LiveActive security incident?Get immediate response
MITRE ATT&CK® Technique

T1027.016: Junk Code Insertion

Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execute, does not change the functionality of the code. Junk code makes analysis more difficult and time-consuming, as the analyst steps through non-functional code instead of analyzing the main code. It also may hinder detections that rely on static code analysis due to the use of benign functionality, especially when combined with Compression or Software Packing.[1][2]

No-Operation (NOP) instructions are an example of dead code commonly used in x86 assembly language. They are commonly used as the 0x90 opcode. When NOPs are added to malware, the disassembler may show the NOP instructions, leading to the analyst needing to step through them.[1]

The use of junk / dead code insertion is distinct from Binary Padding because the purpose is to obfuscate the functionality of the code, rather than simply to change the malware’s signature.

EnterpriseT1027.016Sub-techniqueObject v2.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Junk Code Insertion matters because it is designed to waste analyst time and weaken static malware analysis. The inserted code may not execute or may execute without changing program behavior, but it can make malicious files harder to reverse engineer and harder for detections based only on static code patterns. For leaders, the practical issue is not the junk code itself; it is whether endpoint protection, SOC triage, and incident response can still make timely decisions when malware is intentionally padded with irrelevant instructions or benign-looking logic.

Executive priority

Treat this as a resilience and investigation-readiness issue for Windows, Linux, and macOS endpoints. ATT&CK lists multiple groups and malware families using this behavior, including ransomware, stealers, backdoors, loaders, and surveillance tooling, so leadership should ask whether malware handling depends too heavily on signature or static analysis alone. Priority should go to endpoint antimalware coverage, behavioral detection, malware triage process maturity, and IR playbooks that can escalate suspicious execution even when file analysis is slowed by obfuscation.

Technical view

This is a stealth sub-technique of Obfuscated Files or Information. SOC and detection teams should validate coverage against suspicious execution patterns rather than relying only on static signatures. ATT&CK does not provide an official detection description for this technique, but the relationship to DET0322 indicates a detection strategy focused on junk code obfuscation with suspicious execution patterns. For IR and malware analysts, the key validation point is whether tooling and process can identify non-functional or benign-looking inserted code, such as NOP-style dead code, while still preserving focus on actual program behavior, process activity, persistence, credential access, network activity, and payload staging.

Likely telemetry

  • Endpoint antimalware and EDR alerts for suspicious files and process behavior
  • File metadata and malware triage results from submitted executables or scripts
  • Process creation and parent-child process telemetry across Windows, Linux, and macOS
  • Behavioral execution traces from sandboxing or detonation environments
  • Static and dynamic malware analysis notes identifying dead code, NOP-like instruction sequences, or irrelevant code paths

Detection direction

  • Validate that detections are not limited to static code signatures that can be weakened by inserted junk or benign-looking functionality.
  • Tune around behavior observed during execution: suspicious process chains, unexpected payload loading, command execution, network connections, or other runtime activity.
  • Use the DET0322 relationship as direction for a detection strategy centered on junk code obfuscation plus suspicious execution patterns.
  • Account for false positives: dead code or NOP instructions can exist in legitimate software, so alerts should be correlated with suspicious file origin, execution context, and runtime behavior.
  • Review malware analysis workflow for blind spots where analysts spend excessive time on non-functional code and miss the operational behavior that matters for containment.

Mitigation priorities

  • Deploy and maintain antivirus/antimalware across relevant endpoints, consistent with M1049, with automated updates enabled.
  • Prioritize behavioral analysis and heuristic capabilities alongside signatures, because junk code is intended to hinder static analysis.
  • Ensure suspicious files can be escalated to sandboxing or malware triage workflows when endpoint tools flag uncertainty.
  • Use endpoint hardening and monitoring coverage consistently across Windows, Linux, and macOS where those platforms are in scope.
  • Measure control effectiveness through testing that includes obfuscated samples or benign simulations that exercise analysis and alert-triage workflow without relying on vendor-specific assumptions.
Additional notes and limits

ATT&CK identifies this as a sub-technique of T1027 Obfuscated Files or Information and distinguishes it from Binary Padding: the purpose is to obscure code functionality, not merely alter a malware signature. Relationship context shows use by several named groups and software entries, including FIN7, Gamaredon Group, APT32, Kimsuky, APT-C-36, Mustang Panda, XTunnel, CORESHELL, FinFisher, POWERSTATS, ZeroT, SamSam, Maze, Pony, Goopy, FatDuke, WastedLocker, Gelsemium, StrelaStealer, and PureCrypter. These relationships support relevance across multiple malware types, but local exposure depends on the organization’s assets, telemetry, and threat model.

The official ATT&CK object does not provide a detection section, so detection guidance is derived from the technique description, the DET0322 relationship, the listed platforms, and the M1049 mitigation relationship. This take does not claim active exploitation, guaranteed detection, or organization-specific risk. Confirmation requires local endpoint telemetry, malware analysis capability, and control validation evidence.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Junk Code Insertion

Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execute, does not change the functionality of the code. Junk code makes analysis more difficult and time-consuming, as the analyst steps through non-functional code instead of analyzing the main code. It also may hinder detections that rely on static code analysis due to the use of benign functionality, especially when combined with Compression or Software Packing.[1][2]

No-Operation (NOP) instructions are an example of dead code commonly used in x86 assembly language. They are commonly used as the 0x90 opcode. When NOPs are added to malware, the disassembler may show the NOP instructions, leading to the analyst needing to step through them.[1]

The use of junk / dead code insertion is distinct from Binary Padding because the purpose is to obfuscate the functionality of the code, rather than simply to change the malware’s signature.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
DomainIDNameRelationship / procedure
EnterpriseT1027Obfuscated Files or InformationThis object subtechnique of Obfuscated Files or Information.
Associated objects

Groups, software, and campaigns

GroupEnterprise

G0046: FIN7

FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of FIN7 was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to big game hunting (BGH), including use of REvil ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the Carbanak Group, but multiple threat groups have been observed using Carbanak, leading these groups to be tracked separately.[1][2][3][4][5][6][7]

GroupEnterprise

G0099: APT-C-36

APT-C-36 is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. APT-C-36 has targeted government institutions and entities in the financial, energy, and professional manufacturing sectors across Colombia and other Latin American countries.[1][2][3][4]

GroupEnterprise

G0047: Gamaredon Group

Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.[1][2][3][4][5]

In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. [6][5]

GroupEnterprise

G0094: Kimsuky

Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Kimsuky operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing.[1][2][3][4][5][6]

Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).[7][8][9] In 2023, Kimsuky was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance.[10]

DPRK threat actor cluster boundaries overlap in open source reporting, with some security researchers consolidating all attributed North Korean state-sponsored cyber activity under Lazarus Group, rather than tracking operationally distinct subgroups.

GroupEnterprise

G0050: APT32

APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.[1][2][3]

GroupEnterprise

G0129: Mustang Panda

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. [1][2][3][4][5][6][7][8][9][10][11][12][13]

MalwareEnterprise

S0449: Maze

Maze ransomware, previously known as "ChaCha", was discovered in May 2019. In addition to encrypting files on victim machines for impact, Maze operators conduct information stealing campaigns prior to encryption and post the information online to extort affected companies.[1][2][3]

Windows
MalwareEnterprise

S0117: XTunnel

XTunnel a VPN-like network proxy tool that can relay traffic between a C2 server and a victim. It was first seen in May 2013 and reportedly used by APT28 during the compromise of the Democratic National Committee. [1] [2] [3]

Windows
MalwareEnterprise

S1183: StrelaStealer

StrelaStealer is an information stealer malware variant first identified in November 2022 and active through late 2024. StrelaStealer focuses on the automated identification, collection, and exfiltration of email credentials from email clients such as Outlook and Thunderbird.[1][2][3][4]

Windows
MalwareEnterprise

S0248: yty

yty is a modular, plugin-based malware framework. The components of the framework are written in a variety of programming languages. [1]

Windows
MalwareEnterprise

S0453: Pony

Pony is a credential stealing malware, though has also been used among adversaries for its downloader capabilities. The source code for Pony Loader 1.0 and 2.0 were leaked online, leading to their use by various threat actors.[1]

Windows
MalwareEnterprise

S0370: SamSam

SamSam is ransomware that appeared in early 2016. Unlike some ransomware, its variants have required operators to manually interact with the malware to execute some of its core components.[1][2][3][4]

Windows
MalwareEnterprise

S9020: LODEINFO

LODEINFO is a fileless backdoor malware first identified in 2020 that has been used by actors including MirrorFace, primarily against media, diplomatic, governmental, and public sector organizations in Japan.[1][2][3]

Windows
MalwareEnterprise

S0477: Goopy

Goopy is a Windows backdoor and Trojan used by APT32 and shares several similarities to another backdoor used by the group (Denis). Goopy is named for its impersonation of the legitimate Google Updater executable.[1]

Windows
MalwareEnterprise

S0182: FinFisher

FinFisher is a government-grade commercial surveillance spyware reportedly sold exclusively to government agencies for use in targeted and lawful criminal investigations. It is heavily obfuscated and uses multiple anti-analysis techniques. It has other variants including Wingbird. [1] [2] [3] [4] [5]

WindowsAndroid
Relationship explorer

All related ATT&CK context

detects · Detection StrategyDET0322: Detection Strategy for Junk Code Obfuscation with Suspicious Execution PatternsEnterpriseuses · MalwareS0449: MazeEnterpriseuses · MalwareS0117: XTunnelEnterpriseuses · MalwareS1183: StrelaStealerEnterpriseuses · GroupG0046: FIN7Enterpriseuses · GroupG0099: APT-C-36Enterpriseuses · GroupG0047: Gamaredon GroupEnterpriseuses · MalwareS0248: ytyEnterpriseuses · MalwareS0230: ZeroTEnterpriseuses · MalwareS0453: PonyEnterpriseuses · MalwareS0370: SamSamEnterpriseuses · MalwareS9020: LODEINFOEnterpriseuses · MalwareS0477: GoopyEnterpriseuses · GroupG0094: KimsukyEnterpriseuses · MalwareS0612: WastedLockerEnterpriseuses · MalwareS0137: CORESHELLEnterprisemitigates · MitigationM1049: Antivirus/AntimalwareEnterprisesubtechnique of · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · MalwareS0182: FinFisherEnterpriseuses · MalwareS9027: ANELLDREnterpriseuses · GroupG0050: APT32Enterpriseuses · GroupG0129: Mustang PandaEnterpriseuses · MalwareS0666: GelsemiumEnterpriseuses · MalwareS0223: POWERSTATSEnterprise
Mitigations

Mitigation direction

MitigationEnterprise

M1049: Antivirus/Antimalware

Antivirus/Antimalware solutions utilize signatures, heuristics, and behavioral analysis to detect, block, and remediate malicious software, including viruses, trojans, ransomware, and spyware. These solutions continuously monitor endpoints and systems for known malicious patterns and suspicious behaviors that indicate compromise. Antivirus/Antimalware software should be deployed across all devices, with automated updates to ensure protection against the latest threats. This mitigation can be implemented through the following measures:

Signature-Based Detection:

- Implementation: Use predefined signatures to identify known malware based on unique patterns such as file hashes, byte sequences, or command-line arguments. This method is effective against known threats. - Use Case: When malware like "Emotet" is detected, its signature (such as a specific file hash) matches a known database of malicious software, triggering an alert and allowing immediate quarantine of the infected file.

Heuristic-Based Detection:

- Implementation: Deploy heuristic algorithms that analyze behavior and characteristics of files and processes to identify potential malware, even if it doesn’t match a known signature. - Use Case: If a program attempts to modify multiple critical system files or initiate suspicious network communications, heuristic analysis may flag it as potentially malicious, even if no specific malware signature is available.

Behavioral Detection (Behavior Prevention):

- Implementation: Use behavioral analysis to detect patterns of abnormal activities, such as unusual system calls, unauthorized file encryption, or attempts to escalate privileges. - Use Case: Behavioral analysis can detect ransomware attacks early by identifying behavior like mass file encryption, even before a specific ransomware signature has been identified.

Real-Time Scanning:

- Implementation: Enable real-time scanning to automatically inspect files and network traffic for signs of malware as they are accessed, downloaded, or executed. - Use Case: When a user downloads an email attachment, the antivirus solution scans the file in real-time, checking it against both signatures and heuristics to detect any malicious content before it can be opened.

Cloud-Assisted Threat Intelligence:

- Implementation: Use cloud-based threat intelligence to ensure the antivirus solution can access the latest malware definitions and real-time threat feeds from a global database of emerging threats. - Use Case: Cloud-assisted antivirus solutions quickly identify newly discovered malware by cross-referencing against global threat databases, providing real-time protection against zero-day attacks.

**Tools for Implementation**:

- Endpoint Security Platforms: Use solutions such as EDR for comprehensive antivirus/antimalware protection across all systems. - Centralized Management: Implement centralized antivirus management consoles that provide visibility into threat activity, enable policy enforcement, and automate updates. - Behavioral Analysis Tools: Leverage solutions with advanced behavioral analysis capabilities to detect malicious activity patterns that don’t rely on known signatures.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.0
Created
Modified
Raw hash
30ee6c0140aac911...
Imported snapshots across ATT&CK releases(2)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.22.0Older bundle30ee6c0140aa…
19.12.0Current bundle30ee6c0140aa…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    ReasonLabs

    ReasonLabs. (n.d.). What is Dead code insertion?. Retrieved March 4, 2025.

    Open source URL
  2. [2]
    ReasonLabs Cyberpedia Junk Code

    What is Junk Code?. (n.d.). ReasonLabs. Retrieved April 4, 2025.

    Open source URL
  3. [3]
    McAfee Maze March 2020

    Mundo, A. (2020, March 26). Ransomware Maze. Retrieved May 18, 2020.

    Open source URL
  4. [4]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  5. [5]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  6. [6]
    Mandiant FIN7 Apr 2022

    Abdo, B., et al. (2022, April 4). FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7. Retrieved April 5, 2022.

    Open source URL
  7. [7]
    Recorded Future TAG-144 AUG 2025

    Insikt Group. (2025, August 26). TAG-144’s Persistent Grip on South American Organizations. Retrieved April 16, 2026.

    Open source URL
  8. [8]
    ESET Gamaredon June 2020

    Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.

    Open source URL
  9. [9]
    ASERT Donot March 2018

    Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018.

    Open source URL
  10. [10]
    Proofpoint ZeroT Feb 2017

    Huss, D., et al. (2017, February 2). Oops, they did it again: APT Targets Russia and Belarus with ZeroT and PlugX. Retrieved April 5, 2018.

    Open source URL
  11. [11]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  12. [12]
    Sophos SamSam Apr 2018

    Palotay, D. and Mackenzie, P. (2018, April). SamSam Ransomware Chooses Its Targets Carefully. Retrieved April 15, 2019.

    Open source URL
  13. [13]
    ITOCHU LODEINFO JAN 2024

    ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.

    Open source URL
  14. [14]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  15. [15]
    Securonix Kimsuky February 2025

    Den Iuzvyk, Tim Peck. (2025, February 13). Analyzing DEEP#DRIVE: North Korean Threat Actors Observed Exploiting Trusted Platforms for Targeted Attacks. Retrieved August 19, 2025.

    Open source URL
  16. [16]
    NCC Group WastedLocker June 2020

    Antenucci, S., Pantazopoulos, N., Sandee, M. (2020, June 23). WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group. Retrieved September 14, 2021.

    Open source URL
  17. [17]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  18. [18]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  19. [19]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  20. [20]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  21. [21]
    ESET OceanLotus

    Foltýn, T. (2018, March 13). OceanLotus ships new backdoor using old tricks. Retrieved May 22, 2018.

    Open source URL
  22. [22]
    ESET OceanLotus Mar 2019

    Dumont, R. (2019, March 20). Fake or Fake: Keeping up with OceanLotus decoys. Retrieved April 1, 2019.

    Open source URL
  23. [23]
    Eset PlugX Korplug Mustang Panda March 2022

    Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025.

    Open source URL
  24. [24]
    Avira Mustang Panda January 2020

    Hamzeloofard, S. (2020, January 31). New wave of PlugX targets Hong Kong | Avira Blog. Retrieved April 13, 2021.

    Open source URL
  25. [25]
    ESET Gelsemium June 2021

    Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.

    Open source URL
  26. [26]
    TrendMicro POWERSTATS V3 June 2019

    Lunghi, D. and Horejsi, J.. (2019, June 10). MuddyWater Resurfaces, Uses Multi-Stage Backdoor POWERSTATS V3 and New Post-Exploitation Tools. Retrieved May 14, 2020.

    Open source URL
  27. [27]
    ESET Dukes October 2019

    Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.

    Open source URL
  28. [28]
    Zscaler PureCrypter JUN 2022

    Dumont, R. (2022, June 13). Technical Analysis of PureCrypter: A Fully-Functional Loader Distributing Remote Access Trojans and Information Stealers. Retrieved April 16, 2026.

    Open source URL
  29. [29]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  30. [30]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  31. [31]
    ReasonLabs

    ReasonLabs. (n.d.). What is Dead code insertion?. Retrieved March 4, 2025.

    Open source URL
  32. [32]
    ReasonLabs

    ReasonLabs. (n.d.). What is Dead code insertion?. Retrieved March 4, 2025.

    Open source URL
  33. [33]
    ReasonLabs Cyberpedia Junk Code

    What is Junk Code?. (n.d.). ReasonLabs. Retrieved April 4, 2025.

    Open source URL
  34. [34]
    ReasonLabs Cyberpedia Junk Code

    What is Junk Code?. (n.d.). ReasonLabs. Retrieved April 4, 2025.

    Open source URL
  35. [35]
    mitre-attackT1027.016
    Open source URL
  36. [36]
    mitre-attackT1027.016
    Open source URL
  37. [37]
    mitre-attackT1027.016
    Open source URL
  38. [38]
    McAfee Maze March 2020

    Mundo, A. (2020, March 26). Ransomware Maze. Retrieved May 18, 2020.

    Open source URL
  39. [39]
    ESET Sednit Part 2

    ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.

  40. [40]
    Fortgale StrelaStealer 2023

    Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.

    Open source URL
  41. [41]
    Mandiant FIN7 Apr 2022

    Abdo, B., et al. (2022, April 4). FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7. Retrieved April 5, 2022.

    Open source URL
  42. [42]
    Recorded Future TAG-144 AUG 2025

    Insikt Group. (2025, August 26). TAG-144’s Persistent Grip on South American Organizations. Retrieved April 16, 2026.

    Open source URL
  43. [43]
    ESET Gamaredon June 2020

    Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.

    Open source URL
  44. [44]
    ASERT Donot March 2018

    Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018.

    Open source URL
  45. [45]
    Proofpoint ZeroT Feb 2017

    Huss, D., et al. (2017, February 2). Oops, they did it again: APT Targets Russia and Belarus with ZeroT and PlugX. Retrieved April 5, 2018.

    Open source URL
  46. [46]
    Malwarebytes Pony April 2016

    hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.

    Open source URL
  47. [47]
    Sophos SamSam Apr 2018

    Palotay, D. and Mackenzie, P. (2018, April). SamSam Ransomware Chooses Its Targets Carefully. Retrieved April 15, 2019.

    Open source URL
  48. [48]
    ITOCHU LODEINFO JAN 2024

    ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.

    Open source URL
  49. [49]
    Cybereason Cobalt Kitty 2017

    Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.

    Open source URL
  50. [50]
    Securonix Kimsuky February 2025

    Den Iuzvyk, Tim Peck. (2025, February 13). Analyzing DEEP#DRIVE: North Korean Threat Actors Observed Exploiting Trusted Platforms for Targeted Attacks. Retrieved August 19, 2025.

    Open source URL
  51. [51]
    NCC Group WastedLocker June 2020

    Antenucci, S., Pantazopoulos, N., Sandee, M. (2020, June 23). WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group. Retrieved September 14, 2021.

    Open source URL
  52. [52]
    FireEye APT28

    FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.

    Open source URL
  53. [53]
    ReasonLabs

    ReasonLabs. (n.d.). What is Dead code insertion?. Retrieved March 4, 2025.

    Open source URL
  54. [54]
    ReasonLabs

    ReasonLabs. (n.d.). What is Dead code insertion?. Retrieved March 4, 2025.

    Open source URL
  55. [55]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  56. [56]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  57. [57]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  58. [58]
    ESET OceanLotus

    Foltýn, T. (2018, March 13). OceanLotus ships new backdoor using old tricks. Retrieved May 22, 2018.

    Open source URL
  59. [59]
    ESET OceanLotus Mar 2019

    Dumont, R. (2019, March 20). Fake or Fake: Keeping up with OceanLotus decoys. Retrieved April 1, 2019.

    Open source URL
  60. [60]
    Avira Mustang Panda January 2020

    Hamzeloofard, S. (2020, January 31). New wave of PlugX targets Hong Kong | Avira Blog. Retrieved April 13, 2021.

    Open source URL
  61. [61]
    Eset PlugX Korplug Mustang Panda March 2022

    Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use