwareS0126: ComRATEnterpriseuses · MalwareS1158: DUSTPANEnterpriseuses · MalwareS1159: DUSTTRAPEnterpriseuses · ToolS0231: Invoke-PSImageEnterprise
Mitigations

Mitigation direction

MitigationEnterprise

M1049: Antivirus/Antimalware

Antivirus/Antimalware solutions utilize signatures, heuristics, and behavioral analysis to detect, block, and remediate malicious software, including viruses, trojans, ransomware, and spyware. These solutions continuously monitor endpoints and systems for known malicious patterns and suspicious behaviors that indicate compromise. Antivirus/Antimalware software should be deployed across all devices, with automated updates to ensure protection against the latest threats. This mitigation can be implemented through the following measures:

Signature-Based Detection:

- Implementation: Use predefined signatures to identify known malware based on unique patterns such as file hashes, byte sequences, or command-line arguments. This method is effective against known threats. - Use Case: When malware like "Emotet" is detected, its signature (such as a specific file hash) matches a known database of malicious software, triggering an alert and allowing immediate quarantine of the infected file.

Heuristic-Based Detection:

- Implementation: Deploy heuristic algorithms that analyze behavior and characteristics of files and processes to identify potential malware, even if it doesn’t match a known signature. - Use Case: If a program attempts to modify multiple critical system files or initiate suspicious network communications, heuristic analysis may flag it as potentially malicious, even if no specific malware signature is available.

Behavioral Detection (Behavior Prevention):

- Implementation: Use behavioral analysis to detect patterns of abnormal activities, such as unusual system calls, unauthorized file encryption, or attempts to escalate privileges. - Use Case: Behavioral analysis can detect ransomware attacks early by identifying behavior like mass file encryption, even before a specific ransomware signature has been identified.

Real-Time Scanning:

- Implementation: Enable real-time scanning to automatically inspect files and network traffic for signs of malware as they are accessed, downloaded, or executed. - Use Case: When a user downloads an email attachment, the antivirus solution scans the file in real-time, checking it against both signatures and heuristics to detect any malicious content before it can be opened.

Cloud-Assisted Threat Intelligence:

- Implementation: Use cloud-based threat intelligence to ensure the antivirus solution can access the latest malware definitions and real-time threat feeds from a global database of emerging threats. - Use Case: Cloud-assisted antivirus solutions quickly identify newly discovered malware by cross-referencing against global threat databases, providing real-time protection against zero-day attacks.

**Tools for Implementation**:

- Endpoint Security Platforms: Use solutions such as EDR for comprehensive antivirus/antimalware protection across all systems. - Centralized Management: Implement centralized antivirus management consoles that provide visibility into threat activity, enable policy enforcement, and automate updates. - Behavioral Analysis Tools: Leverage solutions with advanced behavioral analysis capabilities to detect malicious activity patterns that don’t rely on known signatures.

MitigationEnterprise

M1040: Behavior Prevention on Endpoint

Behavior Prevention on Endpoint refers to the use of technologies and strategies to detect and block potentially malicious activities by analyzing the behavior of processes, files, API calls, and other endpoint events. Rather than relying solely on known signatures, this approach leverages heuristics, machine learning, and real-time monitoring to identify anomalous patterns indicative of an attack. This mitigation can be implemented through the following measures:

Suspicious Process Behavior:

- Implementation: Use Endpoint Detection and Response (EDR) tools to monitor and block processes exhibiting unusual behavior, such as privilege escalation attempts. - Use Case: An attacker uses a known vulnerability to spawn a privileged process from a user-level application. The endpoint tool detects the abnormal parent-child process relationship and blocks the action.

Unauthorized File Access:

- Implementation: Leverage Data Loss Prevention (DLP) or endpoint tools to block processes attempting to access sensitive files without proper authorization. - Use Case: A process tries to read or modify a sensitive file located in a restricted directory, such as /etc/shadow on Linux or the SAM registry hive on Windows. The endpoint tool identifies this anomalous behavior and prevents it.

Abnormal API Calls:

- Implementation: Implement runtime analysis tools to monitor API calls and block those associated with malicious activities. - Use Case: A process dynamically injects itself into another process to hijack its execution. The endpoint detects the abnormal use of APIs like `OpenProcess` and `WriteProcessMemory` and terminates the offending process.

Exploit Prevention:

- Implementation: Use behavioral exploit prevention tools to detect and block exploits attempting to gain unauthorized access. - Use Case: A buffer overflow exploit is launched against a vulnerable application. The endpoint detects the anomalous memory write operation and halts the process.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.0
Created
Modified
Raw hash
811d5c68c86c7bbd...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.0Current bundle811d5c68c86c…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Sentinel Labs

    Phil Stokes. (2021, January 11). FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts. Retrieved September 30, 2022.

    Open source URL
  2. [2]
    Microsoft Learn

    Microsoft. (2021, April 6). 2.5 ExtraData. Retrieved September 30, 2022.

    Open source URL
  3. [3]
    GitHub PSImage

    Barrett Adams . (n.d.). Invoke-PSImage . Retrieved September 30, 2022.

    Open source URL
  4. [4]
    Securelist Dtrack2

    KONSTANTIN ZYKOV. (2019, September 23). Hello! My name is Dtrack. Retrieved September 30, 2022.

    Open source URL
  5. [5]
    SentinelLabs reversing run-only applescripts 2021

    Phil Stokes. (2021, January 11). FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts. Retrieved September 29, 2022.

    Open source URL
  6. [6]
    Trend Micro

    Karen Victor. (2020, May 18). Reflective Loading Runs Netwalker Fileless Ransomware. Retrieved September 30, 2022.

    Open source URL
  7. [7]
    Malware Analysis Report ComRAT

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A) MAR-10310246-2.v1 – PowerShell Script: ComRAT. Retrieved September 30, 2022.

    Open source URL
  8. [8]
    CheckPoint Agrius 2023

    Marc Salinas Fernandez & Jiri Vinopal. (2023, May 23). AGRIUS DEPLOYS MONEYBIRD IN TARGETED ATTACKS AGAINST ISRAELI ORGANIZATIONS. Retrieved May 21, 2024.

    Open source URL
  9. [9]
    Mandiant APT41

    Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022.

    Open source URL
  10. [10]
    Microsoft DiamondSleet 2023

    Microsoft Threat Intelligence. (2023, November 22). Diamond Sleet supply chain compromise distributes a modified CyberLink installer. Retrieved March 28, 2025.

    Open source URL
  11. [11]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  12. [12]
    Mandiant ROADSWEEP August 2022

    Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.

    Open source URL
  13. [13]
    SentinelOne Agrius 2021

    Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.

    Open source URL
  14. [14]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  15. [15]
    emotet_hc3_nov2023

    Office of Information Security, Health Sector Cybersecurity Coordination Center. (2023, November 16). Emotet Malware: The Enduring and Persistent Threat to the Health Sector. Retrieved June 19, 2024.

    Open source URL
  16. [16]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  17. [17]
    Trendmicro_IcedID

    Kenefick , I. (2022, December 23). IcedID Botnet Distributors Abuse Google PPC to Distribute Malware. Retrieved July 24, 2024.

    Open source URL
  18. [18]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  19. [19]
    Unit42 Agrius 2023

    Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.

    Open source URL
  20. [20]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  21. [21]
    Zscaler Pikabot 2023

    Brett Stone-Gross & Nikolaos Pantazopoulos. (2023, May 24). Technical Analysis of Pikabot. Retrieved July 12, 2024.

    Open source URL
  22. [22]
    Elastic Pikabot 2024

    Daniel Stepanic & Salim Bitam. (2024, February 23). PIKABOT, I choose you!. Retrieved July 12, 2024.

    Open source URL
  23. [23]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  24. [24]
    Unit42 3cx supply chain 2023

    Robert Falcone, Josh Grunzweig. (2023, March 30). Threat Brief: 3CXDesktopApp Supply Chain Attack. Retrieved September 15, 2025.

    Open source URL
  25. [25]
    Latrodectus APR 2024

    Proofpoint Threat Research and Team Cymru S2 Threat Research. (2024, April 4). Latrodectus: This Spider Bytes Like Ice . Retrieved May 31, 2024.

    Open source URL
  26. [26]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  27. [27]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  28. [28]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  29. [29]
    Google Cloud APT41 2022

    Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman & John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved September 16, 2024.

    Open source URL
  30. [30]
    Microsoft Unidentified Dec 2018

    Microsoft Defender Research Team. (2018, December 3). Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers. Retrieved April 15, 2019.

    Open source URL
  31. [31]
    Microsoft Moonstone Sleet 2024

    Microsoft Threat Intelligence. (2024, May 28). Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks. Retrieved August 26, 2024.

    Open source URL
  32. [32]
    Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

    FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.

    Open source URL
  33. [33]
    GitHub PSImage

    Barrett Adams . (n.d.). Invoke-PSImage . Retrieved September 30, 2022.

    Open source URL
  34. [34]
    GitHub PSImage

    Barrett Adams . (n.d.). Invoke-PSImage . Retrieved September 30, 2022.

    Open source URL
  35. [35]
    Malware Analysis Report ComRAT

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A) MAR-10310246-2.v1 – PowerShell Script: ComRAT. Retrieved September 30, 2022.

    Open source URL
  36. [36]
    Malware Analysis Report ComRAT

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A) MAR-10310246-2.v1 – PowerShell Script: ComRAT. Retrieved September 30, 2022.

    Open source URL
  37. [37]
    Microsoft Learn

    Microsoft. (2021, April 6). 2.5 ExtraData. Retrieved September 30, 2022.

    Open source URL
  38. [38]
    Microsoft Learn

    Microsoft. (2021, April 6). 2.5 ExtraData. Retrieved September 30, 2022.

    Open source URL
  39. [39]
    Securelist Dtrack2

    KONSTANTIN ZYKOV. (2019, September 23). Hello! My name is Dtrack. Retrieved September 30, 2022.

    Open source URL
  40. [40]
    Securelist Dtrack2

    KONSTANTIN ZYKOV. (2019, September 23). Hello! My name is Dtrack. Retrieved September 30, 2022.

    Open source URL
  41. [41]
    Sentinel Labs

    Phil Stokes. (2021, January 11). FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts. Retrieved September 30, 2022.

    Open source URL
  42. [42]
    Sentinel Labs

    Phil Stokes. (2021, January 11). FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts. Retrieved September 30, 2022.

    Open source URL
  43. [43]
    SentinelLabs reversing run-only applescripts 2021

    Phil Stokes. (2021, January 11). FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts. Retrieved September 29, 2022.

    Open source URL
  44. [44]
    SentinelLabs reversing run-only applescripts 2021

    Phil Stokes. (2021, January 11). FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts. Retrieved September 29, 2022.

    Open source URL
  45. [45]
    Trend Micro

    Karen Victor. (2020, May 18). Reflective Loading Runs Netwalker Fileless Ransomware. Retrieved September 30, 2022.

    Open source URL
  46. [46]
    Trend Micro

    Karen Victor. (2020, May 18). Reflective Loading Runs Netwalker Fileless Ransomware. Retrieved September 30, 2022.

    Open source URL
  47. [47]
    mitre-attackT1027.009
    Open source URL
  48. [48]
    mitre-attackT1027.009
    Open source URL
  49. [49]
    mitre-attackT1027.009
    Open source URL
  50. [50]
    CheckPoint Agrius 2023

    Marc Salinas Fernandez & Jiri Vinopal. (2023, May 23). AGRIUS DEPLOYS MONEYBIRD IN TARGETED ATTACKS AGAINST ISRAELI ORGANIZATIONS. Retrieved May 21, 2024.

    Open source URL
  51. [51]
    Mandiant APT41

    Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022.

    Open source URL
  52. [52]
    Microsoft DiamondSleet 2023

    Microsoft Threat Intelligence. (2023, November 22). Diamond Sleet supply chain compromise distributes a modified CyberLink installer. Retrieved March 28, 2025.

    Open source URL
  53. [53]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  54. [54]
    Mandiant ROADSWEEP August 2022

    Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.

    Open source URL
  55. [55]
    SentinelOne Agrius 2021

    Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.

    Open source URL
  56. [56]
    Binary Defense Emotes Wi-Fi Spreader

    Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.

    Open source URL
  57. [57]
    emotet_hc3_nov2023

    Office of Information Security, Health Sector Cybersecurity Coordination Center. (2023, November 16). Emotet Malware: The Enduring and Persistent Threat to the Health Sector. Retrieved June 19, 2024.

    Open source URL
  58. [58]
    SentinelLabs reversing run-only applescripts 2021

    Phil Stokes. (2021, January 11). FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts. Retrieved September 29, 2022.

    Open source URL
  59. [59]
    SentinelLabs reversing run-only applescripts 2021

    Phil Stokes. (2021, January 11). FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts. Retrieved September 29, 2022.

    Open source URL
  60. [60]
    Securelist Dtrack

    Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.

    Open source URL
  61. [61]
    Trendmicro_IcedID

    Kenefick , I. (2022, December 23). IcedID Botnet Distributors Abuse Google PPC to Distribute Malware. Retrieved July 24, 2024.

    Open source URL
  62. [62]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  63. [63]
    Unit42 Agrius 2023

    Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.

    Open source URL
  64. [64]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  65. [65]
    Elastic Pikabot 2024

    Daniel Stepanic & Salim Bitam. (2024, February 23). PIKABOT, I choose you!. Retrieved July 12, 2024.

    Open source URL
  66. [66]
    Zscaler Pikabot 2023

    Brett Stone-Gross & Nikolaos Pantazopoulos. (2023, May 24). Technical Analysis of Pikabot. Retrieved July 12, 2024.

    Open source URL
  67. [67]
    win10_asr

    Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.

    Open source URL
  68. [68]
    Unit42 3cx supply chain 2023

    Robert Falcone, Josh Grunzweig. (2023, March 30). Threat Brief: 3CXDesktopApp Supply Chain Attack. Retrieved September 15, 2025.

    Open source URL
  69. [69]
    Latrodectus APR 2024

    Proofpoint Threat Research and Team Cymru S2 Threat Research. (2024, April 4). Latrodectus: This Spider Bytes Like Ice . Retrieved May 31, 2024.

    Open source URL
  70. [70]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  71. [71]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  72. [72]
    Google Cloud APT41 2022

    Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman & John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved September 16, 2024.

    Open source URL
  73. [73]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  74. [74]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  75. [75]
    GitHub PSImage

    Barrett Adams. (n.d.). Invoke-PSImage . Retrieved September 30, 2022.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use