LiveActive security incident?Get immediate response
MITRE ATT&CK® Technique

T1027.013: Encrypted/Encoded File

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within a file used in an intrusion. Many other techniques, such as Software Packing, Steganography, and Embedded Payloads, share this same broad objective. Encrypting and/or encoding files could lead to a lapse in detection of static signatures, only for this malicious content to be revealed (i.e., Deobfuscate/Decode Files or Information) at the time of execution/use.

This type of file obfuscation can be applied to many file artifacts present on victim hosts, such as malware log/configuration and payload files.[1] Files can be encrypted with a hardcoded or user-supplied key, as well as otherwise obfuscated using standard encoding schemes such as Base64.

The entire content of a file may be obfuscated, or just specific functions or values (such as C2 addresses). Encryption and encoding may also be applied in redundant layers for additional protection.

For example, adversaries may abuse password-protected Word documents or self-extracting (SFX) archives as a method of encrypting/encoding a file such as a Phishing payload. These files typically function by attaching the intended archived content to a decompressor stub that is executed when the file is invoked (e.g., User Execution).[2]

Adversaries may also abuse file-specific as well as custom encoding schemes. For example, Byte Order Mark (BOM) headers in text files may be abused to manipulate and obfuscate file content until Command and Scripting Interpreter execution.

EnterpriseT1027.013Sub-techniqueObject v2.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Encrypted or encoded files matter because they can make malicious content look harmless until it is decoded or used. For leaders, the risk is not the encoding itself; it is whether endpoint, email, file, and investigation workflows can still recognize suspicious behavior when static signatures miss hidden payloads, configuration values, or command-and-control details.

Executive priority

Prioritize this as a detection-resilience and incident-readiness issue across Linux, macOS, and Windows endpoints. Ask whether security teams can prove coverage beyond file signatures: behavioral prevention on endpoints, antimalware health, collection of file/process evidence, and response procedures for password-protected documents, self-extracting archives, Base64-like content, and files that decode at execution time. The ATT&CK relationships to multiple campaigns and groups make this a broadly relevant tradecraft pattern, but local exposure depends on your environment and telemetry.

Technical view

SOC and IR teams should validate detection around files whose contents are encrypted, encoded, layered, or revealed only during execution or use, especially where related behaviors include user execution, phishing payload delivery, command/scripting interpreter activity, and deobfuscation/decoding. Because MITRE provides no official detection text for this sub-technique, use the related DET0087 detection strategy and test whether endpoint behavior analytics, antimalware, and file inspection workflows can connect suspicious file creation or opening with follow-on process, script, archive, or decode activity.

Likely telemetry

  • Endpoint file creation, modification, quarantine, and scan results
  • Process execution lineage for documents, archives, self-extracting executables, scripts, and interpreters
  • Command-line and script content where collected
  • Antivirus/antimalware detections, prevention events, and update status
  • Endpoint behavior-prevention alerts involving suspicious file, process, or API activity

Detection direction

  • Do not rely only on static signatures; validate behavior-based detection for encoded or encrypted content that is decoded at runtime.
  • Tune analytics to connect suspicious files with follow-on execution, scripting, archive extraction, or deobfuscation activity rather than alerting on encoding alone.
  • Review blind spots for password-protected documents, self-extracting archives, custom encodings, and files with only selected values obfuscated, such as embedded addresses or configuration data.
  • Expect false positives from legitimate compressed, encrypted, or encoded files; require contextual signals such as source, user action, process lineage, and subsequent execution.
  • Use the relationship to Obfuscated Files or Information and Deobfuscate/Decode Files or Information as investigation pivots when reconstructing intrusion activity.

Mitigation priorities

  • Maintain antimalware across supported endpoints with current updates and central visibility into detections and failures.
  • Prioritize behavior prevention on endpoints so suspicious process, file, and API activity can be blocked or escalated even when content is hidden from signatures.
  • Harden handling of risky file types and delivery paths, especially documents, archives, and self-extracting files received through user-driven workflows.
  • Ensure IR playbooks include safe extraction, decoding, and analysis procedures for suspicious files without depending on the original visible content.
  • Use control validation exercises to confirm Linux, macOS, and Windows coverage rather than assuming one platform’s detection logic transfers to another.
Additional notes and limits

This sub-technique is a stealth behavior under T1027, focused on concealing file content with encryption, encoding, or layered obfuscation. ATT&CK lists many campaign and group relationships, which supports broad relevance, but those relationships should guide threat-informed validation rather than imply current targeting of any specific organization.

MITRE does not provide official detection guidance for this object in the supplied fields. The available object describes behavior and related mitigations at a high level, so detection quality must be determined from local telemetry, endpoint tooling, file-handling controls, and incident response evidence.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Encrypted/Encoded File

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within a file used in an intrusion. Many other techniques, such as Software Packing, Steganography, and Embedded Payloads, share this same broad objective. Encrypting and/or encoding files could lead to a lapse in detection of static signatures, only for this malicious content to be revealed (i.e., Deobfuscate/Decode Files or Information) at the time of execution/use.

This type of file obfuscation can be applied to many file artifacts present on victim hosts, such as malware log/configuration and payload files.[1] Files can be encrypted with a hardcoded or user-supplied key, as well as otherwise obfuscated using standard encoding schemes such as Base64.

The entire content of a file may be obfuscated, or just specific functions or values (such as C2 addresses). Encryption and encoding may also be applied in redundant layers for additional protection.

For example, adversaries may abuse password-protected Word documents or self-extracting (SFX) archives as a method of encrypting/encoding a file such as a Phishing payload. These files typically function by attaching the intended archived content to a decompressor stub that is executed when the file is invoked (e.g., User Execution).[2]

Adversaries may also abuse file-specific as well as custom encoding schemes. For example, Byte Order Mark (BOM) headers in text files may be abused to manipulate and obfuscate file content until Command and Scripting Interpreter execution.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
DomainIDNameRelationship / procedure
EnterpriseT1027Obfuscated Files or InformationThis object subtechnique of Obfuscated Files or Information.
Associated objects

Groups, software, and campaigns

GroupEnterprise

G0100: Inception

Inception is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East.[1][2][3]

GroupEnterprise

G0066: Elderwood

Elderwood is a suspected Chinese cyber espionage group that was reportedly responsible for the 2009 Google intrusion known as Operation Aurora. [1] The group has targeted defense organizations, supply chain manufacturers, human rights and nongovernmental organizations (NGOs), and IT service providers. [2] [3]

GroupEnterprise

G0012: Darkhotel

Darkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. Darkhotel has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks.[1][2][3]

GroupEnterprise

G0007: APT28

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]

APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.

GroupEnterprise

G0026: APT18

APT18 is a threat group that has operated since at least 2009 and has targeted a range of industries, including technology, manufacturing, human rights groups, government, and medical. [1]

GroupEnterprise

G0065: Leviathan

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.[1] Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.[1][2][3][4]

GroupEnterprise

G0121: Sidewinder

Sidewinder is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan.[1][2][3]

GroupEnterprise

G0087: APT39

APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.[1][2][3][4][5]

GroupEnterprise

G0032: Lazarus Group

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]

North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]

GroupEnterprise

G1031: Saint Bear

Saint Bear is a Russian-nexus threat actor active since early 2021, primarily targeting entities in Ukraine and Georgia. The group is notable for a specific remote access tool, Saint Bot, and information stealer, OutSteel in campaigns. Saint Bear typically relies on phishing or web staging of malicious documents and related file types for initial access, spoofing government or related entities.[1][2] Saint Bear has previously been confused with Ember Bear operations, but analysis of behaviors, tools, and targeting indicates these are distinct clusters.

MalwareEnterprise

S1052: DEADEYE

DEADEYE is a malware launcher that has been used by APT41 since at least May 2021. DEADEYE has variants that can either embed a payload inside a compiled binary (DEADEYE.EMBED) or append it to the end of a file (DEADEYE.APPEND).[1]

Windows
MalwareEnterprise

S1242: Qilin

Qilin is a ransomware family operated as a ransomware-as-a-service (RaaS) that has been active since at least 2022. It includes variants written in Go and Rust capable of targeting Windows, Linux, and VMware ESXi environments. Qilin shares functionality overlaps with Black Basta, REvil, and BlackCat ransomware. Qilin affiliates have targeted multiple entities worldwide with the majority of victims in the US, France, Canada, and the UK, primarily in the manufacturing, technology, financial services, and healthcare sectors.[1][2][3][4][5]

ESXiWindowsLinux
MalwareEnterprise

S0678: Torisma

Torisma is a second stage implant designed for specialized monitoring that has been used by Lazarus Group. Torisma was discovered during an investigation into the 2020 Operation North Star campaign that targeted the defense sector.[1]

Windows
MalwareEnterprise

S0136: USBStealer

USBStealer is malware that has been used by APT28 since at least 2005 to extract information from air-gapped networks. It does not have the capability to communicate over the Internet and has been used in conjunction with ADVSTORESHELL. [1] [2]

Windows
MalwareEnterprise

S1153: Cuckoo Stealer

Cuckoo Stealer is a macOS malware with characteristics of spyware and an infostealer that has been in use since at least 2024. Cuckoo Stealer is a universal Mach-O binary that can run on Intel or ARM-based Macs and has been spread through trojanized versions of various potentially unwanted programs or PUP's such as converters, cleaners, and uninstallers.[1][2]

macOS
MalwareEnterprise

S0487: Kessel

Kessel is an advanced version of OpenSSH which acts as a custom backdoor, mainly acting to steal credentials and function as a bot. Kessel has been active since its C2 domain began resolving in August 2018.[1]

Linux
MalwareEnterprise

S0386: Ursnif

Ursnif is a banking trojan and variant of the Gozi malware observed being spread through various automated exploit kits, Spearphishing Attachments, and malicious links.[1][2] Ursnif is associated primarily with data theft, but variants also include components (backdoors, spyware, file injectors, etc.) capable of a wide variety of behaviors.[3]

Windows
CampaignEnterprise

C0045: ShadowRay

ShadowRay was a campaign that began in late 2023 targeting the education, cryptocurrency, biopharma, and other sectors through a vulnerability (CVE-2023-48022) in the Ray AI framework named ShadowRay. According to security researchers ShadowRay was the first known instance of AI workloads being activley exploited in the wild through vulnerabilities in AI infrastructure. CVE-2023-48022, which allows access to compute resources and sensitive data for exposed instances, remains unpatched and has been disputed by the vendor as they maintain that Ray is not intended for use outside of a strictly controlled network environment.[1]

CampaignEnterprise

C0002: Night Dragon

Night Dragon was a cyber espionage campaign that targeted oil, energy, and petrochemical companies, along with individuals and executives in Kazakhstan, Taiwan, Greece, and the United States. The unidentified threat actors searched for information related to oil and gas field production systems, financials, and collected data from SCADA systems. Based on the observed techniques, tools, and network activities, security researchers assessed the campaign involved a threat group based in China.[1]

CampaignEnterprise

C0006: Operation Honeybee

Operation Honeybee was a campaign that targeted humanitarian aid and inter-Korean affairs organizations from at least late 2017 through early 2018. Operation Honeybee initially targeted South Korea, but expanded to include Vietnam, Singapore, Japan, Indonesia, Argentina, and Canada. Security researchers assessed the threat actors were likely Korean speakers based on metadata used in both lure documents and executables, and named the campaign "Honeybee" after the author name discovered in malicious Word documents.[1]

CampaignEnterprise

C0063: 2025 Poland Wiper Attacks

2025 Poland Wiper Attacks is a Russian state-sponsored campaign that conducted destructive cyberattacks against Polish energy infrastructure in December 2025. Targets included more than 30 wind and photovoltaic farms, a combined heat and power (CHP) plant, and a manufacturing sector company. The attacks on the distributed energy resources (DER) disrupted communications between affected facilities and the distribution system operator, but did not impact electricity generation or heat supply. Across the campaign, threat actors deployed two previously undocumented wiper tools, DynoWiper, a Windows-based wiper and LazyWiper, a PowerShell wiper, distributed via malicious Group Policy Objects. At the CHP plant, threat actors had maintained access since at least March 2025, using that foothold to obtain credentials and move laterally before attempting wiper deployment. Some reporting has assessed the activity to be consistent with Russian Federal Security Service (FSB) threat activity group Dragonfly, also tracked as STATIC TUNDRA, while other reporting attributes the destructive wiper activities to the Russian General Staff Main Intelligence Directorate (GRU) threat activity group ELECTRUM, also tracked as Sandworm Team.[1][2][3][4]

Relationship explorer

All related ATT&CK context

uses · MalwareS1052: DEADEYEEnterpriseuses · MalwareS1242: QilinEnterpriseuses · MalwareS0678: TorismaEnterpriseuses · MalwareS0352: OSX_OCEANLOTUS.DEnterpriseuses · GroupG0100: InceptionEnterpriseuses · MalwareS0136: USBStealerEnterpriseuses · MalwareS0082: EmissaryEnterpriseuses · MalwareS1153: Cuckoo StealerEnterpriseuses · MalwareS0487: KesselEnterpriseuses · MalwareS0565: RaindropEnterpriseuses · MalwareS0433: RifdoorEnterpriseuses · GroupG0070: Dark CaracalEnterpriseuses · GroupG0066: ElderwoodEnterprisesubtechnique of · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · MalwareS1019: SharkEnterpriseuses · MalwareS0386: UrsnifEnterpriseuses · MalwareS9037: RustyWaterEnterpriseuses · MalwareS1150: ROADSWEEPEnterpriseuses · MalwareS1233: PAKLOGEnterpriseuses · GroupG0012: DarkhotelEnterpriseuses · CampaignC0045: ShadowRayEnterpriseuses · GroupG0134: Transparent TribeEnterpriseuses · MalwareS1212: RansomHubEnterpriseuses · MalwareS1100: NinjaEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.0
Created
Modified
Raw hash
5e60abc7c165f152...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.0Current bundle5e60abc7c165…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    File obfuscation

    Aspen Lindblom, Joseph Goodwin, and Chris Sheldon. (2021, July 19). Shlayer Malvertising Campaigns Still Using Flash Update Disguise. Retrieved March 29, 2024.

    Open source URL
  2. [2]
    SFX - Encrypted/Encoded File

    Jai Minton. (2023, March 31). How Falcon OverWatch Investigates Malicious Self-Extracting Archives, Decoy Files and Their Hidden Payloads. Retrieved March 29, 2024.

    Open source URL
  3. [3]
    Mandiant APT41

    Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022.

    Open source URL
  4. [4]
    HC3 Qilin Threat Profile JUN 2024

    Health Sector Cybersecurity Coordination Center. (2024, June 18). Qilin, aka Agenda Ransomware. Retrieved September 26, 2025.

    Open source URL
  5. [5]
    McAfee Lazarus Nov 2020

    Beek, C. (2020, November 5). Operation North Star: Behind The Scenes. Retrieved December 20, 2021.

    Open source URL
  6. [6]
    TrendMicro MacOS April 2018

    Horejsi, J. (2018, April 04). New MacOS Backdoor Linked to OceanLotus Found. Retrieved November 13, 2018.

    Open source URL
  7. [7]
    Kaspersky Cloud Atlas December 2014

    GReAT. (2014, December 10). Cloud Atlas: RedOctober APT is back in style. Retrieved May 8, 2020.

    Open source URL
  8. [8]
    ESET Sednit USBStealer 2014

    Calvet, J. (2014, November 11). Sednit Espionage Group Attacking Air-Gapped Networks. Retrieved January 4, 2017.

  9. [9]
    Lotus Blossom Dec 2015

    Falcone, R. and Miller-Osborn, J.. (2015, December 18). Attack on French Diplomat Linked to Operation Lotus Blossom. Retrieved February 15, 2016.

  10. [10]
    Emissary Trojan Feb 2016

    Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.

  11. [11]
    Kandji Cuckoo April 2024

    Kohler, A. and Lopez, C. (2024, April 30). Malware: Cuckoo Behaves Like Cross Between Infostealer and Spyware. Retrieved August 20, 2024.

    Open source URL
  12. [12]
    SentinelOne Cuckoo Stealer May 2024

    Stokes, P. (2024, May 9). macOS Cuckoo Stealer | Ensuring Detection and Defense as New Samples Rapidly Emerge. Retrieved August 20, 2024.

    Open source URL
  13. [13]
    ESET ForSSHe December 2018

    Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.

    Open source URL
  14. [14]
    Symantec RAINDROP January 2021

    Symantec Threat Hunter Team. (2021, January 18). Raindrop: New Malware Discovered in SolarWinds Investigation. Retrieved January 19, 2021.

    Open source URL
  15. [15]
    Microsoft Deep Dive Solorigate January 2021

    MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.

    Open source URL
  16. [16]
    Carbon Black HotCroissant April 2020

    Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020.

    Open source URL
  17. [17]
    Lookout Dark Caracal Jan 2018

    Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.

    Open source URL
  18. [18]
    Symantec Elderwood Sept 2012

    O'Gorman, G., and McDonald, G.. (2012, September 6). The Elderwood Project. Retrieved November 17, 2024.

    Open source URL
  19. [19]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  20. [20]
    Accenture Lyceum Targets November 2021

    Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.

    Open source URL
  21. [21]
    ProofPoint Ursnif Aug 2016

    Proofpoint Staff. (2016, August 25). Nightmare on Tor Street: Ursnif variant Dreambot adds Tor functionality. Retrieved June 5, 2019.

    Open source URL
  22. [22]
    Bromium Ursnif Mar 2017

    Holland, A. (2019, March 7). Tricks and COMfoolery: How Ursnif Evades Detection. Retrieved June 10, 2019.

    Open source URL
  23. [23]
    CloudSEK_RustyWater_Jan2026

    Awasthi, P. (2026, January 8). Reborn in Rust: Muddy Water Evolves Tooling with RustyWater Implant. Retrieved March 19, 2026.

    Open source URL
  24. [24]
    Mandiant ROADSWEEP August 2022

    Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.

    Open source URL
  25. [25]
    CISA Iran Albanian Attacks September 2022

    CISA. (2022, September 23). AA22-264A Iranian State Actors Conduct Cyber Operations Against the Government of Albania. Retrieved August 6, 2024.

    Open source URL
  26. [26]
    Microsoft Albanian Government Attacks September 2022

    MSTIC. (2022, September 8). Microsoft investigates Iranian attacks against the Albanian government. Retrieved August 6, 2024.

    Open source URL
  27. [27]
    Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2. Retrieved September 12, 2025.

    Open source URL
  28. [28]
    Securelist Darkhotel Aug 2015

    Kaspersky Lab's Global Research & Analysis Team. (2015, August 10). Darkhotel's attacks in 2015. Retrieved November 2, 2018.

    Open source URL
  29. [29]
    Microsoft DUBNIUM July 2016

    Microsoft. (2016, July 14). Reverse engineering DUBNIUM – Stage 2 payload analysis . Retrieved March 31, 2021.

    Open source URL
  30. [30]
    Oligo ShadowRay Campaign MAR 2024

    Lumelsly, A. et al. (2024, March 26). ShadowRay: First Known Attack Campaign Targeting AI Workloads Actively Exploited In The Wild. Retrieved December 2, 2024.

    Open source URL
  31. [31]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  32. [32]
    Group-IB RansomHub FEB 2025

    Alfano, V. et al. (2025, February 12). RansomHub Never Sleeps Episode 1: The evolution of modern ransomware. Retrieved March 17, 2025.

    Open source URL
  33. [33]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  34. [34]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  35. [35]
    Bitdefender APT28 Dec 2015

    Bitdefender. (2015, December). APT28 Under the Scope. Retrieved February 23, 2017.

    Open source URL
  36. [36]
    Unit 42 Sofacy Feb 2018

    Lee, B, et al. (2018, February 28). Sofacy Attacks Multiple Government Entities. Retrieved March 15, 2018.

    Open source URL
  37. [37]
    Palo Alto Sofacy 06-2018

    Lee, B., Falcone, R. (2018, June 06). Sofacy Group’s Parallel Attacks. Retrieved June 18, 2018.

    Open source URL
  38. [38]
    Talos Seduploader Oct 2017

    Mercer, W., et al. (2017, October 22). "Cyber Conflict" Decoy Document Used in Real Cyber Conflict. Retrieved November 2, 2018.

    Open source URL
  39. [39]
    Accenture SNAKEMACKEREL Nov 2018

    Accenture Security. (2018, November 29). SNAKEMACKEREL. Retrieved April 15, 2019.

    Open source URL
  40. [40]
    FireEye HAWKBALL Jun 2019

    Patil, S. and Williams, M.. (2019, June 5). Government Sector in Central Asia Targeted With New HAWKBALL Backdoor Delivered via Microsoft Office Vulnerabilities. Retrieved June 20, 2019.

    Open source URL
  41. [41]
    Trend Micro Skidmap

    Remillano, A., Urbanec, J. (2019, September 19). Skidmap Linux Malware Uses Rootkit Capabilities to Hide Cryptocurrency-Mining Payload. Retrieved June 4, 2020.

    Open source URL
  42. [42]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  43. [43]
    PaloAlto DNS Requests May 2016

    Grunzweig, J., et al. (2016, May 24). New Wekby Attacks Use DNS Requests As Command and Control Mechanism. Retrieved November 15, 2018.

    Open source URL
  44. [44]
    Dell Sakula

    Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, July 30). Sakula Malware Family. Retrieved January 26, 2016.

  45. [45]
    Novetta-Axiom

    Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.

    Open source URL
  46. [46]
    Palo Alto OilRig May 2016

    Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.

  47. [47]
    Sophos SamSam Apr 2018

    Palotay, D. and Mackenzie, P. (2018, April). SamSam Ransomware Chooses Its Targets Carefully. Retrieved April 15, 2019.

    Open source URL
  48. [48]
    Talos SamSam Jan 2018

    Ventura, V. (2018, January 22). SamSam - The Evolution Continues Netting Over $325,000 in 4 Weeks. Retrieved April 16, 2019.

    Open source URL
  49. [49]
    ESET Operation Groundbait

    Cherepanov, A.. (2016, May 17). Operation Groundbait: Analysis of a surveillance toolkit. Retrieved May 18, 2016.

  50. [50]
    fsecure NanHaiShu July 2016

    F-Secure Labs. (2016, July). NANHAISHU RATing the South China Sea. Retrieved July 6, 2018.

    Open source URL
  51. [51]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  52. [52]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  53. [53]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  54. [54]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  55. [55]
    Cybereason Bazar July 2020

    Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.

    Open source URL
  56. [56]
    NCC Group Team9 June 2020

    Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.

    Open source URL
  57. [57]
    CrowdStrike Wizard Spider October 2020

    Podlosky, A., Hanel, A. et al. (2020, October 16). WIZARD SPIDER Update: Resilient, Reactive and Resolute. Retrieved June 15, 2021.

    Open source URL
  58. [58]
    Sentinel Labs LockBit 3.0 JUL 2022

    Walter, J. (2022, July 21). LockBit 3.0 Update | Unpicking the Ransomware’s Latest Anti-Analysis and Evasion Techniques. Retrieved February 5, 2025.

    Open source URL
  59. [59]
    Joint Cybersecurity Advisory LockBit 3.0 MAR 2023

    FBI et al. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved February 5, 2025.

    Open source URL
  60. [60]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  61. [61]
    Kaspersky LODEINFO OCT 2022

    Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part I. Retrieved April 17, 2026.

    Open source URL
  62. [62]
    ATT Sidewinder January 2021

    Hegel, T. (2021, January 13). A Global Perspective of the SideWinder APT. Retrieved January 27, 2021.

    Open source URL
  63. [63]
    Rewterz Sidewinder APT April 2020

    Rewterz. (2020, April 20). Sidewinder APT Group Campaign Analysis. Retrieved January 29, 2021.

    Open source URL
  64. [64]
    Cyble Sidewinder September 2020

    Cyble. (2020, September 26). SideWinder APT Targets with futuristic Tactics and Techniques. Retrieved January 29, 2021.

    Open source URL
  65. [65]
    Google Cloud Mandiant UNC3886 2024

    Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024.

    Open source URL
  66. [66]
    Volexity InkySquid BLUELIGHT August 2021

    Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.

    Open source URL
  67. [67]
    ESET PipeMon May 2020

    Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti Group. Retrieved August 24, 2020.

    Open source URL
  68. [68]
    MalwareBytes WoodyRAT Aug 2022

    MalwareBytes Threat Intelligence Team. (2022, August 3). Woody RAT: A new feature-rich malware spotted in the wild. Retrieved December 6, 2022.

    Open source URL
  69. [69]
    Checkpoint MosesStaff Nov 2021

    Checkpoint Research. (2021, November 15). Uncovering MosesStaff techniques: Ideology over Money. Retrieved August 11, 2022.

    Open source URL
  70. [70]
    FBI FLASH APT39 September 2020

    FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020.

    Open source URL
  71. [71]
    ESET HiddenFace 2024

    Breitenbacher, D. (2024). Unmasking HiddenFace. Retrieved April 17, 2026.

    Open source URL
  72. [72]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  73. [73]
    Talos GravityRAT

    Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.

    Open source URL
  74. [74]
    Medium Metamorfo Apr 2020

    Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020.

    Open source URL
  75. [75]
    ESET Casbaneiro Oct 2019

    ESET Research. (2019, October 3). Casbaneiro: peculiarities of this banking Trojan that affects Brazil and Mexico. Retrieved September 23, 2021.

    Open source URL
  76. [76]
    Novetta Blockbuster

    Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.

    Open source URL
  77. [77]
    Novetta Blockbuster Loaders

    Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Loaders, Installers and Uninstallers Report. Retrieved November 17, 2024.

    Open source URL
  78. [78]
    Novetta Blockbuster RATs

    Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Remote Administration Tools & Content Staging Malware Report. Retrieved March 16, 2016.

    Open source URL
  79. [79]
    McAfee Lazarus Resurfaces Feb 2018

    Sherstobitoff, R. (2018, February 12). Lazarus Resurfaces, Targets Global Banks and Bitcoin Users. Retrieved February 19, 2018.

    Open source URL
  80. [80]
    TrendMicro macOS Dacls May 2020

    Mabutas, G. (2020, May 11). New MacOS Dacls RAT Backdoor Shows Lazarus’ Multi-Platform Attack Capability. Retrieved August 10, 2020.

    Open source URL
  81. [81]
    Lazarus APT January 2022

    Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022.

    Open source URL
  82. [82]
    Qualys LolZarus

    Pradhan, A. (2022, February 8). LolZarus: Lazarus Group Incorporating Lolbins into Campaigns. Retrieved March 22, 2022.

    Open source URL
  83. [83]
    Zscaler XLoader 2025

    Zscaler Threatlabz. (2025, January 27). Technical Analysis of Xloader Versions 6 and 7 | Part 1. Retrieved March 11, 2025.

    Open source URL
  84. [84]
    ANY.RUN XLoader 2023

    ANY.RUN. (2023, February 28). XLoader/FormBook: Encryption Analysis and Malware Decryption . Retrieved March 11, 2025.

    Open source URL
  85. [85]
    Palo Alto Unit 42 OutSteel SaintBot February 2022

    Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.

    Open source URL
  86. [86]
    FireEye APT33 Guardrail

    Ackerman, G., et al. (2018, December 21). OVERRULED: Containing a Potentially Destructive Adversary. Retrieved January 17, 2019.

    Open source URL
  87. [87]
    Symantec Bilbug 2022

    Symntec Threat Hunter Team. (2022, November 12). Billbug: State-sponsored Actor Targets Cert Authority, Government Agencies in Multiple Asian Countries. Retrieved March 15, 2025.

    Open source URL
  88. [88]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  89. [89]
    McAfee Night Dragon

    McAfee® Foundstone® Professional Services and McAfee Labs™. (2011, February 10). Global Energy Cyberattacks: “Night Dragon”. Retrieved February 19, 2018.

    Open source URL
  90. [90]
    ESET LightNeuron May 2019

    Faou, M. (2019, May). Turla LightNeuron: One email away from remote code execution. Retrieved June 24, 2019.

    Open source URL
  91. [91]
    SecureWorks August 2019

    SecureWorks 2019, August 27 LYCEUM Takes Center Stage in Middle East Campaign Retrieved. 2019/11/19

    Open source URL
  92. [92]
    FireEye FELIXROOT July 2018

    Patil, S. (2018, June 26). Microsoft Office Vulnerabilities Used to Distribute FELIXROOT Backdoor in Recent Campaign. Retrieved November 17, 2024.

    Open source URL
  93. [93]
    ESET GreyEnergy Oct 2018

    Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.

    Open source URL
  94. [94]
    Symantec Remsec IOCs

    Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.

  95. [95]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  96. [96]
    Donut Github

    TheWover. (2019, May 9). donut. Retrieved March 25, 2022.

    Open source URL
  97. [97]
    SentinelOne SocGholish Infrastructure November 2022

    Milenkoski, A. (2022, November 7). SocGholish Diversifies and Expands Its Malware Staging Infrastructure to Counter Defenders. Retrieved March 22, 2024.

    Open source URL
  98. [98]
    Aryaka Kimsuky July 2025

    Varadharajan Krishnasamy, Aditya K Sood. (2025, July 29). From Reconnaissance to Control: The Operational Blueprint of Kimsuky APT for Cyber Espionage. Retrieved April 18, 2026.

    Open source URL
  99. [99]
    Gen Digital Kimsuky HTTPTroy October 2025

    Alexndru-Cristian Bardas. (2025, October 30). DPRK’s Playbook: Kimsuky’s HttpTroy and Lazarus’s New BLINDINGCAN Variant. Retrieved April 8, 2026.

    Open source URL
  100. [100]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  101. [101]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  102. [102]
    McAfee Honeybee

    Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018.

    Open source URL
  103. [103]
    objective-see windtail2 jan 2019

    Wardle, Patrick. (2019, January 15). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 2). Retrieved October 3, 2019.

    Open source URL
  104. [104]
    ESET Grandoreiro April 2020

    ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020.

    Open source URL
  105. [105]
    Kaspersky Lyceum October 2021

    Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.

    Open source URL
  106. [106]
    US-CERT BLINDINGCAN Aug 2020

    US-CERT. (2020, August 19). MAR-10295134-1.v1 – North Korean Remote Access Trojan: BLINDINGCAN. Retrieved August 19, 2020.

    Open source URL
  107. [107]
    CERT Polska

    CERT Polska. (2026, January 30). Energy Sector Incident Report – 29 December. Retrieved April 22, 2026.

    Open source URL
  108. [108]
    Malwarebytes Konni Aug 2021

    Threat Intelligence Team. (2021, August 23). New variant of Konni malware used in campaign targetting Russia. Retrieved January 5, 2022.

    Open source URL
  109. [109]
    Forcepoint Monsoon

    Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.

    Open source URL
  110. [110]
    Forcepoint BITTER Pakistan Oct 2016

    Dela Paz, R. (2016, October 21). BITTER: a targeted attack against Pakistan. Retrieved June 1, 2022.

    Open source URL
  111. [111]
    Cisco Ukraine Wipers January 2022

    Biasini, N. et al.. (2022, January 21). Ukraine Campaign Delivers Defacement and Wipers, in Continued Escalation. Retrieved March 14, 2022.

    Open source URL
  112. [112]
    Medium S2W WhisperGate January 2022

    S2W. (2022, January 18). Analysis of Destructive Malware (WhisperGate) targeting Ukraine. Retrieved March 14, 2022.

    Open source URL
  113. [113]
    RecordedFuture WhisperGate Jan 2022

    Insikt Group. (2020, January 28). WhisperGate Malware Corrupts Computers in Ukraine. Retrieved September 16, 2024.

    Open source URL
  114. [114]
    File obfuscation

    Aspen Lindblom, Joseph Goodwin, and Chris Sheldon. (2021, July 19). Shlayer Malvertising Campaigns Still Using Flash Update Disguise. Retrieved March 29, 2024.

    Open source URL
  115. [115]
    File obfuscation

    Aspen Lindblom, Joseph Goodwin, and Chris Sheldon. (2021, July 19). Shlayer Malvertising Campaigns Still Using Flash Update Disguise. Retrieved March 29, 2024.

    Open source URL
  116. [116]
    SFX - Encrypted/Encoded File

    Jai Minton. (2023, March 31). How Falcon OverWatch Investigates Malicious Self-Extracting Archives, Decoy Files and Their Hidden Payloads. Retrieved March 29, 2024.

    Open source URL
  117. [117]
    SFX - Encrypted/Encoded File

    Jai Minton. (2023, March 31). How Falcon OverWatch Investigates Malicious Self-Extracting Archives, Decoy Files and Their Hidden Payloads. Retrieved March 29, 2024.

    Open source URL
  118. [118]
    mitre-attackT1027.013
    Open source URL
  119. [119]
    mitre-attackT1027.013
    Open source URL
  120. [120]
    mitre-attackT1027.013
    Open source URL
  121. [121]
    Mandiant APT41

    Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022.

    Open source URL
  122. [122]
    HC3 Qilin Threat Profile JUN 2024

    Health Sector Cybersecurity Coordination Center. (2024, June 18). Qilin, aka Agenda Ransomware. Retrieved September 26, 2025.

    Open source URL
  123. [123]
    McAfee Lazarus Nov 2020

    Beek, C. (2020, November 5). Operation North Star: Behind The Scenes. Retrieved December 20, 2021.

    Open source URL
  124. [124]
    TrendMicro MacOS April 2018

    Horejsi, J. (2018, April 04). New MacOS Backdoor Linked to OceanLotus Found. Retrieved November 13, 2018.

    Open source URL
  125. [125]
    Kaspersky Cloud Atlas December 2014

    GReAT. (2014, December 10). Cloud Atlas: RedOctober APT is back in style. Retrieved May 8, 2020.

    Open source URL
  126. [126]
    ESET Sednit USBStealer 2014

    Calvet, J. (2014, November 11). Sednit Espionage Group Attacking Air-Gapped Networks. Retrieved January 4, 2017.

  127. [127]
    Emissary Trojan Feb 2016

    Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.

  128. [128]
    Lotus Blossom Dec 2015

    Falcone, R. and Miller-Osborn, J.. (2015, December 18). Attack on French Diplomat Linked to Operation Lotus Blossom. Retrieved February 15, 2016.

  129. [129]
    Kandji Cuckoo April 2024

    Kohler, A. and Lopez, C. (2024, April 30). Malware: Cuckoo Behaves Like Cross Between Infostealer and Spyware. Retrieved August 20, 2024.

    Open source URL
  130. [130]
    SentinelOne Cuckoo Stealer May 2024

    Stokes, P. (2024, May 9). macOS Cuckoo Stealer | Ensuring Detection and Defense as New Samples Rapidly Emerge. Retrieved August 20, 2024.

    Open source URL
  131. [131]
    ESET ForSSHe December 2018

    Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.

    Open source URL
  132. [132]
    Microsoft Deep Dive Solorigate January 2021

    MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.

    Open source URL
  133. [133]
    Symantec RAINDROP January 2021

    Symantec Threat Hunter Team. (2021, January 18). Raindrop: New Malware Discovered in SolarWinds Investigation. Retrieved January 19, 2021.

    Open source URL
  134. [134]
    Carbon Black HotCroissant April 2020

    Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020.

    Open source URL
  135. [135]
    Lookout Dark Caracal Jan 2018

    Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.

    Open source URL
  136. [136]
    Symantec Elderwood Sept 2012

    O'Gorman, G., and McDonald, G.. (2012, September 6). The Elderwood Project. Retrieved November 17, 2024.

    Open source URL
  137. [137]
    Accenture Lyceum Targets November 2021

    Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.

    Open source URL
  138. [138]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  139. [139]
    Bromium Ursnif Mar 2017

    Holland, A. (2019, March 7). Tricks and COMfoolery: How Ursnif Evades Detection. Retrieved June 10, 2019.

    Open source URL
  140. [140]
    ProofPoint Ursnif Aug 2016

    Proofpoint Staff. (2016, August 25). Nightmare on Tor Street: Ursnif variant Dreambot adds Tor functionality. Retrieved June 5, 2019.

    Open source URL
  141. [141]
    CloudSEK_RustyWater_Jan2026

    Awasthi, P. (2026, January 8). Reborn in Rust: Muddy Water Evolves Tooling with RustyWater Implant. Retrieved March 19, 2026.

    Open source URL
  142. [142]
    CISA Iran Albanian Attacks September 2022

    CISA. (2022, September 23). AA22-264A Iranian State Actors Conduct Cyber Operations Against the Government of Albania. Retrieved August 6, 2024.

    Open source URL
  143. [143]
    Mandiant ROADSWEEP August 2022

    Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.

    Open source URL
  144. [144]
    Microsoft Albanian Government Attacks September 2022

    MSTIC. (2022, September 8). Microsoft investigates Iranian attacks against the Albanian government. Retrieved August 6, 2024.

    Open source URL
  145. [145]
    Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2. Retrieved September 12, 2025.

    Open source URL
  146. [146]
    Microsoft DUBNIUM July 2016

    Microsoft. (2016, July 14). Reverse engineering DUBNIUM – Stage 2 payload analysis . Retrieved March 31, 2021.

    Open source URL
  147. [147]
    Securelist Darkhotel Aug 2015

    Kaspersky Lab's Global Research & Analysis Team. (2015, August 10). Darkhotel's attacks in 2015. Retrieved November 2, 2018.

    Open source URL
  148. [148]
    Oligo ShadowRay Campaign MAR 2024

    Lumelsly, A. et al. (2024, March 26). ShadowRay: First Known Attack Campaign Targeting AI Workloads Actively Exploited In The Wild. Retrieved December 2, 2024.

    Open source URL
  149. [149]
    Proofpoint Operation Transparent Tribe March 2016

    Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.

    Open source URL
  150. [150]
    Group-IB RansomHub FEB 2025

    Alfano, V. et al. (2025, February 12). RansomHub Never Sleeps Episode 1: The evolution of modern ransomware. Retrieved March 17, 2025.

    Open source URL
  151. [151]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  152. [152]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  153. [153]
    Accenture SNAKEMACKEREL Nov 2018

    Accenture Security. (2018, November 29). SNAKEMACKEREL. Retrieved April 15, 2019.

    Open source URL
  154. [154]
    Bitdefender APT28 Dec 2015

    Bitdefender. (2015, December). APT28 Under the Scope. Retrieved February 23, 2017.

    Open source URL
  155. [155]
    Palo Alto Sofacy 06-2018

    Lee, B., Falcone, R. (2018, June 06). Sofacy Group’s Parallel Attacks. Retrieved June 18, 2018.

    Open source URL
  156. [156]
    Talos Seduploader Oct 2017

    Mercer, W., et al. (2017, October 22). "Cyber Conflict" Decoy Document Used in Real Cyber Conflict. Retrieved November 2, 2018.

    Open source URL
  157. [157]
    Unit 42 Sofacy Feb 2018

    Lee, B, et al. (2018, February 28). Sofacy Attacks Multiple Government Entities. Retrieved March 15, 2018.

    Open source URL
  158. [158]
    FireEye HAWKBALL Jun 2019

    Patil, S. and Williams, M.. (2019, June 5). Government Sector in Central Asia Targeted With New HAWKBALL Backdoor Delivered via Microsoft Office Vulnerabilities. Retrieved June 20, 2019.

    Open source URL
  159. [159]
    Trend Micro Skidmap

    Remillano, A., Urbanec, J. (2019, September 19). Skidmap Linux Malware Uses Rootkit Capabilities to Hide Cryptocurrency-Mining Payload. Retrieved June 4, 2020.

    Open source URL
  160. [160]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  161. [161]
    PaloAlto DNS Requests May 2016

    Grunzweig, J., et al. (2016, May 24). New Wekby Attacks Use DNS Requests As Command and Control Mechanism. Retrieved November 15, 2018.

    Open source URL
  162. [162]
    Mandiant APT41

    Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022.

    Open source URL
  163. [163]
    Mandiant APT41

    Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022.

    Open source URL
  164. [164]
    Dell Sakula

    Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, July 30). Sakula Malware Family. Retrieved January 26, 2016.

  165. [165]
    Novetta-Axiom

    Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.

    Open source URL
  166. [166]
    Palo Alto OilRig May 2016

    Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.

  167. [167]
    Sophos SamSam Apr 2018

    Palotay, D. and Mackenzie, P. (2018, April). SamSam Ransomware Chooses Its Targets Carefully. Retrieved April 15, 2019.

    Open source URL
  168. [168]
    Talos SamSam Jan 2018

    Ventura, V. (2018, January 22). SamSam - The Evolution Continues Netting Over $325,000 in 4 Weeks. Retrieved April 16, 2019.

    Open source URL
  169. [169]
    ESET Operation Groundbait

    Cherepanov, A.. (2016, May 17). Operation Groundbait: Analysis of a surveillance toolkit. Retrieved May 18, 2016.

  170. [170]
    fsecure NanHaiShu July 2016

    F-Secure Labs. (2016, July). NANHAISHU RATing the South China Sea. Retrieved July 6, 2018.

    Open source URL
  171. [171]
    SentinelLabs Metador Technical Appendix Sept 2022

    SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.

    Open source URL
  172. [172]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  173. [173]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  174. [174]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  175. [175]
    CrowdStrike Wizard Spider October 2020

    Podlosky, A., Hanel, A. et al. (2020, October 16). WIZARD SPIDER Update: Resilient, Reactive and Resolute. Retrieved June 15, 2021.

    Open source URL
  176. [176]
    Cybereason Bazar July 2020

    Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.

    Open source URL
  177. [177]
    NCC Group Team9 June 2020

    Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.

    Open source URL
  178. [178]
    Joint Cybersecurity Advisory LockBit 3.0 MAR 2023

    FBI et al. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved February 5, 2025.

    Open source URL
  179. [179]
    Sentinel Labs LockBit 3.0 JUL 2022

    Walter, J. (2022, July 21). LockBit 3.0 Update | Unpicking the Ransomware’s Latest Anti-Analysis and Evasion Techniques. Retrieved February 5, 2025.

    Open source URL
  180. [180]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  181. [181]
    Kaspersky LODEINFO OCT 2022

    Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part I. Retrieved April 17, 2026.

    Open source URL
  182. [182]
    ATT Sidewinder January 2021

    Hegel, T. (2021, January 13). A Global Perspective of the SideWinder APT. Retrieved January 27, 2021.

    Open source URL
  183. [183]
    Cyble Sidewinder September 2020

    Cyble. (2020, September 26). SideWinder APT Targets with futuristic Tactics and Techniques. Retrieved January 29, 2021.

    Open source URL
  184. [184]
    Rewterz Sidewinder APT April 2020

    Rewterz. (2020, April 20). Sidewinder APT Group Campaign Analysis. Retrieved January 29, 2021.

    Open source URL
  185. [185]
    Google Cloud Mandiant UNC3886 2024

    Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024.

    Open source URL
  186. [186]
    Volexity InkySquid BLUELIGHT August 2021

    Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.

    Open source URL
  187. [187]
    ESET PipeMon May 2020

    Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti Group. Retrieved August 24, 2020.

    Open source URL
  188. [188]
    MalwareBytes WoodyRAT Aug 2022

    MalwareBytes Threat Intelligence Team. (2022, August 3). Woody RAT: A new feature-rich malware spotted in the wild. Retrieved December 6, 2022.

    Open source URL
  189. [189]
    Checkpoint MosesStaff Nov 2021

    Checkpoint Research. (2021, November 15). Uncovering MosesStaff techniques: Ideology over Money. Retrieved August 11, 2022.

    Open source URL
  190. [190]
    FBI FLASH APT39 September 2020

    FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020.

    Open source URL
  191. [191]
    ESET HiddenFace 2024

    Breitenbacher, D. (2024). Unmasking HiddenFace. Retrieved April 17, 2026.

    Open source URL
  192. [192]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  193. [193]
    Talos GravityRAT

    Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.

    Open source URL
  194. [194]
    ESET Casbaneiro Oct 2019

    ESET Research. (2019, October 3). Casbaneiro: peculiarities of this banking Trojan that affects Brazil and Mexico. Retrieved September 23, 2021.

    Open source URL
  195. [195]
    Medium Metamorfo Apr 2020

    Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020.

    Open source URL
  196. [196]
    Lazarus APT January 2022

    Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022.

    Open source URL
  197. [197]
    McAfee Lazarus Resurfaces Feb 2018

    Sherstobitoff, R. (2018, February 12). Lazarus Resurfaces, Targets Global Banks and Bitcoin Users. Retrieved February 19, 2018.

    Open source URL
  198. [198]
    Novetta Blockbuster

    Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.

    Open source URL
  199. [199]
    Novetta Blockbuster Loaders

    Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Loaders, Installers and Uninstallers Report. Retrieved November 17, 2024.

    Open source URL
  200. [200]
    Novetta Blockbuster RATs

    Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Remote Administration Tools & Content Staging Malware Report. Retrieved March 16, 2016.

    Open source URL
  201. [201]
    Qualys LolZarus

    Pradhan, A. (2022, February 8). LolZarus: Lazarus Group Incorporating Lolbins into Campaigns. Retrieved March 22, 2022.

    Open source URL
  202. [202]
    TrendMicro macOS Dacls May 2020

    Mabutas, G. (2020, May 11). New MacOS Dacls RAT Backdoor Shows Lazarus’ Multi-Platform Attack Capability. Retrieved August 10, 2020.

    Open source URL
  203. [203]
    ANY.RUN XLoader 2023

    ANY.RUN. (2023, February 28). XLoader/FormBook: Encryption Analysis and Malware Decryption . Retrieved March 11, 2025.

    Open source URL
  204. [204]
    Zscaler XLoader 2025

    Zscaler Threatlabz. (2025, January 27). Technical Analysis of Xloader Versions 6 and 7 | Part 1. Retrieved March 11, 2025.

    Open source URL
  205. [205]
    Palo Alto Unit 42 OutSteel SaintBot February 2022

    Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.

    Open source URL
  206. [206]
    FireEye APT33 Guardrail

    Ackerman, G., et al. (2018, December 21). OVERRULED: Containing a Potentially Destructive Adversary. Retrieved January 17, 2019.

    Open source URL
  207. [207]
    Symantec Bilbug 2022

    Symntec Threat Hunter Team. (2022, November 12). Billbug: State-sponsored Actor Targets Cert Authority, Government Agencies in Multiple Asian Countries. Retrieved March 15, 2025.

    Open source URL
  208. [208]
    DCSO StrelaStealer 2022

    DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.

    Open source URL
  209. [209]
    McAfee Night Dragon

    McAfee® Foundstone® Professional Services and McAfee Labs™. (2011, February 10). Global Energy Cyberattacks: “Night Dragon”. Retrieved February 19, 2018.

    Open source URL
  210. [210]
    ESET LightNeuron May 2019

    Faou, M. (2019, May). Turla LightNeuron: One email away from remote code execution. Retrieved June 24, 2019.

    Open source URL
  211. [211]
    SecureWorks August 2019

    SecureWorks 2019, August 27 LYCEUM Takes Center Stage in Middle East Campaign Retrieved. 2019/11/19

    Open source URL
  212. [212]
    ESET GreyEnergy Oct 2018

    Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.

    Open source URL
  213. [213]
    FireEye FELIXROOT July 2018

    Patil, S. (2018, June 26). Microsoft Office Vulnerabilities Used to Distribute FELIXROOT Backdoor in Recent Campaign. Retrieved November 17, 2024.

    Open source URL
  214. [214]
    Kaspersky ProjectSauron Technical Analysis

    Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.

    Open source URL
  215. [215]
    Symantec Remsec IOCs

    Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.

  216. [216]
    Donut Github

    TheWover. (2019, May 9). donut. Retrieved March 25, 2022.

    Open source URL
  217. [217]
    SentinelOne SocGholish Infrastructure November 2022

    Milenkoski, A. (2022, November 7). SocGholish Diversifies and Expands Its Malware Staging Infrastructure to Counter Defenders. Retrieved March 22, 2024.

    Open source URL
  218. [218]
    Aryaka Kimsuky July 2025

    Varadharajan Krishnasamy, Aditya K Sood. (2025, July 29). From Reconnaissance to Control: The Operational Blueprint of Kimsuky APT for Cyber Espionage. Retrieved April 18, 2026.

    Open source URL
  219. [219]
    Gen Digital Kimsuky HTTPTroy October 2025

    Alexndru-Cristian Bardas. (2025, October 30). DPRK’s Playbook: Kimsuky’s HttpTroy and Lazarus’s New BLINDINGCAN Variant. Retrieved April 8, 2026.

    Open source URL
  220. [220]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  221. [221]
    Google Cloud APT41 2024

    Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.

    Open source URL
  222. [222]
    McAfee Honeybee

    Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018.

    Open source URL
  223. [223]
    Google Cloud Mandiant UNC3886 2024

    Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024.

    Open source URL
  224. [224]
    Google Cloud Mandiant UNC3886 2024

    Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024.

    Open source URL
  225. [225]
    objective-see windtail2 jan 2019

    Wardle, Patrick. (2019, January 15). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 2). Retrieved October 3, 2019.

    Open source URL
  226. [226]
    ESET Grandoreiro April 2020

    ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020.

    Open source URL
  227. [227]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  228. [228]
    Securelist Brazilian Banking Malware July 2020

    GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.

    Open source URL
  229. [229]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  230. [230]
    ClearSky Siamesekitten August 2021

    ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.

    Open source URL
  231. [231]
    Kaspersky Lyceum October 2021

    Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.

    Open source URL
  232. [232]
    US-CERT BLINDINGCAN Aug 2020

    US-CERT. (2020, August 19). MAR-10295134-1.v1 – North Korean Remote Access Trojan: BLINDINGCAN. Retrieved August 19, 2020.

    Open source URL
  233. [233]
    CERT Polska

    CERT Polska. (2026, January 30). Energy Sector Incident Report – 29 December. Retrieved April 22, 2026.

    Open source URL
  234. [234]
    Malwarebytes Konni Aug 2021

    Threat Intelligence Team. (2021, August 23). New variant of Konni malware used in campaign targetting Russia. Retrieved January 5, 2022.

    Open source URL
  235. [235]
    Forcepoint Monsoon

    Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.

    Open source URL
  236. [236]
    Forcepoint BITTER Pakistan Oct 2016

    Dela Paz, R. (2016, October 21). BITTER: a targeted attack against Pakistan. Retrieved June 1, 2022.

    Open source URL
  237. [237]
    Cisco Ukraine Wipers January 2022

    Biasini, N. et al.. (2022, January 21). Ukraine Campaign Delivers Defacement and Wipers, in Continued Escalation. Retrieved March 14, 2022.

    Open source URL
  238. [238]
    Medium S2W WhisperGate January 2022

    S2W. (2022, January 18). Analysis of Destructive Malware (WhisperGate) targeting Ukraine. Retrieved March 14, 2022.

    Open source URL
  239. [239]
    RecordedFuture WhisperGate Jan 2022

    Insikt Group. (2020, January 28). WhisperGate Malware Corrupts Computers in Ukraine. Retrieved September 16, 2024.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use