T1614.001: System Language Discovery
Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.[1]
There are various sources of data an adversary could use to infer system language, such as system defaults and keyboard layouts. Specific checks will vary based on the target and/or adversary, but may involve behaviors such as Query Registry and calls to Native API functions.[2]
For example, on a Windows system adversaries may attempt to infer the language of a system by querying the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language or parsing the outputs of Windows API functions GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList and GetUserDefaultLangID.[3][4][5]
On a macOS or Linux system, adversaries may query locale to retrieve the value of the $LANG environment variable.
Security context for executives and security teams
System Language Discovery is a small discovery behavior with outsized decision value: malware or operators may check a host’s language, locale, or keyboard settings to infer geography and decide what to do next. For leaders, this matters because it can be part of automated targeting logic before ransomware, banking malware, backdoors, or espionage activity proceeds. By itself it is not proof of compromise, but in the right sequence it can help explain why suspicious code is profiling an endpoint before follow-on actions.
Executive priority
Prioritize this as a coverage-validation item rather than a standalone high-severity alert. ATT&CK associates this technique with multiple Windows malware families, including ransomware and backdoors, and with campaigns/groups, so it is useful for incident scoping, threat-informed detection engineering, and audit evidence that discovery behaviors are monitored. Ask whether SOC telemetry can show when endpoints query language/locale data, whether this is correlated with other discovery or execution activity, and whether incident responders can distinguish normal software localization checks from suspicious pre-infection gating.
Technical view
This is a Discovery sub-technique of System Location Discovery covering Linux, macOS, and Windows. On Windows, ATT&CK describes registry queries to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language and use of APIs such as GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList, and GetUserDefaultLangID. On macOS and Linux, ATT&CK describes querying locale to retrieve $LANG. No official MITRE detection text is provided, but the relationship context includes DET0565, Detection Strategy for System Language Discovery. SOC teams should validate detections around abnormal locale/language checks when they occur near suspicious execution, malware staging, broader host discovery, or activity linked to known software relationships such as Ryuk, SynAck, Maze, REvil, IcedID, Bazar, Clop, Cuba, and related backdoors listed by ATT&CK.
Likely telemetry
- Windows process execution and command-line telemetry for tools or scripts querying locale, language, keyboard layout, or registry language keys.
- Windows registry access telemetry for HKLM\SYSTEM\CurrentControlSet\Control\Nls\Language.
- Endpoint/EDR telemetry that can expose calls or behavioral indicators related to language and keyboard layout API usage where available.
- Linux and macOS process execution telemetry for locale commands and environment-variable inspection involving $LANG.
- Parent/child process context showing whether language discovery occurred from expected software installers/localized applications or from unusual binaries, scripts, downloaders, or backdoors.
Detection direction
- Do not alert on language checks in isolation without context; many legitimate applications check locale for localization.
- Tune for suspicious parent processes, newly introduced binaries, scripts, malware-like execution chains, or language checks occurring immediately before other discovery, persistence, credential, or impact behaviors.
- Validate DET0565 or equivalent internal analytics against the specific data sources available in the environment, because ATT&CK does not provide official detection logic for this object.
- Create platform-specific coverage: registry/API-oriented monitoring for Windows and process/environment monitoring for Linux and macOS.
- Use relationship context to enrich investigations, not to assert attribution: ATT&CK links this behavior to multiple groups, campaigns, and software families, but local evidence is required before drawing conclusions.
Mitigation priorities
- Focus first on visibility and correlation rather than blocking all locale checks, since language discovery is commonly legitimate.
- Ensure endpoint logging captures process lineage, command line, registry access where appropriate, and sufficient EDR behavioral context across Windows, Linux, and macOS.
- Use least privilege, application control, and execution-control baselines to reduce the chance that untrusted binaries or scripts can run discovery logic unchecked.
- In incident response playbooks, treat unexpected language discovery as a profiling signal and pivot to surrounding execution, persistence, network, and follow-on discovery evidence.
- For compliance and readiness evidence, document how discovery behaviors are logged, retained, triaged, and correlated with broader ATT&CK-based detections.
Additional notes and limits
This technique is most valuable as a contextual signal. Its business relevance comes from helping identify malware or operator decision logic that may precede infection, selective execution, or additional actions. The supplied relationships show use by multiple ATT&CK-tracked campaigns, groups, and software entries, including ransomware and backdoor families, but those relationships should guide enrichment and prioritization rather than attribution.
Official MITRE detection guidance is not provided for this technique. The ATT&CK object supplies behavior examples and platform scope, but not specific analytics, data source requirements, severity, or mitigation text. Local telemetry quality, process context, baselines for legitimate localization behavior, and correlation with other events are required to assess risk accurately.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
System Language Discovery
Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.[1]
There are various sources of data an adversary could use to infer system language, such as system defaults and keyboard layouts. Specific checks will vary based on the target and/or adversary, but may involve behaviors such as Query Registry and calls to Native API functions.[2]
For example, on a Windows system adversaries may attempt to infer the language of a system by querying the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language or parsing the outputs of Windows API functions GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList and GetUserDefaultLangID.[3][4][5]
On a macOS or Linux system, adversaries may query locale to retrieve the value of the $LANG environment variable.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1614 | System Location Discovery | This object subtechnique of System Location Discovery. |
Groups, software, and campaigns
G0004: Ke3chang
G1054: MirrorFace
MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.[1][2][3][4][5][6]
G1043: BlackByte
BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.[1][2][3][4][5]
G1053: Storm-0501
Storm-0501 is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. Storm-0501 has been active since 2021 and has previously been affiliated with Sabbath Ransomware and other Ransomware-as-a-Service (RaaS) variants such as Hive, BlackCat, Hunters International, LockBit 3.0, and Embargo ransomware.[1][2][3][4]
G1026: Malteiro
Malteiro is a financially motivated criminal group that is likely based in Brazil and has been active since at least November 2019. The group operates and distributes the Mispadu banking trojan via a Malware-as-a-Service (MaaS) business model. Malteiro mainly targets victims throughout Latin America (particularly Mexico) and Europe (particularly Spain and Portugal).[1]
S1153: Cuckoo Stealer
Cuckoo Stealer is a macOS malware with characteristics of spyware and an infostealer that has been in use since at least 2024. Cuckoo Stealer is a universal Mach-O binary that can run on Intel or ARM-based Macs and has been spread through trojanized versions of various potentially unwanted programs or PUP's such as converters, cleaners, and uninstallers.[1][2]
S0652: MarkiRAT
MarkiRAT is a remote access Trojan (RAT) compiled with Visual Studio that has been used by Ferocious Kitten since at least 2015.[1]
S0658: XCSSET
XCSSET is a modular macOS malware family delivered through infected Xcode projects and executed when the project is compiled. Active since August 2020, it has been observed installing backdoors, spoofed browsers, collecting data, and encrypting user files. It is composed of SHC-compiled shell scripts and run-only AppleScripts, often hiding in apps that mimic system tools (such as Xcode, Mail, or Notes) or use familiar icons (like Launchpad) to avoid detection.[1][2][3]
S0625: Cuba
S0696: Flagpro
S0483: IcedID
S0640: Avaddon
S0449: Maze
S1122: Mispadu
Mispadu is a banking trojan written in Delphi that was first observed in 2019 and uses a Malware-as-a-Service (MaaS) business model.[1][2] This malware is operated, managed, and sold by the Malteiro cybercriminal group.[2] Mispadu has mainly been used to target victims in Brazil and Mexico, and has also had confirmed operations throughout Latin America and Europe.[2][3][4]
S0543: Spark
S1228: PUBLOAD
PUBLOAD is a stager malware that has been observed installing itself in existing directories such as `C:\Users\Public` or creating new directories to stage the malware and its components.[1] PUBLOAD malware collects details of the victim host, establishes persistence, encrypts victim details using RC4 and communicates victim details back to C2. PUBLOAD malware has previously been leveraged by China-affiliated actors identified as Mustang Panda. PUBLOAD is also known as “NoFive” and some public reporting identifies the loader component as CLAIMLOADER.[2]
S0446: Ryuk
C0022: Operation Dream Job
Operation Dream Job was a cyber espionage operation likely conducted by Lazarus Group that targeted the defense, aerospace, government, and other sectors in the United States, Israel, Australia, Russia, and India. In at least one case, the cyber actors tried to monetize their network access to conduct a business email compromise (BEC) operation. In 2020, security researchers noted overlapping TTPs, to include fake job lures and code similarities, between Operation Dream Job, Operation North Star, and Operation Interception; by 2022 security researchers described Operation Dream Job as an umbrella term covering both Operation Interception and Operation North Star.[1][2][3][4]
C0061: Operation Digital Eye
Operation Digital Eye was conducted in June and July of 2024 by suspected People's Republic of China (PRC)-nexus threat actors targeting business-to-business IT service providers in Southern Europe. Operation Digital Eye activity included the use of Visual Studio Code tunnels for command and control (C2) and custom lateral movement capabilities. Overlaps in tooling between Digital Eye and previous China-nexus campaigns, Operation Soft Cell and Operation Tainted Love, indicate the potential use of shared vendors or digital quartermasters.[1]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | 8c3b7719d5bd… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Malware System Language Check
Pierre-Marc Bureau. (2009, January 15). Malware Trying to Avoid Some Countries. Retrieved August 18, 2021.
Open source URL - [2]CrowdStrike Ryuk January 2019
Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.
Open source URL - [3]Darkside Ransomware Cybereason
Cybereason Nocturnus. (2021, April 1). Cybereason vs. Darkside Ransomware. Retrieved August 18, 2021.
Open source URL - [4]Securelist JSWorm
Fedor Sinitsyn. (2021, May 25). Evolution of JSWorm Ransomware. Retrieved August 18, 2021.
Open source URL - [5]SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL - [6]ClearSky Lazarus Aug 2020
ClearSky Research Team. (2020, August 13). Operation 'Dream Job' Widespread North Korean Espionage Campaign. Retrieved December 20, 2021.
Open source URL - [7]Kandji Cuckoo April 2024
Kohler, A. and Lopez, C. (2024, April 30). Malware: Cuckoo Behaves Like Cross Between Infostealer and Spyware. Retrieved August 20, 2024.
Open source URL - [8]Kaspersky Ferocious Kitten Jun 2021
GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.
Open source URL - [9]trendmicro xcsset xcode project 2020
Mac Threat Response, Mobile Research Team. (2020, August 13). The XCSSET Malware: Inserts Malicious Code Into Xcode Projects, Performs UXSS Backdoor Planting in Safari, and Leverages Two Zero-day Exploits. Retrieved October 5, 2021.
Open source URL - [10]McAfee Cuba April 2021
Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.
Open source URL - [11]Microsoft NICKEL December 2021
MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022.
Open source URL - [12]NTT Security Flagpro new December 2021
Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.
Open source URL - [13]DFIR_Quantum_Ransomware
DFIR. (2022, April 25). Quantum Ransomware. Retrieved July 26, 2024.
Open source URL - [14]Arxiv Avaddon Feb 2021
Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.
Open source URL - [15]McAfee Maze March 2020
Mundo, A. (2020, March 26). Ransomware Maze. Retrieved May 18, 2020.
Open source URL - [16]ITOCHU LODEINFO JAN 2024
ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.
Open source URL - [17]Segurança Informática URSA Sophisticated Loader 2020
Pedro Tavares (Segurança Informática). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024.
Open source URL - [18]SCILabs Malteiro 2021
SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.
Open source URL - [19]Unit42 Molerat Mar 2020
Falcone, R., et al. (2020, March 3). Molerats Delivers Spark Backdoor to Government and Telecommunications Organizations. Retrieved December 14, 2020.
Open source URL - [20]CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024
CSIRT CTI. (2024, January 23). Stately Taurus Targets Myanmar Amidst Concerns over Military Junta’s Handling of Rebel Attacks. Retrieved August 4, 2025.
Open source URL - [21]Picus BlackByte 2022
Huseyin Can Yuceel. (2022, February 21). TTPs used by BlackByte Ransomware Targeting Critical Infrastructure. Retrieved December 16, 2024.
Open source URL - [22]sentinelone operationDigitalEye Dec 2024
Aleksandar Milenkoski, Luigi Martire. (2024, December 10). Operation Digital Eye | Chinese APT Compromises Critical Digital Infrastructure via Visual Studio Code Tunnels. Retrieved February 27, 2025.
Open source URL - [23]Sophos Gootloader
Szappanos, G. & Brandt, A. (2021, March 1). “Gootloader” expands its payload delivery options. Retrieved September 30, 2022.
Open source URL - [24]Cylance Dust Storm
Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.
Open source URL - [25]Kaspersky LODEINFO Part II OCT 2022
Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part II. Retrieved April 17, 2026.
Open source URL - [26]NCC Group Team9 June 2020
Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.
Open source URL - [27]FireEye FiveHands April 2021
McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.
Open source URL - [28]Mcafee Clop Aug 2019
Mundo, A. (2019, August 1). Clop Ransomware. Retrieved May 10, 2021.
Open source URL - [29]Splunk RedLine Stealer June 2023
Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.
Open source URL - [30]Talos Zeus Panda Nov 2017
Brumaghin, E., et al. (2017, November 02). Poisoning the Well: Banking Trojan Targets Google Search Results. Retrieved November 5, 2018.
Open source URL - [31]Socket GlassWorm January 2026
Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.
Open source URL - [32]Group IB GrimAgent July 2021
Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.
Open source URL - [33]BleepingComputer Molerats Dec 2020
Ilascu, I. (2020, December 14). Hacking group’s new malware abuses Google and Facebook services. Retrieved December 28, 2020.
Open source URL - [34]FBI Lockbit 2.0 FEB 2022
FBI. (2022, February 4). Indicators of Compromise Associated with LockBit 2.0 Ransomware. Retrieved January 24, 2025.
Open source URL - [35]Palo Alto Lockbit 2.0 JUN 2022
Elsad, A. et al. (2022, June 9). LockBit 2.0: How This RaaS Operates and How to Protect Against It. Retrieved January 24, 2025.
Open source URL - [36]Kaspersky Sodin July 2019
Mamedov, O, et al. (2019, July 3). Sodin ransomware exploits Windows vulnerability and processor architecture. Retrieved August 4, 2020.
Open source URL - [37]Fortgale StrelaStealer 2023
Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.
Open source URL - [38]IBM StrelaStealer 2024
Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.
Open source URL - [39]Cybereason StealBit Exfiltration Tool
Cybereason Global SOC Team. (n.d.). THREAT ANALYSIS REPORT: Inside the LockBit Arsenal - The StealBit Exfiltration Tool. Retrieved January 29, 2025.
Open source URL - [40]Avertium Storm-0501 Sabbath Ransomware Arcane January 2022
Avertium. (2022, January 11). An In-Depth Look at Ransomware Gang, Sabbath. Retrieved October 19, 2025.
Open source URL - [41]Google Mandiant Storm-0501 Sabbath Ransomware November 2021
Tyler McLellan, Brandan Schondorfer. (2021, November 29). Kitten.gif: Meet the Sabbath Ransomware Affiliate Program, Again. Retrieved October 19, 2025.
Open source URL - [42]Joint Cybersecurity Advisory LockBit JUN 2023
CISA et al. (2023, June 14). UNDERSTANDING RANSOMWARE THREAT ACTORS: LOCKBIT. Retrieved February 5, 2025.
Open source URL - [43]Joint Cybersecurity Advisory LockBit 3.0 MAR 2023
FBI et al. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved February 5, 2025.
Open source URL - [44]Trustwave BlackByte 2021
Rodel Mendrez & Lloyd Macrohon. (2021, October 15). BlackByte Ransomware – Pt. 1 In-depth Analysis. Retrieved December 16, 2024.
Open source URL - [45]CrowdStrike Ryuk January 2019
Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.
Open source URL - [46]CrowdStrike Ryuk January 2019
Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.
Open source URL - [47]Darkside Ransomware Cybereason
Cybereason Nocturnus. (2021, April 1). Cybereason vs. Darkside Ransomware. Retrieved August 18, 2021.
Open source URL - [48]Darkside Ransomware Cybereason
Cybereason Nocturnus. (2021, April 1). Cybereason vs. Darkside Ransomware. Retrieved August 18, 2021.
Open source URL - [49]Malware System Language Check
Pierre-Marc Bureau. (2009, January 15). Malware Trying to Avoid Some Countries. Retrieved August 18, 2021.
Open source URL - [50]Malware System Language Check
Pierre-Marc Bureau. (2009, January 15). Malware Trying to Avoid Some Countries. Retrieved August 18, 2021.
Open source URL - [51]SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL - [52]SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL - [53]Securelist JSWorm
Fedor Sinitsyn. (2021, May 25). Evolution of JSWorm Ransomware. Retrieved August 18, 2021.
Open source URL - [54]Securelist JSWorm
Fedor Sinitsyn. (2021, May 25). Evolution of JSWorm Ransomware. Retrieved August 18, 2021.
Open source URL - [55]mitre-attackT1614.001Open source URL
- [56]mitre-attackT1614.001Open source URL
- [57]mitre-attackT1614.001Open source URL
- [58]ClearSky Lazarus Aug 2020
ClearSky Research Team. (2020, August 13). Operation 'Dream Job' Widespread North Korean Espionage Campaign. Retrieved December 20, 2021.
Open source URL - [59]Kandji Cuckoo April 2024
Kohler, A. and Lopez, C. (2024, April 30). Malware: Cuckoo Behaves Like Cross Between Infostealer and Spyware. Retrieved August 20, 2024.
Open source URL - [60]Kaspersky Ferocious Kitten Jun 2021
GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.
Open source URL - [61]trendmicro xcsset xcode project 2020
Mac Threat Response, Mobile Research Team. (2020, August 13). The XCSSET Malware: Inserts Malicious Code Into Xcode Projects, Performs UXSS Backdoor Planting in Safari, and Leverages Two Zero-day Exploits. Retrieved October 5, 2021.
Open source URL - [62]McAfee Cuba April 2021
Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.
Open source URL - [63]Microsoft NICKEL December 2021
MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022.
Open source URL - [64]NTT Security Flagpro new December 2021
Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.
Open source URL - [65]DFIR_Quantum_Ransomware
DFIR. (2022, April 25). Quantum Ransomware. Retrieved July 26, 2024.
Open source URL - [66]Arxiv Avaddon Feb 2021
Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.
Open source URL - [67]McAfee Maze March 2020
Mundo, A. (2020, March 26). Ransomware Maze. Retrieved May 18, 2020.
Open source URL - [68]ITOCHU LODEINFO JAN 2024
ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.
Open source URL - [69]SCILabs Malteiro 2021
SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.
Open source URL - [70]Segurança Informática URSA Sophisticated Loader 2020
Pedro Tavares (Segurança Informática). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024.
Open source URL - [71]Unit42 Molerat Mar 2020
Falcone, R., et al. (2020, March 3). Molerats Delivers Spark Backdoor to Government and Telecommunications Organizations. Retrieved December 14, 2020.
Open source URL - [72]CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024
CSIRT CTI. (2024, January 23). Stately Taurus Targets Myanmar Amidst Concerns over Military Junta’s Handling of Rebel Attacks. Retrieved August 4, 2025.
Open source URL - [73]Picus BlackByte 2022
Huseyin Can Yuceel. (2022, February 21). TTPs used by BlackByte Ransomware Targeting Critical Infrastructure. Retrieved December 16, 2024.
Open source URL - [74]CrowdStrike Ryuk January 2019
Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.
Open source URL - [75]CrowdStrike Ryuk January 2019
Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.
Open source URL - [76]sentinelone operationDigitalEye Dec 2024
Aleksandar Milenkoski, Luigi Martire. (2024, December 10). Operation Digital Eye | Chinese APT Compromises Critical Digital Infrastructure via Visual Studio Code Tunnels. Retrieved February 27, 2025.
Open source URL - [77]Sophos Gootloader
Szappanos, G. & Brandt, A. (2021, March 1). “Gootloader” expands its payload delivery options. Retrieved September 30, 2022.
Open source URL - [78]Cylance Dust Storm
Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.
Open source URL - [79]Kaspersky LODEINFO Part II OCT 2022
Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part II. Retrieved April 17, 2026.
Open source URL - [80]NCC Group Team9 June 2020
Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.
Open source URL - [81]FireEye FiveHands April 2021
McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.
Open source URL - [82]Microsoft NICKEL December 2021
MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022.
Open source URL - [83]Microsoft NICKEL December 2021
MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022.
Open source URL - [84]Mcafee Clop Aug 2019
Mundo, A. (2019, August 1). Clop Ransomware. Retrieved May 10, 2021.
Open source URL - [85]Splunk RedLine Stealer June 2023
Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.
Open source URL - [86]Talos Zeus Panda Nov 2017
Brumaghin, E., et al. (2017, November 02). Poisoning the Well: Banking Trojan Targets Google Search Results. Retrieved November 5, 2018.
Open source URL - [87]Socket GlassWorm January 2026
Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.
Open source URL - [88]Group IB GrimAgent July 2021
Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.
Open source URL - [89]BleepingComputer Molerats Dec 2020
Ilascu, I. (2020, December 14). Hacking group’s new malware abuses Google and Facebook services. Retrieved December 28, 2020.
Open source URL - [90]FBI Lockbit 2.0 FEB 2022
FBI. (2022, February 4). Indicators of Compromise Associated with LockBit 2.0 Ransomware. Retrieved January 24, 2025.
Open source URL - [91]Palo Alto Lockbit 2.0 JUN 2022
Elsad, A. et al. (2022, June 9). LockBit 2.0: How This RaaS Operates and How to Protect Against It. Retrieved January 24, 2025.
Open source URL - [92]Kaspersky Sodin July 2019
Mamedov, O, et al. (2019, July 3). Sodin ransomware exploits Windows vulnerability and processor architecture. Retrieved August 4, 2020.
Open source URL - [93]Fortgale StrelaStealer 2023
Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.
Open source URL - [94]IBM StrelaStealer 2024
Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.
Open source URL - [95]Cybereason StealBit Exfiltration Tool
Cybereason Global SOC Team. (n.d.). THREAT ANALYSIS REPORT: Inside the LockBit Arsenal - The StealBit Exfiltration Tool. Retrieved January 29, 2025.
Open source URL - [96]Avertium Storm-0501 Sabbath Ransomware Arcane January 2022
Avertium. (2022, January 11). An In-Depth Look at Ransomware Gang, Sabbath. Retrieved October 19, 2025.
Open source URL - [97]Google Mandiant Storm-0501 Sabbath Ransomware November 2021
Tyler McLellan, Brandan Schondorfer. (2021, November 29). Kitten.gif: Meet the Sabbath Ransomware Affiliate Program, Again. Retrieved October 19, 2025.
Open source URL - [98]Joint Cybersecurity Advisory LockBit 3.0 MAR 2023
FBI et al. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved February 5, 2025.
Open source URL - [99]Joint Cybersecurity Advisory LockBit JUN 2023
CISA et al. (2023, June 14). UNDERSTANDING RANSOMWARE THREAT ACTORS: LOCKBIT. Retrieved February 5, 2025.
Open source URL - [100]SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL - [101]SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL - [102]Cylance Dust Storm
Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.
Open source URL - [103]Cylance Dust Storm
Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.
Open source URL - [104]BleepingComputer Molerats Dec 2020
Ilascu, I. (2020, December 14). Hacking group’s new malware abuses Google and Facebook services. Retrieved December 28, 2020.
Open source URL - [105]SCILabs Malteiro 2021
SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.