LiveActive security incident?Get immediate response
MITRE ATT&CK® Technique

T1090: Proxy

MITRE ATT&CK T1090: Proxy Technique details for ESXi, Linux, macOS, with detection guidance, relationships and mapped CVEs.

EnterpriseT1090TechniqueObject v3.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Proxy use matters because it can hide command-and-control traffic behind intermediaries, trusted paths, chained hops, or CDN routing rather than obvious direct connections to adversary infrastructure. For leaders, the decision point is whether the organization can prove where outbound and lateral network traffic is going, especially across endpoints, network devices, ESXi, Linux, macOS, and Windows environments.

Executive priority

Treat T1090 as a resilience and visibility issue, not just a network-control issue. Proxying can reduce the value of simple blocklists and make incident scoping harder because defenders may only see the last intermediary. Executives should ask whether egress filtering, SSL/TLS inspection where appropriate, intrusion prevention, and network traffic filtering are deployed, governed, and evidenced well enough to support incident response and audit needs.

Technical view

SOC and IR teams should validate visibility into command-and-control paths that may traverse internal proxies, external proxies, multi-hop chains, or CDN/domain-fronting style routing. ATT&CK provides no official detection text for this parent technique, but the related detection strategy DET0445 focuses on proxy infrastructure setup and traffic bridging. Detection engineering should prioritize unusual traffic brokering patterns, unexpected systems acting as relays, abnormal egress concentration through a small number of hosts, and mismatches or anomalies in encrypted web traffic where inspection is legally and operationally permitted.

Likely telemetry

  • Firewall, proxy, secure web gateway, and egress filtering logs
  • Network intrusion detection/prevention alerts at boundaries
  • NetFlow or equivalent network connection metadata
  • DNS and CDN-related destination telemetry
  • TLS/SSL inspection metadata and decrypted content where policy permits

Detection direction

  • Validate whether DET0445-like analytics exist for proxy infrastructure setup and traffic bridging rather than relying only on known-bad IP or domain matching.
  • Tune for hosts or network devices unexpectedly forwarding traffic, concentrating outbound sessions, or acting as intermediaries between internal systems and external destinations.
  • Account for multi-hop proxy limitations: defenders may only observe the last-hop proxy, so investigation workflows should preserve connection chains and pivot across internal and boundary telemetry.
  • For CDN or HTTPS-routed traffic, compare TLS, HTTP, DNS, and proxy evidence where available; note that encrypted traffic and privacy constraints can limit content inspection.
  • Reduce false positives by baselining approved business proxies, remote access relays, CDN-heavy applications, and sanctioned network appliances before escalating deviations.

Mitigation priorities

  • Start with network traffic filtering to restrict unnecessary ingress, egress, and lateral communications across endpoints, servers, network devices, and virtualized platforms.
  • Use network intrusion prevention at boundaries to block traffic matching known malicious or policy-violating patterns.
  • Apply SSL/TLS inspection selectively where legal, privacy, and operational requirements allow, with clear exception handling for sensitive traffic.
  • Maintain an inventory of authorized proxies, relays, CDNs, and network paths so SOC teams can distinguish expected intermediaries from suspicious bridging behavior.
  • Ensure incident response playbooks include proxy-chain scoping, last-hop analysis, and collection from network devices as well as endpoints.
Additional notes and limits

ATT&CK links this technique to multiple sub-techniques: Internal Proxy, External Proxy, Multi-hop Proxy, and Domain Fronting. It is also associated through relationships with multiple campaigns and groups, which supports prioritizing durable detection and response coverage, but those relationships do not by themselves prove current activity in any specific environment.

The official ATT&CK object does not provide detection guidance for the parent technique. Recommendations here are derived from the supplied description, platforms, tactics, mitigations, DET0445 relationship, and sub-technique context. Local architecture, encryption policy, proxy inventory, and log availability are required to determine actual coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Proxy

No official description is available in the imported ATT&CK source object.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

4 rows
DomainIDNameRelationship / procedure
EnterpriseT1090.001Internal ProxySub-techniqueInternal Proxy subtechnique of this object.
EnterpriseT1090.003Multi-hop ProxySub-techniqueMulti-hop Proxy subtechnique of this object.
EnterpriseT1090.004Domain FrontingSub-techniqueDomain Fronting subtechnique of this object.
EnterpriseT1090.002External ProxySub-techniqueExternal Proxy subtechnique of this object.
Associated objects

Groups, software, and campaigns

GroupEnterprise

G1017: Volt Typhoon

Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.[1][2][3][4]. The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.[5].

Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to Volt Typhoon, also tracked as VOLTZITE, for follow-on operations. [6]

GroupEnterprise

G0034: Sandworm Team

Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.[1][2] This group has been active since at least 2009.[3][4][5][6]

In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide NotPetya attack, targeting of the 2017 French presidential campaign, the 2018 Olympic Destroyer attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.[1][2] Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as APT28.[7]

GroupEnterprise

G0010: Turla

Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.[1][2][3][4][5]

GroupEnterprise

G0052: CopyKittens

CopyKittens is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip.[1][2][3]

GroupEnterprise

G1054: MirrorFace

MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.[1][2][3][4][5][6]

GroupEnterprise

G1004: LAPSUS$

LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.[1][2][3]

GroupEnterprise

G0108: Blue Mockingbird

Blue Mockingbird is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in December 2019.[1]

GroupEnterprise

G1021: Cinnamon Tempest

Cinnamon Tempest is a China-based threat group that has been active since at least 2021 deploying multiple strains of ransomware based on the leaked Babuk source code. Cinnamon Tempest does not operate their ransomware on an affiliate model or purchase access but appears to act independently in all stages of the attack lifecycle. Based on victimology, the short lifespan of each ransomware variant, and use of malware attributed to government-sponsored threat groups, Cinnamon Tempest may be motivated by intellectual property theft or cyberespionage rather than financial gain.[1][2][3][4]

GroupEnterprise

G0124: Windigo

The Windigo group has been operating since at least 2011, compromising thousands of Linux and Unix servers using the Ebury SSH backdoor to create a spam botnet. Despite law enforcement intervention against the creators, Windigo operators continued updating Ebury through 2019.[1][2]

GroupEnterprise

G1005: POLONIUM

POLONIUM is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February 2022. Security researchers assess POLONIUM has coordinated their operations with multiple actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS), based on victim overlap as well as common techniques and tooling.[1]

GroupEnterprise

G0117: Fox Kitten

Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.[1][2][3][4]

MalwareEnterprise

S0198: NETWIRE

NETWIRE is a publicly available, multiplatform remote administration tool (RAT) that has been used by criminal and APT groups since at least 2012.[1][2][3]

WindowsLinuxmacOS
MalwareEnterprise

S1212: RansomHub

RansomHub is a ransomware-as-a-service (RaaS) offering with Windows, ESXi, Linux, and FreeBSD versions that has been in use since at least 2024 to target organizations in multiple sectors globally. RansomHub operators may have purchased and rebranded resources from Knight (formerly Cyclops) Ransomware which shares infrastructure, feature, and code overlaps with RansomHub.[1][2]

LinuxWindows
ToolEnterprise

S0040: HTRAN

HTRAN is a tool that proxies connections through intermediate hops and aids users in disguising their true geographical location. It can be used by adversaries to hide their location when interacting with the victim networks. [1][2]

LinuxWindows
ToolEnterprise

S1144: FRP

FRP, which stands for Fast Reverse Proxy, is an openly available tool that is capable of exposing a server located behind a firewall or Network Address Translation (NAT) to the Internet. FRP can support multiple protocols including TCP, UDP, and HTTP(S) and has been abused by threat actors to proxy command and control communications.[1][2][3][4]

LinuxmacOSWindows
MalwareEnterprise

S1229: Havoc

Havoc is an open-source post-exploitation command and control (C2) framework first released on GitHub in October 2022 by C5pider (Paul Ungur), who continues to maintain and develop it with community contributors. Havoc provides a wide range of offensive security capabilities and has been adopted by multiple threat actors to establish and maintain control over compromised systems.

LinuxmacOSWindows
MalwareEnterprise

S0412: ZxShell

ZxShell is a remote administration tool and backdoor that can be downloaded from the Internet, particularly from Chinese hacker websites. It has been used since at least 2004.[1][2]

Windows
CampaignEnterprise

C0063: 2025 Poland Wiper Attacks

2025 Poland Wiper Attacks is a Russian state-sponsored campaign that conducted destructive cyberattacks against Polish energy infrastructure in December 2025. Targets included more than 30 wind and photovoltaic farms, a combined heat and power (CHP) plant, and a manufacturing sector company. The attacks on the distributed energy resources (DER) disrupted communications between affected facilities and the distribution system operator, but did not impact electricity generation or heat supply. Across the campaign, threat actors deployed two previously undocumented wiper tools, DynoWiper, a Windows-based wiper and LazyWiper, a PowerShell wiper, distributed via malicious Group Policy Objects. At the CHP plant, threat actors had maintained access since at least March 2025, using that foothold to obtain credentials and move laterally before attempting wiper deployment. Some reporting has assessed the activity to be consistent with Russian Federal Security Service (FSB) threat activity group Dragonfly, also tracked as STATIC TUNDRA, while other reporting attributes the destructive wiper activities to the Russian General Staff Main Intelligence Directorate (GRU) threat activity group ELECTRUM, also tracked as Sandworm Team.[1][2][3][4]

CampaignEnterprise

C0059: Salesforce Data Exfiltration

The Salesforce Data Exfiltration campaign began in October 2024 with financially-motivated threat actor UNC6040 using Spearphishing Voice (vishing) to compromise corporate Salesforce instances for large-scale data theft and extortion. Following the initial data theft, victim organizations received extortion demands from a separate threat actor, UNC6240, who claimed to be the “ShinyHunters” group. The observed infrastructure and TTPs used during the Salesforce Data Exfiltration campaign overlap with those used by threat groups with suspected ties to the broader collective known as "The Com.” These overlaps could plausibly be the result of associated actors operating within the same communities and are not necessarily an indication of a direct operational relationship.[1][2]

CampaignEnterprise

C0017: C0017

C0017 was an APT41 campaign conducted between May 2021 and February 2022 that successfully compromised at least six U.S. state government networks through the exploitation of vulnerable Internet facing web applications. During C0017, APT41 was quick to adapt and use publicly-disclosed as well as zero-day vulnerabilities for initial access, and in at least two cases re-compromised victims following remediation efforts. The goals of C0017 are unknown, however APT41 was observed exfiltrating Personal Identifiable Information (PII).[1]

CampaignEnterprise

C0056: RedPenguin

The RedPenguin project was launched by Juniper in July 2024 to investigate reported malware infections of Juniper MX Series routers. RedPenguin activity was separately attributed to UNC3886 and included the deployment of multiple custom versions of the publicly-available TINYSHELL backdoor on Juniper routers.[1][2]

CampaignEnterprise

C0014: Operation Wocao

Operation Wocao was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and the United States. The suspected China-based actors compromised government organizations and managed service providers, as well as aviation, construction, energy, finance, health care, insurance, offshore engineering, software development, and transportation companies.[1]

Security researchers assessed the Operation Wocao actors used similar TTPs and tools as APT20, suggesting a possible overlap. Operation Wocao was named after an observed command line entry by one of the threat actors, possibly out of frustration from losing webshell access.[1]

CampaignEnterprise

C0058: SharePoint ToolShell Exploitation

The SharePoint ToolShell Exploitation campaign was conducted in July 2025 and encompassed the first waves of exploitation against incompletely patched spoofing (CVE-2025-49706) and remote code execution (CVE-2025-49704) vulnerabilities affecting on-premises Microsoft SharePoint servers. Later patched and updated as CVE-2025-53770 and CVE-2025-53771, the ToolShell vulnerabilities were widely exploited including by China-based ransomware actor Storm-2603 and espionage actors Threat Group-3390 and ZIRCONIUM. SharePoint ToolShell Exploitation targeted multiple regions and industries including finance, education, energy, and healthcare across Asia, Europe, and the United States.[1][2][3][4][5]

Relationship explorer

All related ATT&CK context

uses · MalwareS1210: SagerunexEnterpriseuses · MalwareS0198: NETWIREEnterpriseuses · MalwareS1114: ZIPLINEEnterpriseuses · MalwareS1212: RansomHubEnterpriseuses · MalwareS0669: KOCTOPUSEnterpriseuses · GroupG1017: Volt TyphoonEnterpriseuses · MalwareS0461: SDBbotEnterpriseuses · MalwareS0615: SombRATEnterpriseuses · ToolS0040: HTRANEnterpriseuses · ToolS1144: FRPEnterpriseuses · CampaignC0047: RedDelta Modified PlugX Infection Chain OperationsEnterpriseuses · GroupG0034: Sandworm TeamEnterprisedetects · Detection StrategyDET0445: Detection of Proxy Infrastructure Setup and Traffic BridgingEnterpriseuses · MalwareS1229: HavocEnterpriseuses · MalwareS0347: AuditCredEnterprisesubtechnique of · TechniqueT1090.001: Internal ProxyEnterpriseuses · MalwareS0412: ZxShellEnterprisesubtechnique of · TechniqueT1090.003: Multi-hop ProxyEnterprisesubtechnique of · TechniqueT1090.004: Domain FrontingEnterpriseuses · GroupG0010: TurlaEnterpriseuses · CampaignC0048: Operation MidnightEclipseEnterpriseuses · MalwareS0376: HOPLIGHTEnterpriseuses · GroupG0052: CopyKittensEnterpriseuses · GroupG1054: MirrorFaceEnterprise
Mitigations

Mitigation direction

MitigationEnterprise

M1037: Filter Network Traffic

Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures:

Ingress Traffic Filtering:

- Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers. - Implementation: Limit SSH (port 22) and RDP (port 3389) traffic to specific IP ranges.

Egress Traffic Filtering:

- Use Case: Use firewalls or endpoint security software to block unauthorized outbound traffic to prevent data exfiltration and command-and-control (C2) communications. - Implementation: Block outbound traffic to known malicious IPs or regions where communication is unexpected.

Protocol-Based Filtering:

- Use Case: Restrict the use of specific protocols that are commonly abused by adversaries, such as SMB, RPC, or Telnet, based on business needs. - Implementation: Disable SMBv1 on endpoints to prevent exploits like EternalBlue.

Network Segmentation:

- Use Case: Create network segments for critical systems and restrict communication between segments unless explicitly authorized. - Implementation: Implement VLANs to isolate IoT devices or guest networks from core business systems.

Application Layer Filtering:

- Use Case: Use proxy servers or Web Application Firewalls (WAFs) to inspect and block malicious HTTP/S traffic. - Implementation: Configure a WAF to block SQL injection attempts or other web application exploitation techniques.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
3.2
Created
Modified
Raw hash
793148620802f657...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.13.2Current bundle793148620802…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Trend Micro APT Attack Tools

    Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools of the Trade. Retrieved December 2, 2015.

  2. [2]
    Cisco LotusBlossom 2025

    Joey Chen, Cisco Talos. (2025, February 27). Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools. Retrieved March 15, 2025.

    Open source URL
  3. [3]
    Red Canary NETWIRE January 2020

    Lambert, T. (2020, January 29). Intro to Netwire. Retrieved January 7, 2021.

    Open source URL
  4. [4]
    Mandiant Cutting Edge January 2024

    McLellan, T. et al. (2024, January 12). Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation. Retrieved February 27, 2024.

    Open source URL
  5. [5]
    Mandiant Cutting Edge Part 2 January 2024

    Lin, M. et al. (2024, January 31). Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation. Retrieved February 27, 2024.

    Open source URL
  6. [6]
    Group-IB RansomHub FEB 2025

    Alfano, V. et al. (2025, February 12). RansomHub Never Sleeps Episode 1: The evolution of modern ransomware. Retrieved March 17, 2025.

    Open source URL
  7. [7]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  8. [8]
    Microsoft Volt Typhoon May 2023

    Microsoft Threat Intelligence. (2023, May 24). Volt Typhoon targets US critical infrastructure with living-off-the-land techniques. Retrieved July 27, 2023.

    Open source URL
  9. [9]
    Joint Cybersecurity Advisory Volt Typhoon June 2023

    NSA et al. (2023, May 24). People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection. Retrieved July 27, 2023.

    Open source URL
  10. [10]
    CISA AA24-038A PRC Critical Infrastructure February 2024

    CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.

    Open source URL
  11. [11]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  12. [12]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  13. [13]
    Operation Quantum Entanglement

    Haq, T., Moran, N., Vashisht, S., Scott, M. (2014, September). OPERATION QUANTUM ENTANGLEMENT. Retrieved November 17, 2024.

    Open source URL
  14. [14]
    NCSC Joint Report Public Tools

    The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.

    Open source URL
  15. [15]
    FRP GitHub

    fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.

    Open source URL
  16. [16]
    Recorded Future RedDelta 2025

    Insikt Group. (2025, January 9). Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain. Retrieved January 14, 2025.

    Open source URL
  17. [17]
    ESET Telebots Dec 2016

    Cherepanov, A.. (2016, December 13). The rise of TeleBots: Analyzing disruptive KillDisk attacks. Retrieved June 10, 2020.

    Open source URL
  18. [18]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  19. [19]
    TrendMicro Lazarus Nov 2018

    Trend Micro. (2018, November 20). Lazarus Continues Heists, Mounts Attacks on Financial Organizations in Latin America. Retrieved December 3, 2018.

    Open source URL
  20. [20]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  21. [21]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  22. [22]
    ESET Turla PowerShell May 2019

    Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.

    Open source URL
  23. [23]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  24. [24]
    US-CERT HOPLIGHT Apr 2019

    US-CERT. (2019, April 10). MAR-10135536-8 – North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019.

    Open source URL
  25. [25]
    Microsoft POLONIUM June 2022

    Microsoft. (2022, June 2). Exposing POLONIUM activity and infrastructure targeting Israeli organizations. Retrieved July 1, 2022.

    Open source URL
  26. [26]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  27. [27]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  28. [28]
    MalwareBytes Ngrok February 2020

    Segura, J. (2020, February 26). Fraudsters cloak credit card skimmer with fake content delivery network, ngrok server. Retrieved September 15, 2020.

    Open source URL
  29. [29]
    Zdnet Ngrok September 2018

    Cimpanu, C. (2018, September 13). Sly malware author hides cryptomining botnet behind ever-shifting proxy service. Retrieved September 15, 2020.

    Open source URL
  30. [30]
    Mandiant Cutting Edge Part 3 February 2024

    Lin, M. et al. (2024, February 27). Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts. Retrieved March 1, 2024.

    Open source URL
  31. [31]
    MSTIC DEV-0537 Mar 2022

    MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022.

    Open source URL
  32. [32]
    RedCanary Mockingbird May 2020

    Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved May 26, 2020.

    Open source URL
  33. [33]
    GitHub Neo-reGeorg 2019

    L-Codes. (2019). Neo-reGeorg. Retrieved December 4, 2024.

    Open source URL
  34. [34]
    CERT Polska

    CERT Polska. (2026, January 30). Energy Sector Incident Report – 29 December. Retrieved April 22, 2026.

    Open source URL
  35. [35]
    ESET DynoWiper Update JAN 2026

    ESET. (2026, January 30). DynoWiper update: Technical analysis and attribution. Retrieved April 22, 2026.

    Open source URL
  36. [36]
    Sygnia Emperor Dragonfly October 2022

    Biderman, O. et al. (2022, October 3). REVEALING EMPEROR DRAGONFLY: NIGHT SKY AND CHEERSCRYPT - A SINGLE RANSOMWARE GROUP. Retrieved December 6, 2023.

    Open source URL
  37. [37]
    Google Salesforce JUN 2025

    Google Threat Intelligence Group. (2025, June 4). The Cost of a Call: From Voice Phishing to Data Extortion. Retrieved October 22, 2025.

    Open source URL
  38. [38]
    Riskiq Remcos Jan 2018

    Klijnsma, Y. (2018, January 23). Espionage Campaign Leverages Spear Phishing, RATs Against Turkish Defense Contractors. Retrieved November 6, 2018.

    Open source URL
  39. [39]
    Fortinet Remcos Campaign NOV 2024

    Zhang, X. (2024, November 8). New Campaign Uses Remcos RAT to Exploit Victims. Retrieved April 16, 2026.

    Open source URL
  40. [40]
    US-CERT BADCALL

    US-CERT. (2018, February 06). Malware Analysis Report (MAR) - 10135536-G. Retrieved June 7, 2018.

    Open source URL
  41. [41]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  42. [42]
    S2W Troll Stealer 2024

    Jiho Kim & Sebin Lee, S2W. (2024, February 7). Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer (English ver.). Retrieved January 17, 2025.

    Open source URL
  43. [43]
    Securelist fileless attacks Feb 2017

    Kaspersky Lab's Global Research and Analysis Team. (2017, February 8). Fileless attacks against enterprise networks. Retrieved February 8, 2017.

    Open source URL
  44. [44]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  45. [45]
    JPCert PLEAD Downloader June 2018

    Tomonaga, S. (2018, June 8). PLEAD Downloader Used by BlackTech. Retrieved May 6, 2020.

    Open source URL
  46. [46]
    Dell Dridex Oct 2015

    Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, October 13). Dridex (Bugat v5) Botnet Takeover Operation. Retrieved May 31, 2019.

    Open source URL
  47. [47]
    Checkpoint Dridex Jan 2021

    Check Point Research. (2021, January 4). Stopping Serial Killer: Catching the Next Strike. Retrieved September 7, 2021.

    Open source URL
  48. [48]
    US-CERT HARDRAIN March 2018

    US-CERT. (2018, February 05). Malware Analysis Report (MAR) - 10135536-F. Retrieved June 11, 2018.

    Open source URL
  49. [49]
    ESET ForSSHe December 2018

    Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.

    Open source URL
  50. [50]
    JPCert BlackTech Malware September 2019

    Tomonaga, S.. (2019, September 18). Malware Used by BlackTech after Network Intrusion. Retrieved May 6, 2020.

    Open source URL
  51. [51]
    ESET Windigo Mar 2014

    Bilodeau, O., Bureau, M., Calvet, J., Dorais-Joncas, A., Léveillé, M., Vanheuverzwijn, B. (2014, March 18). Operation Windigo – the vivisection of a large Linux server‑side credential‑stealing malware campaign. Retrieved February 10, 2021.

    Open source URL
  52. [52]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  53. [53]
    US-CERT TYPEFRAME June 2018

    US-CERT. (2018, June 14). MAR-10135536-12 – North Korean Trojan: TYPEFRAME. Retrieved July 13, 2018.

    Open source URL
  54. [54]
    GitHub reGeorg 2016

    xl7dev. (2016). reGeorg-master. Retrieved December 3, 2024.

    Open source URL
  55. [55]
    Fortinet reGeorg MAR 2019

    FortiGard Labs. (2019, March 12). ReGeorg.HTTP.Tunnel. Retrieved December 3, 2024.

    Open source URL
  56. [56]
    Mandiant APT29 Eye Spy Email Nov 22

    Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023.

    Open source URL
  57. [57]
    Mandiant APT41

    Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022.

    Open source URL
  58. [58]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  59. [59]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  60. [60]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  61. [61]
    Objective See Green Lambert for OSX Oct 2021

    Sandvik, Runa. (2021, October 1). Made In America: Green Lambert for OS X. Retrieved March 21, 2022.

    Open source URL
  62. [62]
    Glitch-Cat Green Lambert ATTCK Oct 2021

    Sandvik, Runa. (2021, October 18). Green Lambert and ATT&CK. Retrieved November 17, 2024.

    Open source URL
  63. [63]
    Bitdefender FunnyDream Campaign November 2020

    Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.

    Open source URL
  64. [64]
    FoxIT Wocao December 2019

    Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.

    Open source URL
  65. [65]
    Bitdefender Naikon April 2021

    Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.

    Open source URL
  66. [66]
    PaloAlto CardinalRat Apr 2017

    Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.

    Open source URL
  67. [67]
    TrendMicro Patchwork Dec 2017

    Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.

    Open source URL
  68. [68]
    CISA AA20-259A Iran-Based Actor September 2020

    CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.

    Open source URL
  69. [69]
    ClearSky Pay2Kitten December 2020

    ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.

    Open source URL
  70. [70]
    Check Point Pay2Key November 2020

    Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021.

    Open source URL
  71. [71]
    Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025

    Insikt Group. (2025, February 13). Inside the Scam: North Korea’s IT Worker Threat. Retrieved October 17, 2025.

    Open source URL
  72. [72]
    Symantec Vasport May 2012

    Zhou, R. (2012, May 15). Backdoor.Vasport. Retrieved February 22, 2018.

    Open source URL
  73. [73]
    FalconFeeds_Iran_Mar2026

    FalconFeeds.io. (2026, March 5). The Digital Redoubt: Iran’s National Information Network and the Asymmetry of Modern Cyber Conflict. Retrieved March 9, 2026.

    Open source URL
  74. [74]
    Microsoft SharePoint Exploit JUL 2025

    Microsoft Threat Intelligence. (2025, July 22). Disrupting active exploitation of on-premises SharePoint vulnerabilities. Retrieved October 15, 2025.

    Open source URL
  75. [75]
    ESET ToolShell JUL 2025

    ESET Research. (2025, July 24). ToolShell: An all-you-can-eat buffet for threat actors. Retrieved October 15, 2025.

    Open source URL
  76. [76]
    GitHub QuasarRAT

    MaxXor. (n.d.). QuasarRAT. Retrieved July 10, 2018.

    Open source URL
  77. [77]
    Volexity Patchwork June 2018

    Meltzer, M, et al. (2018, June 07). Patchwork APT Group Targets US Think Tanks. Retrieved July 16, 2018.

    Open source URL
  78. [78]
    WithSecure Kapeka 2024

    Mohammad Kazem Hassan Nejad, WithSecure. (2024, April 17). KAPEKA A novel backdoor spotted in Eastern Europe. Retrieved January 6, 2025.

    Open source URL
  79. [79]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  80. [80]
    CrowdStrike Scattered Spider JUL 2025

    Counter Adversary Operations. (2025, July 2). CrowdStrike Services Observes SCATTERED SPIDER Escalate Attacks Across Industries. Retrieved October 13, 2025.

    Open source URL
  81. [81]
    CISA Scattered Spider Advisory November 2023

    CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.

    Open source URL
  82. [82]
    DFIR Phosphorus November 2021

    DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023.

    Open source URL
  83. [83]
    NJCCIC Ursnif Sept 2016

    NJCCIC. (2016, September 27). Ursnif. Retrieved September 12, 2024.

    Open source URL
  84. [84]
    ProofPoint Ursnif Aug 2016

    Proofpoint Staff. (2016, August 25). Nightmare on Tor Street: Ursnif variant Dreambot adds Tor functionality. Retrieved June 5, 2019.

    Open source URL
  85. [85]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  86. [86]
    Talos Bisonal Mar 2020

    Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.

    Open source URL
  87. [87]
    Crowdstrike DNC June 2016

    Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016.

    Open source URL
  88. [88]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  89. [89]
    University of Birmingham C2

    Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.

    Open source URL
  90. [90]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  91. [91]
    ESET Gamaredon Sept2024

    Rusnák, Z. (2024, September 26). Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023. Retrieved October 30, 2024.

    Open source URL
  92. [92]
    Trend Micro APT Attack Tools

    Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools of the Trade. Retrieved December 2, 2015.

  93. [93]
    Trend Micro APT Attack Tools

    Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools of the Trade. Retrieved December 2, 2015.

  94. [94]
    University of Birmingham C2

    Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.

    Open source URL
  95. [95]
    University of Birmingham C2

    Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.

    Open source URL
  96. [96]
    mitre-attackT1090
    Open source URL
  97. [97]
    mitre-attackT1090
    Open source URL
  98. [98]
    mitre-attackT1090
    Open source URL
  99. [99]
    Cisco LotusBlossom 2025

    Joey Chen, Cisco Talos. (2025, February 27). Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools. Retrieved March 15, 2025.

    Open source URL
  100. [100]
    Red Canary NETWIRE January 2020

    Lambert, T. (2020, January 29). Intro to Netwire. Retrieved January 7, 2021.

    Open source URL
  101. [101]
    Mandiant Cutting Edge January 2024

    McLellan, T. et al. (2024, January 12). Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation. Retrieved February 27, 2024.

    Open source URL
  102. [102]
    Mandiant Cutting Edge Part 2 January 2024

    Lin, M. et al. (2024, January 31). Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation. Retrieved February 27, 2024.

    Open source URL
  103. [103]
    Group-IB RansomHub FEB 2025

    Alfano, V. et al. (2025, February 12). RansomHub Never Sleeps Episode 1: The evolution of modern ransomware. Retrieved March 17, 2025.

    Open source URL
  104. [104]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  105. [105]
    CISA AA24-038A PRC Critical Infrastructure February 2024

    CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.

    Open source URL
  106. [106]
    Joint Cybersecurity Advisory Volt Typhoon June 2023

    NSA et al. (2023, May 24). People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection. Retrieved July 27, 2023.

    Open source URL
  107. [107]
    Microsoft Volt Typhoon May 2023

    Microsoft Threat Intelligence. (2023, May 24). Volt Typhoon targets US critical infrastructure with living-off-the-land techniques. Retrieved July 27, 2023.

    Open source URL
  108. [108]
    Proofpoint TA505 October 2019

    Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.

    Open source URL
  109. [109]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  110. [110]
    NCSC Joint Report Public Tools

    The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.

    Open source URL
  111. [111]
    Operation Quantum Entanglement

    Haq, T., Moran, N., Vashisht, S., Scott, M. (2014, September). OPERATION QUANTUM ENTANGLEMENT. Retrieved November 17, 2024.

    Open source URL
  112. [112]
    FRP GitHub

    fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.

    Open source URL
  113. [113]
    Recorded Future RedDelta 2025

    Insikt Group. (2025, January 9). Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain. Retrieved January 14, 2025.

    Open source URL
  114. [114]
    ESET Telebots Dec 2016

    Cherepanov, A.. (2016, December 13). The rise of TeleBots: Analyzing disruptive KillDisk attacks. Retrieved June 10, 2020.

    Open source URL
  115. [115]
    Havoc Framework Documentation

    Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.

    Open source URL
  116. [116]
    TrendMicro Lazarus Nov 2018

    Trend Micro. (2018, November 20). Lazarus Continues Heists, Mounts Attacks on Financial Organizations in Latin America. Retrieved December 3, 2018.

    Open source URL
  117. [117]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  118. [118]
    Talos ZxShell Oct 2014

    Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.

    Open source URL
  119. [119]
    ESET Turla PowerShell May 2019

    Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.

    Open source URL
  120. [120]
    Volexity UPSTYLE 2024

    Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.

    Open source URL
  121. [121]
    US-CERT HOPLIGHT Apr 2019

    US-CERT. (2019, April 10). MAR-10135536-8 – North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019.

    Open source URL
  122. [122]
    Microsoft POLONIUM June 2022

    Microsoft. (2022, June 2). Exposing POLONIUM activity and infrastructure targeting Israeli organizations. Retrieved July 1, 2022.

    Open source URL
  123. [123]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  124. [124]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  125. [125]
    MalwareBytes Ngrok February 2020

    Segura, J. (2020, February 26). Fraudsters cloak credit card skimmer with fake content delivery network, ngrok server. Retrieved September 15, 2020.

    Open source URL
  126. [126]
    Zdnet Ngrok September 2018

    Cimpanu, C. (2018, September 13). Sly malware author hides cryptomining botnet behind ever-shifting proxy service. Retrieved September 15, 2020.

    Open source URL
  127. [127]
    Mandiant Cutting Edge Part 3 February 2024

    Lin, M. et al. (2024, February 27). Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts. Retrieved March 1, 2024.

    Open source URL
  128. [128]
    MSTIC DEV-0537 Mar 2022

    MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022.

    Open source URL
  129. [129]
    RedCanary Mockingbird May 2020

    Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved May 26, 2020.

    Open source URL
  130. [130]
    GitHub Neo-reGeorg 2019

    L-Codes. (2019). Neo-reGeorg. Retrieved December 4, 2024.

    Open source URL
  131. [131]
    CERT Polska

    CERT Polska. (2026, January 30). Energy Sector Incident Report – 29 December. Retrieved April 22, 2026.

    Open source URL
  132. [132]
    ESET DynoWiper Update JAN 2026

    ESET. (2026, January 30). DynoWiper update: Technical analysis and attribution. Retrieved April 22, 2026.

    Open source URL
  133. [133]
    Sygnia Emperor Dragonfly October 2022

    Biderman, O. et al. (2022, October 3). REVEALING EMPEROR DRAGONFLY: NIGHT SKY AND CHEERSCRYPT - A SINGLE RANSOMWARE GROUP. Retrieved December 6, 2023.

    Open source URL
  134. [134]
    Google Salesforce JUN 2025

    Google Threat Intelligence Group. (2025, June 4). The Cost of a Call: From Voice Phishing to Data Extortion. Retrieved October 22, 2025.

    Open source URL
  135. [135]
    Fortinet Remcos Campaign NOV 2024

    Zhang, X. (2024, November 8). New Campaign Uses Remcos RAT to Exploit Victims. Retrieved April 16, 2026.

    Open source URL
  136. [136]
    Riskiq Remcos Jan 2018

    Klijnsma, Y. (2018, January 23). Espionage Campaign Leverages Spear Phishing, RATs Against Turkish Defense Contractors. Retrieved November 6, 2018.

    Open source URL
  137. [137]
    US-CERT BADCALL

    US-CERT. (2018, February 06). Malware Analysis Report (MAR) - 10135536-G. Retrieved June 7, 2018.

    Open source URL
  138. [138]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  139. [139]
    S2W Troll Stealer 2024

    Jiho Kim & Sebin Lee, S2W. (2024, February 7). Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer (English ver.). Retrieved January 17, 2025.

    Open source URL
  140. [140]
    Securelist fileless attacks Feb 2017

    Kaspersky Lab's Global Research and Analysis Team. (2017, February 8). Fileless attacks against enterprise networks. Retrieved February 8, 2017.

    Open source URL
  141. [141]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  142. [142]
    JPCert PLEAD Downloader June 2018

    Tomonaga, S. (2018, June 8). PLEAD Downloader Used by BlackTech. Retrieved May 6, 2020.

    Open source URL
  143. [143]
    Checkpoint Dridex Jan 2021

    Check Point Research. (2021, January 4). Stopping Serial Killer: Catching the Next Strike. Retrieved September 7, 2021.

    Open source URL
  144. [144]
    Dell Dridex Oct 2015

    Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, October 13). Dridex (Bugat v5) Botnet Takeover Operation. Retrieved May 31, 2019.

    Open source URL
  145. [145]
    US-CERT HARDRAIN March 2018

    US-CERT. (2018, February 05). Malware Analysis Report (MAR) - 10135536-F. Retrieved June 11, 2018.

    Open source URL
  146. [146]
    ESET ForSSHe December 2018

    Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.

    Open source URL
  147. [147]
    JPCert BlackTech Malware September 2019

    Tomonaga, S.. (2019, September 18). Malware Used by BlackTech after Network Intrusion. Retrieved May 6, 2020.

    Open source URL
  148. [148]
    ESET Windigo Mar 2014

    Bilodeau, O., Bureau, M., Calvet, J., Dorais-Joncas, A., Léveillé, M., Vanheuverzwijn, B. (2014, March 18). Operation Windigo – the vivisection of a large Linux server‑side credential‑stealing malware campaign. Retrieved February 10, 2021.

    Open source URL
  149. [149]
    Microsoft POLONIUM June 2022

    Microsoft. (2022, June 2). Exposing POLONIUM activity and infrastructure targeting Israeli organizations. Retrieved July 1, 2022.

    Open source URL
  150. [150]
    Microsoft POLONIUM June 2022

    Microsoft. (2022, June 2). Exposing POLONIUM activity and infrastructure targeting Israeli organizations. Retrieved July 1, 2022.

    Open source URL
  151. [151]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  152. [152]
    US-CERT TYPEFRAME June 2018

    US-CERT. (2018, June 14). MAR-10135536-12 – North Korean Trojan: TYPEFRAME. Retrieved July 13, 2018.

    Open source URL
  153. [153]
    Fortinet reGeorg MAR 2019

    FortiGard Labs. (2019, March 12). ReGeorg.HTTP.Tunnel. Retrieved December 3, 2024.

    Open source URL
  154. [154]
    GitHub reGeorg 2016

    xl7dev. (2016). reGeorg-master. Retrieved December 3, 2024.

    Open source URL
  155. [155]
    Mandiant APT29 Eye Spy Email Nov 22

    Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023.

    Open source URL
  156. [156]
    Mandiant APT41

    Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022.

    Open source URL
  157. [157]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  158. [158]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  159. [159]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  160. [160]
    Glitch-Cat Green Lambert ATTCK Oct 2021

    Sandvik, Runa. (2021, October 18). Green Lambert and ATT&CK. Retrieved November 17, 2024.

    Open source URL
  161. [161]
    Objective See Green Lambert for OSX Oct 2021

    Sandvik, Runa. (2021, October 1). Made In America: Green Lambert for OS X. Retrieved March 21, 2022.

    Open source URL
  162. [162]
    Bitdefender FunnyDream Campaign November 2020

    Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.

    Open source URL
  163. [163]
    FoxIT Wocao December 2019

    Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.

    Open source URL
  164. [164]
    Bitdefender Naikon April 2021

    Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.

    Open source URL
  165. [165]
    PaloAlto CardinalRat Apr 2017

    Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.

    Open source URL
  166. [166]
    TrendMicro Patchwork Dec 2017

    Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.

    Open source URL
  167. [167]
    CISA AA20-259A Iran-Based Actor September 2020

    CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.

    Open source URL
  168. [168]
    Check Point Pay2Key November 2020

    Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021.

    Open source URL
  169. [169]
    ClearSky Pay2Kitten December 2020

    ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.

    Open source URL
  170. [170]
    Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025

    Insikt Group. (2025, February 13). Inside the Scam: North Korea’s IT Worker Threat. Retrieved October 17, 2025.

    Open source URL
  171. [171]
    Symantec Vasport May 2012

    Zhou, R. (2012, May 15). Backdoor.Vasport. Retrieved February 22, 2018.

    Open source URL
  172. [172]
    FalconFeeds_Iran_Mar2026

    FalconFeeds.io. (2026, March 5). The Digital Redoubt: Iran’s National Information Network and the Asymmetry of Modern Cyber Conflict. Retrieved March 9, 2026.

    Open source URL
  173. [173]
    ESET ToolShell JUL 2025

    ESET Research. (2025, July 24). ToolShell: An all-you-can-eat buffet for threat actors. Retrieved October 15, 2025.

    Open source URL
  174. [174]
    Microsoft SharePoint Exploit JUL 2025

    Microsoft Threat Intelligence. (2025, July 22). Disrupting active exploitation of on-premises SharePoint vulnerabilities. Retrieved October 15, 2025.

    Open source URL
  175. [175]
    GitHub QuasarRAT

    MaxXor. (n.d.). QuasarRAT. Retrieved July 10, 2018.

    Open source URL
  176. [176]
    Volexity Patchwork June 2018

    Meltzer, M, et al. (2018, June 07). Patchwork APT Group Targets US Think Tanks. Retrieved July 16, 2018.

    Open source URL
  177. [177]
    WithSecure Kapeka 2024

    Mohammad Kazem Hassan Nejad, WithSecure. (2024, April 17). KAPEKA A novel backdoor spotted in Eastern Europe. Retrieved January 6, 2025.

    Open source URL
  178. [178]
    TrendMicro EarthLusca 2022

    Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.

    Open source URL
  179. [179]
    CISA Scattered Spider Advisory November 2023

    CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.

    Open source URL
  180. [180]
    CrowdStrike Scattered Spider JUL 2025

    Counter Adversary Operations. (2025, July 2). CrowdStrike Services Observes SCATTERED SPIDER Escalate Attacks Across Industries. Retrieved October 13, 2025.

    Open source URL
  181. [181]
    DFIR Phosphorus November 2021

    DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023.

    Open source URL
  182. [182]
    NJCCIC Ursnif Sept 2016

    NJCCIC. (2016, September 27). Ursnif. Retrieved September 12, 2024.

    Open source URL
  183. [183]
    ProofPoint Ursnif Aug 2016

    Proofpoint Staff. (2016, August 25). Nightmare on Tor Street: Ursnif variant Dreambot adds Tor functionality. Retrieved June 5, 2019.

    Open source URL
  184. [184]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  185. [185]
    Talos Bisonal Mar 2020

    Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.

    Open source URL
  186. [186]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  187. [187]
    FireEye APT41 Aug 2019

    Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.

    Open source URL
  188. [188]
    Crowdstrike DNC June 2016

    Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016.

    Open source URL
  189. [189]
    ESET Turla Lunar toolset May 2024

    Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.

    Open source URL
  190. [190]
    University of Birmingham C2

    Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.

    Open source URL
  191. [191]
    University of Birmingham C2

    Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.

    Open source URL
  192. [192]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  193. [193]
    Mandiant APT41

    Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use