LiveActive security incident?Get immediate response
MITRE ATT&CK® Technique

T1027.011: Fileless Storage

Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format other than a file. Common examples of non-volatile fileless storage in Windows systems include the Windows Registry, event logs, or WMI repository.[1][2] Shared memory directories on Linux systems (`/dev/shm`, `/run/shm`, `/var/run`, and `/var/lock`) and volatile directories on Network Devices (`/tmp` and `/volatile`) may also be considered fileless storage, as files written to these directories are mapped directly to RAM and not stored on the disk.[3][4][5][6][7].

Similar to fileless in-memory behaviors such as Reflective Code Loading and Process Injection, fileless data storage may remain undetected by antivirus and other endpoint security tools that can only access specific file formats from disk storage. Leveraging fileless storage may also allow adversaries to bypass the protections offered by read-only file systems in Linux.[8]

Adversaries may use fileless storage to conceal various types of stored data, including payloads/shellcode (potentially being used as part of Persistence) and collected data not yet exfiltrated from the victim (e.g., Local Data Staging). Adversaries also often encrypt, encode, splice, or otherwise obfuscate this fileless data when stored.

Some forms of fileless storage activity may indirectly create artifacts in the file system, but in central and otherwise difficult to inspect formats such as the WMI (e.g., `%SystemRoot%\System32\Wbem\Repository`) or Registry (e.g., `%SystemRoot%\System32\Config`) physical files.[1]

EnterpriseT1027.011Sub-techniqueObject v3.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Fileless Storage matters because important attacker data may not appear as normal files on disk. In this ATT&CK entry, adversaries may hide payloads, shellcode, or staged data in places such as the Windows Registry, WMI repository, event logs, or Linux shared-memory/volatile directories. For leaders, the key issue is assurance: endpoint tools and audit programs that mainly inspect ordinary files may miss evidence needed for containment, investigation, and compliance reporting.

Executive priority

Treat this as a coverage-validation item for Windows and Linux environments, especially where business continuity depends on rapid incident scoping. Ask whether SOC and IR teams can inspect Registry, WMI, event log, and Linux shared-memory locations—not just file paths on disk. This also supports audit readiness: M1047 Audit is the supplied mitigation relationship, so organizations should be able to show that relevant activity and configuration changes are recorded and reviewed.

Technical view

ATT&CK lists this as a stealth sub-technique of T1027 Obfuscated Files or Information for Linux and Windows. The defensive validation should focus on whether telemetry exposes non-traditional storage locations named in the object: Windows Registry, WMI repository, event logs, and Linux directories such as /dev/shm, /run/shm, /var/run, and /var/lock. The related detection strategy DET0344 specifically points to Registry, WMI, and shared memory, so detection engineering should test visibility and alert logic across those storage classes rather than relying only on antivirus or disk-file scanning.

Likely telemetry

  • Windows Registry auditing and change events for unusual data storage patterns
  • WMI activity and repository-related telemetry, including changes in %SystemRoot%\System32\Wbem\Repository where available
  • Windows event log activity that may indicate abnormal storage or manipulation of log-backed data
  • Process creation and command-line telemetry showing access to Registry, WMI, event logs, or shared-memory paths
  • Linux file and process telemetry for writes or execution involving /dev/shm, /run/shm, /var/run, and /var/lock

Detection direction

  • Validate DET0344-aligned coverage for Registry, WMI, and shared-memory storage rather than assuming file-based malware detection is sufficient.
  • Tune detections around unusual volume, entropy, encoded content, or executable behavior associated with non-file storage locations, while accounting for legitimate administrative and application use.
  • On Linux, test whether monitoring covers shared-memory and volatile directories, particularly where read-only filesystem assumptions may create a blind spot.
  • For Windows investigations, ensure responders can inspect central but harder-to-review artifacts such as Registry and WMI repository-backed physical files.
  • Correlate storage anomalies with persistence or local data staging hypotheses, since the ATT&CK description notes fileless storage may hide payloads or collected data awaiting exfiltration.

Mitigation priorities

  • Prioritize M1047 Audit: confirm that relevant system logs, user activity, configuration changes, Registry/WMI activity, and Linux shared-memory directory activity are recorded and reviewed.
  • Create audit evidence showing which Windows and Linux storage locations are monitored, retained, and available to SOC and IR teams.
  • Include these locations in incident response collection plans so investigations do not depend only on normal filesystem triage.
  • Review audit configurations regularly, because this technique is specifically valuable when defenders lack visibility into non-file storage formats.
Additional notes and limits

The object has no official ATT&CK detection text, but it has a relationship to DET0344, named Detection Strategy for Fileless Storage via Registry, WMI, and Shared Memory. The relationship set also shows use by multiple campaigns, groups, and software entries, which supports the defensive priority without implying current activity in any specific environment.

This take is limited to the supplied ATT&CK fields, references, and relationships. It does not assert active exploitation, customer exposure, or guaranteed detection. Local operating-system versions, audit policy, EDR capability, log retention, and IR collection procedures are required to determine actual coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Fileless Storage

Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format other than a file. Common examples of non-volatile fileless storage in Windows systems include the Windows Registry, event logs, or WMI repository.[1][2] Shared memory directories on Linux systems (`/dev/shm`, `/run/shm`, `/var/run`, and `/var/lock`) and volatile directories on Network Devices (`/tmp` and `/volatile`) may also be considered fileless storage, as files written to these directories are mapped directly to RAM and not stored on the disk.[3][4][5][6][7].

Similar to fileless in-memory behaviors such as Reflective Code Loading and Process Injection, fileless data storage may remain undetected by antivirus and other endpoint security tools that can only access specific file formats from disk storage. Leveraging fileless storage may also allow adversaries to bypass the protections offered by read-only file systems in Linux.[8]

Adversaries may use fileless storage to conceal various types of stored data, including payloads/shellcode (potentially being used as part of Persistence) and collected data not yet exfiltrated from the victim (e.g., Local Data Staging). Adversaries also often encrypt, encode, splice, or otherwise obfuscate this fileless data when stored.

Some forms of fileless storage activity may indirectly create artifacts in the file system, but in central and otherwise difficult to inspect formats such as the WMI (e.g., `%SystemRoot%\System32\Wbem\Repository`) or Registry (e.g., `%SystemRoot%\System32\Config`) physical files.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
DomainIDNameRelationship / procedure
EnterpriseT1027Obfuscated Files or InformationThis object subtechnique of Obfuscated Files or Information.
Associated objects

Groups, software, and campaigns

GroupEnterprise

G0050: APT32

APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.[1][2][3]

GroupEnterprise

G0010: Turla

Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.[1][2][3][4][5]

MalwareEnterprise

S0650: QakBot

QakBot is a modular banking trojan that has been used primarily by financially-motivated actors since at least 2007. QakBot is continuously maintained and developed and has evolved from an information stealer into a delivery agent for ransomware, most notably ProLock and Egregor.[1][2][3][4]

Windows
MalwareEnterprise

S0126: ComRAT

ComRAT is a second stage implant suspected of being a descendant of Agent.btz and used by Turla. The first version of ComRAT was identified in 2007, but the tool has undergone substantial development for many years since.[1][2][3]

Windows
MalwareEnterprise

S0596: ShadowPad

ShadowPad is a modular backdoor that was first identified in a supply chain compromise of the NetSarang software in mid-July 2017. The malware was originally thought to be exclusively used by APT41, but has since been observed to be used by various Chinese threat activity groups. [1][2][3]

Windows
MalwareEnterprise

S0666: Gelsemium

Gelsemium is a modular malware comprised of a dropper (Gelsemine), a loader (Gelsenicine), and main (Gelsevirine) plug-ins written using the Microsoft Foundation Class (MFC) framework. Gelsemium has been used by the Gelsemium group since at least 2014.[1]

Windows
MalwareEnterprise

S0022: Uroburos

Uroburos is a sophisticated cyber espionage tool written in C that has been used by units within Russia's Federal Security Service (FSB) associated with the Turla toolset to collect intelligence on sensitive targets worldwide. Uroburos has several variants and has undergone nearly constant upgrade since its initial development in 2003 to keep it viable after public disclosures. Uroburos is typically deployed to external-facing nodes on a targeted network and has the ability to leverage additional tools and TTPs to further exploit an internal network. Uroburos has interoperable implants for Windows, Linux, and macOS, employs a high level of stealth in communications and architecture, and can easily incorporate new or replacement components.[1][2]

LinuxWindowsmacOS
MalwareEnterprise

S0531: Grandoreiro

Grandoreiro is a banking trojan written in Delphi that was first observed in 2016 and uses a Malware-as-a-Service (MaaS) business model. Grandoreiro has confirmed victims in Brazil, Mexico, Portugal, and Spain.[1][2]

Windows
MalwareEnterprise

S0198: NETWIRE

NETWIRE is a publicly available, multiplatform remote administration tool (RAT) that has been used by criminal and APT groups since at least 2012.[1][2][3]

WindowsLinuxmacOS
CampaignEnterprise

C0055: Quad7 Activity

Quad7 Activity, also known as CovertNetwork-1658 or the 7777 Botnet, is a network of compromised small office/home office (SOHO) routers. [1] [2] The botnet was initially composed primarily of TP-Link routers and was named Quad7 due to compromised devices exposing TCP port 7777 with the distinctive banner xlogin. Later activity showed a significant increase in compromised Asus routers and the addition of new ports and banners, including TCP port 63256 displaying alogin. Quad7 infrastructure functions as a collection of egress IPs that various China-affiliated threat actors have used to conduct password-spraying and brute-force operations. [1][3] Microsoft has reported that Storm-0940 leveraged credentials obtained through Quad7 Activity to target organizations in North America and Europe, including government agencies, non-governmental organizations, think tanks, law firms, energy firms, IT providers, and defense industrial base entities. [2]

CampaignEnterprise

C0012: Operation CuckooBees

Operation CuckooBees was a cyber espionage campaign targeting technology and manufacturing companies in East Asia, Western Europe, and North America since at least 2019. Security researchers noted the goal of Operation CuckooBees, which was still ongoing as of May 2022, was likely the theft of proprietary information, research and development documents, source code, and blueprints for various technologies. Researchers assessed Operation CuckooBees was conducted by actors affiliated with Winnti Group, APT41, and BARIUM.[1]

Relationship explorer

All related ATT&CK context

uses · MalwareS0673: DarkWatchmanEnterpriseuses · MalwareS0518: PolyglotDukeEnterpriseuses · MalwareS0650: QakBotEnterpriseuses · MalwareS0263: TYPEFRAMEEnterprisemitigates · MitigationM1047: AuditEnterpriseuses · MalwareS0126: ComRATEnterpriseuses · MalwareS0596: ShadowPadEnterprisedetects · Detection StrategyDET0344: Detection Strategy for Fileless Storage via Registry, WMI, and Shared MemoryEnterpriseuses · MalwareS0666: GelsemiumEnterpriseuses · MalwareS0022: UroburosEnterpriseuses · MalwareS0663: SysUpdateEnterprisesubtechnique of · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · MalwareS0343: Exaramel for WindowsEnterpriseuses · MalwareS0531: GrandoreiroEnterpriseuses · MalwareS0198: NETWIREEnterpriseuses · MalwareS0517: PillowmintEnterpriseuses · MalwareS0668: TinyTurlaEnterpriseuses · MalwareS0023: CHOPSTICKEnterpriseuses · GroupG0050: APT32Enterpriseuses · MalwareS1145: PikabotEnterpriseuses · MalwareS0269: QUADAGENTEnterpriseuses · MalwareS0511: RegDukeEnterpriseuses · MalwareS0665: ThreatNeedleEnterpriseuses · CampaignC0055: Quad7 ActivityEnterprise
Mitigations

Mitigation direction

MitigationEnterprise

M1047: Audit

Auditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the environment. Proper auditing configurations can also help to meet compliance requirements. The process of auditing encompasses regular analysis of user behaviors and system logs in support of proactive security measures.

Auditing is applicable to all systems used within an organization, from the front door of a building to accessing a file on a fileserver. It is considered more critical for regulated industries such as, healthcare, finance and government where compliance requirements demand stringent tracking of user and system activates.This mitigation can be implemented through the following measures:

System Audit:

- Use Case: Regularly assess system configurations to ensure compliance with organizational security policies. - Implementation: Use tools to scan for deviations from established benchmarks.

Permission Audits:

- Use Case: Review file and folder permissions to minimize the risk of unauthorized access or privilege escalation. - Implementation: Run access reviews to identify users or groups with excessive permissions.

Software Audits:

- Use Case: Identify outdated, unsupported, or insecure software that could serve as an attack vector. - Implementation: Use inventory and vulnerability scanning tools to detect outdated versions and recommend secure alternatives.

Configuration Audits:

- Use Case: Evaluate system and network configurations to ensure secure settings (e.g., disabled SMBv1, enabled MFA). - Implementation: Implement automated configuration scanning tools like SCAP (Security Content Automation Protocol) to identify non-compliant systems.

Network Audits:

- Use Case: Examine network traffic, firewall rules, and endpoint communications to identify unauthorized or insecure connections. - Implementation: Utilize tools such as Wireshark, or Zeek to monitor and log suspicious network behavior.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
3.0
Created
Modified
Raw hash
072d99796960b993...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.13.0Current bundle072d99796960…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Microsoft Fileless

    Microsoft. (2023, February 6). Fileless threats. Retrieved March 23, 2023.

    Open source URL
  2. [2]
    SecureList Fileless

    Legezo, D. (2022, May 4). A new secret stash for “fileless” malware. Retrieved March 23, 2023.

    Open source URL
  3. [3]
    Elastic Binary Executed from Shared Memory Directory

    Elastic. (n.d.). Binary Executed from Shared Memory Directory. Retrieved September 24, 2024.

    Open source URL
  4. [4]
    Akami Frog4Shell 2024

    Ori David. (2024, February 1). Frog4Shell — FritzFrog Botnet Adds One-Days to Its Arsenal. Retrieved September 24, 2024.

    Open source URL
  5. [5]
    Aquasec Muhstik Malware 2024

    Nitzan Yaakov. (2024, June 4). Muhstik Malware Targets Message Queuing Services Applications. Retrieved September 24, 2024.

    Open source URL
  6. [6]
    Bitsight 7777 Botnet

    Batista, João. Gi7w0rm. (2024, August 27). Retrieved June 5, 2025.

    Open source URL
  7. [7]
    CISCO Nexus 900 Config

    CISCO. (2021, September 14). Cisco Nexus 9000 Series NX-OS Fundamentals Configuration Guide, Release 7.x. Retrieved June 5, 2025.

    Open source URL
  8. [8]
    Sysdig Fileless Malware 23022

    Nicholas Lang. (2022, May 3). Fileless malware mitigation. Retrieved September 24, 2024.

    Open source URL
  9. [9]
    Prevailion DarkWatchman 2021

    Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.

    Open source URL
  10. [10]
    ESET Dukes October 2019

    Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.

    Open source URL
  11. [11]
    Red Canary Qbot

    Rainey, K. (n.d.). Qbot. Retrieved September 27, 2021.

    Open source URL
  12. [12]
    Group IB Ransomware September 2020

    Group IB. (2020, September). LOCK LIKE A PRO. Retrieved November 17, 2024.

    Open source URL
  13. [13]
    US-CERT TYPEFRAME June 2018

    US-CERT. (2018, June 14). MAR-10135536-12 – North Korean Trojan: TYPEFRAME. Retrieved July 13, 2018.

    Open source URL
  14. [14]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  15. [15]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  16. [16]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  17. [17]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  18. [18]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  19. [19]
    Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

    FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.

    Open source URL
  20. [20]
    Trend Micro Iron Tiger April 2021

    Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.

    Open source URL
  21. [21]
    ESET TeleBots Oct 2018

    Cherepanov, A., Lipovsky, R. (2018, October 11). New TeleBots backdoor: First evidence linking Industroyer to NotPetya. Retrieved November 27, 2018.

    Open source URL
  22. [22]
    ESET Grandoreiro April 2020

    ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020.

    Open source URL
  23. [23]
    Red Canary NETWIRE January 2020

    Lambert, T. (2020, January 29). Intro to Netwire. Retrieved January 7, 2021.

    Open source URL
  24. [24]
    Trustwave Pillowmint June 2020

    Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020.

    Open source URL
  25. [25]
    Talos TinyTurla September 2021

    Cisco Talos. (2021, September 21). TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines. Retrieved December 2, 2021.

    Open source URL
  26. [26]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  27. [27]
    ESET OceanLotus Mar 2019

    Dumont, R. (2019, March 20). Fake or Fake: Keeping up with OceanLotus decoys. Retrieved April 1, 2019.

    Open source URL
  28. [28]
    Elastic Pikabot 2024

    Daniel Stepanic & Salim Bitam. (2024, February 23). PIKABOT, I choose you!. Retrieved July 12, 2024.

    Open source URL
  29. [29]
    Unit 42 QUADAGENT July 2018

    Lee, B., Falcone, R. (2018, July 25). OilRig Targets Technology Service Provider and Government Agency with QUADAGENT. Retrieved August 9, 2018.

    Open source URL
  30. [30]
    Kaspersky ThreatNeedle Feb 2021

    Vyacheslav Kopeytsev and Seongsu Park. (2021, February 25). Lazarus targets defense industry with ThreatNeedle. Retrieved October 27, 2021.

    Open source URL
  31. [31]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  32. [32]
    Cybereason Valak May 2020

    Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020.

    Open source URL
  33. [33]
    Unit 42 Valak July 2020

    Duncan, B. (2020, July 24). Evolution of Valak, from Its Beginnings to Mass Distribution. Retrieved August 31, 2020.

    Open source URL
  34. [34]
    SentinelOne Valak June 2020

    Reaves, J. and Platt, J. (2020, June). Valak Malware and the Connection to Gozi Loader ConfCrew. Retrieved August 31, 2020.

    Open source URL
  35. [35]
    US-CERT Volgmer Nov 2017

    US-CERT. (2017, November 22). Alert (TA17-318B): HIDDEN COBRA – North Korean Trojan: Volgmer. Retrieved December 7, 2017.

    Open source URL
  36. [36]
    Symantec Volgmer Aug 2014

    Yagi, J. (2014, August 24). Trojan.Volgmer. Retrieved July 16, 2018.

    Open source URL
  37. [37]
    Cybereason Chaes Nov 2020

    Salem, E. (2020, November 17). CHAES: Novel Malware Targeting Latin American E-Commerce. Retrieved June 30, 2021.

    Open source URL
  38. [38]
    ESET Turla PowerShell May 2019

    Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.

    Open source URL
  39. [39]
    Symantec Waterbug Jun 2019

    Symantec DeepSight Adversary Intelligence Team. (2019, June 20). Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments. Retrieved July 8, 2019.

    Open source URL
  40. [40]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
  41. [41]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  42. [42]
    MSTIC NOBELIUM Mar 2021

    Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.

    Open source URL
  43. [43]
    ESET PipeMon May 2020

    Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti Group. Retrieved August 24, 2020.

    Open source URL
  44. [44]
    Cylance Sodinokibi July 2019

    Cylance. (2019, July 3). hreat Spotlight: Sodinokibi Ransomware. Retrieved August 4, 2020.

    Open source URL
  45. [45]
    Secureworks GandCrab and REvil September 2019

    Secureworks . (2019, September 24). REvil: The GandCrab Connection. Retrieved August 4, 2020.

    Open source URL
  46. [46]
    McAfee Sodinokibi October 2019

    McAfee. (2019, October 2). McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – What The Code Tells Us. Retrieved August 4, 2020.

    Open source URL
  47. [47]
    Intel 471 REvil March 2020

    Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.

    Open source URL
  48. [48]
    Secureworks REvil September 2019

    Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.

    Open source URL
  49. [49]
    ESET Turla Mosquito Jan 2018

    ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.

    Open source URL
  50. [50]
    Akami Frog4Shell 2024

    Ori David. (2024, February 1). Frog4Shell — FritzFrog Botnet Adds One-Days to Its Arsenal. Retrieved September 24, 2024.

    Open source URL
  51. [51]
    Akami Frog4Shell 2024

    Ori David. (2024, February 1). Frog4Shell — FritzFrog Botnet Adds One-Days to Its Arsenal. Retrieved September 24, 2024.

    Open source URL
  52. [52]
    Aquasec Muhstik Malware 2024

    Nitzan Yaakov. (2024, June 4). Muhstik Malware Targets Message Queuing Services Applications. Retrieved September 24, 2024.

    Open source URL
  53. [53]
    Aquasec Muhstik Malware 2024

    Nitzan Yaakov. (2024, June 4). Muhstik Malware Targets Message Queuing Services Applications. Retrieved September 24, 2024.

    Open source URL
  54. [54]
    Bitsight 7777 Botnet

    Batista, João. Gi7w0rm. (2024, August 27). Retrieved June 5, 2025.

    Open source URL
  55. [55]
    Bitsight 7777 Botnet

    Batista, João. Gi7w0rm. (2024, August 27). Retrieved June 5, 2025.

    Open source URL
  56. [56]
    CISCO Nexus 900 Config

    CISCO. (2021, September 14). Cisco Nexus 9000 Series NX-OS Fundamentals Configuration Guide, Release 7.x. Retrieved June 5, 2025.

    Open source URL
  57. [57]
    CISCO Nexus 900 Config

    CISCO. (2021, September 14). Cisco Nexus 9000 Series NX-OS Fundamentals Configuration Guide, Release 7.x. Retrieved June 5, 2025.

    Open source URL
  58. [58]
    Elastic Binary Executed from Shared Memory Directory

    Elastic. (n.d.). Binary Executed from Shared Memory Directory. Retrieved September 24, 2024.

    Open source URL
  59. [59]
    Elastic Binary Executed from Shared Memory Directory

    Elastic. (n.d.). Binary Executed from Shared Memory Directory. Retrieved September 24, 2024.

    Open source URL
  60. [60]
    Microsoft Fileless

    Microsoft. (2023, February 6). Fileless threats. Retrieved March 23, 2023.

    Open source URL
  61. [61]
    Microsoft Fileless

    Microsoft. (2023, February 6). Fileless threats. Retrieved March 23, 2023.

    Open source URL
  62. [62]
    SecureList Fileless

    Legezo, D. (2022, May 4). A new secret stash for “fileless” malware. Retrieved March 23, 2023.

    Open source URL
  63. [63]
    SecureList Fileless

    Legezo, D. (2022, May 4). A new secret stash for “fileless” malware. Retrieved March 23, 2023.

    Open source URL
  64. [64]
    Sysdig Fileless Malware 23022

    Nicholas Lang. (2022, May 3). Fileless malware mitigation. Retrieved September 24, 2024.

    Open source URL
  65. [65]
    Sysdig Fileless Malware 23022

    Nicholas Lang. (2022, May 3). Fileless malware mitigation. Retrieved September 24, 2024.

    Open source URL
  66. [66]
    mitre-attackT1027.011
    Open source URL
  67. [67]
    mitre-attackT1027.011
    Open source URL
  68. [68]
    mitre-attackT1027.011
    Open source URL
  69. [69]
    Prevailion DarkWatchman 2021

    Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.

    Open source URL
  70. [70]
    ESET Dukes October 2019

    Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.

    Open source URL
  71. [71]
    Group IB Ransomware September 2020

    Group IB. (2020, September). LOCK LIKE A PRO. Retrieved November 17, 2024.

    Open source URL
  72. [72]
    Red Canary Qbot

    Rainey, K. (n.d.). Qbot. Retrieved September 27, 2021.

    Open source URL
  73. [73]
    US-CERT TYPEFRAME June 2018

    US-CERT. (2018, June 14). MAR-10135536-12 – North Korean Trojan: TYPEFRAME. Retrieved July 13, 2018.

    Open source URL
  74. [74]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  75. [75]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  76. [76]
    Kaspersky ShadowPad Aug 2017

    Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.

    Open source URL
  77. [77]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  78. [78]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  79. [79]
    Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

    FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.

    Open source URL
  80. [80]
    Trend Micro Iron Tiger April 2021

    Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.

    Open source URL
  81. [81]
    ESET TeleBots Oct 2018

    Cherepanov, A., Lipovsky, R. (2018, October 11). New TeleBots backdoor: First evidence linking Industroyer to NotPetya. Retrieved November 27, 2018.

    Open source URL
  82. [82]
    ESET Grandoreiro April 2020

    ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020.

    Open source URL
  83. [83]
    Red Canary NETWIRE January 2020

    Lambert, T. (2020, January 29). Intro to Netwire. Retrieved January 7, 2021.

    Open source URL
  84. [84]
    Trustwave Pillowmint June 2020

    Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020.

    Open source URL
  85. [85]
    Talos TinyTurla September 2021

    Cisco Talos. (2021, September 21). TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines. Retrieved December 2, 2021.

    Open source URL
  86. [86]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  87. [87]
    ESET OceanLotus Mar 2019

    Dumont, R. (2019, March 20). Fake or Fake: Keeping up with OceanLotus decoys. Retrieved April 1, 2019.

    Open source URL
  88. [88]
    Elastic Pikabot 2024

    Daniel Stepanic & Salim Bitam. (2024, February 23). PIKABOT, I choose you!. Retrieved July 12, 2024.

    Open source URL
  89. [89]
    Unit 42 QUADAGENT July 2018

    Lee, B., Falcone, R. (2018, July 25). OilRig Targets Technology Service Provider and Government Agency with QUADAGENT. Retrieved August 9, 2018.

    Open source URL
  90. [90]
    ESET Dukes October 2019

    Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.

    Open source URL
  91. [91]
    ESET Dukes October 2019

    Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.

    Open source URL
  92. [92]
    Kaspersky ThreatNeedle Feb 2021

    Vyacheslav Kopeytsev and Seongsu Park. (2021, February 25). Lazarus targets defense industry with ThreatNeedle. Retrieved October 27, 2021.

    Open source URL
  93. [93]
    Bitsight 7777 Botnet

    Batista, João. Gi7w0rm. (2024, August 27). Retrieved June 5, 2025.

    Open source URL
  94. [94]
    Bitsight 7777 Botnet

    Batista, João. Gi7w0rm. (2024, August 27). Retrieved June 5, 2025.

    Open source URL
  95. [95]
    Cybereason OperationCuckooBees May 2022

    Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.

    Open source URL
  96. [96]
    Cybereason Valak May 2020

    Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020.

    Open source URL
  97. [97]
    SentinelOne Valak June 2020

    Reaves, J. and Platt, J. (2020, June). Valak Malware and the Connection to Gozi Loader ConfCrew. Retrieved August 31, 2020.

    Open source URL
  98. [98]
    Unit 42 Valak July 2020

    Duncan, B. (2020, July 24). Evolution of Valak, from Its Beginnings to Mass Distribution. Retrieved August 31, 2020.

    Open source URL
  99. [99]
    Symantec Volgmer Aug 2014

    Yagi, J. (2014, August 24). Trojan.Volgmer. Retrieved July 16, 2018.

    Open source URL
  100. [100]
    US-CERT Volgmer Nov 2017

    US-CERT. (2017, November 22). Alert (TA17-318B): HIDDEN COBRA – North Korean Trojan: Volgmer. Retrieved December 7, 2017.

    Open source URL
  101. [101]
    Cybereason Chaes Nov 2020

    Salem, E. (2020, November 17). CHAES: Novel Malware Targeting Latin American E-Commerce. Retrieved June 30, 2021.

    Open source URL
  102. [102]
    ESET Turla PowerShell May 2019

    Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.

    Open source URL
  103. [103]
    Symantec Waterbug Jun 2019

    Symantec DeepSight Adversary Intelligence Team. (2019, June 20). Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments. Retrieved July 8, 2019.

    Open source URL
  104. [104]
    Profero APT27 December 2020

    Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.

    Open source URL
  105. [105]
    Trend Micro DRBControl February 2020

    Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use