auren-research/cyber-sec huggingface dataset:
modified: 2025-03-25T18:04:13.368Z
name: HAFNIUM
description: [HAFNIUM](https://attack.mitre.org/groups/G0125) is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. [HAFNIUM](https://attack.mitre.org/groups/G0125) primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. [HAFNIUM](https://attack.mitre.org/groups/G0125) has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.(Citation: Microsoft HAFNIUM March 2020)(Citation: Volexity Exchange Marauder March 2021)(Citation: Microsoft Silk Typhoon MAR 2025)
aliases: HAFNIUM
Operation Exchange Marauder
Silk Typhoon
x_mitre_deprecated: no
x_mitre_version: 3.0
x_mitre_contributors: Daniyal Naeem, BT Security
Matt Brenton, Zurich Insurance Group
Mayuresh Dani, Qualys
Harshal Tupsamudre, Qualys
Vinayak Wadhwa, SAFE Security
type: intrusion-set
spec_version: 2.1
id: intrusion-set--2688b13e-8e71-405a-9c40-0dee94bddf87
created: 2021-03-03T19:40:47.280Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0125
external_id: G0125
source_name: Silk Typhoon
description: (Citation: Microsoft Threat Actor Naming July 2023)(Citation: Microsoft Silk Typhoon MAR 2025)
source_name: Operation Exchange Marauder
description: (Citation: Volexity Exchange Marauder March 2021)
source_name: Volexity Exchange Marauder March 2021
description: Gruzweig, J. et al. (2021, March 2). Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities. Retrieved March 3, 2021.
url: https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
source_name: Microsoft Threat Actor Naming July 2023
description: Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
url: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
source_name: Microsoft Silk Typhoon MAR 2025
description: Microsoft Threat Intelligence . (2025, March 5). Silk Typhoon targeting IT supply chain. Retrieved March 20, 2025.
url: https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/
source_name: Microsoft HAFNIUM March 2020
description: MSTIC. (2021, March 2). HAFNIUM targeting Exchange Servers with 0-day exploits. Retrieved March 3, 2021.
url: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: intrusion-set
spec_version: 2.1
id: intrusion-set--93f52415-0fe4-4d3d-896c-fc9b8e88ab90
created: 2018-01-16T16:13:52.465Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0060
external_id: G0060
source_name: BRONZE BUTLER
description: (Citation: Trend Micro Daserf Nov 2017)(Citation: Trend Micro Tick November 2019)
source_name: REDBALDKNIGHT
description: (Citation: Trend Micro Daserf Nov 2017)(Citation: Trend Micro Tick November 2019)
source_name: Tick
description: (Citation: Trend Micro Daserf Nov 2017)(Citation: Symantec Tick Apr 2016)(Citation: Trend Micro Tick November 2019)
source_name: Trend Micro Daserf Nov 2017
description: Chen, J. and Hsieh, M. (2017, November 7). REDBALDKNIGHT/BRONZE BUTLER’s Daserf Backdoor Now Using Steganography. Retrieved December 27, 2017.
url: http://blog.trendmicro.com/trendlabs-security-intelligence/redbaldknight-bronze-butler-daserf-backdoor-now-using-steganography/
source_name: Secureworks BRONZE BUTLER Oct 2017
description: Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.
url: https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
source_name: Trend Micro Tick November 2019
description: Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.
url: https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf
source_name: Symantec Tick Apr 2016
description: DiMaggio, J. (2016, April 28). Tick cyberespionage group zeros in on Japan. Retrieved July 16, 2018.
url: https://www.symantec.com/connect/blogs/tick-cyberespionage-group-zeros-japan
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:48:57.719Z
name: BRONZE BUTLER
description: [BRONZE BUTLER](https://attack.mitre.org/groups/G0060) is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.(Citation: Trend Micro Daserf Nov 2017)(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)
aliases: BRONZE BUTLER
REDBALDKNIGHT
Tick
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.3
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Trend Micro Incorporated
modified: 2024-01-08T21:56:22.594Z
name: POLONIUM
description: [POLONIUM](https://attack.mitre.org/groups/G1005) is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February 2022. Security researchers assess [POLONIUM](https://attack.mitre.org/groups/G1005) has coordinated their operations with multiple actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS), based on victim overlap as well as common techniques and tooling.(Citation: Microsoft POLONIUM June 2022)
aliases: POLONIUM
Plaid Rain
x_mitre_deprecated: no
x_mitre_version: 2.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--5f3d0238-d058-44a9-8812-3dd1b6741a8c
created: 2022-07-01T19:07:04.253Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1005
external_id: G1005
source_name: Plaid Rain
description: (Citation: Microsoft Threat Actor Naming July 2023)
source_name: Microsoft Threat Actor Naming July 2023
description: Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
url: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
source_name: Microsoft POLONIUM June 2022
description: Microsoft. (2022, June 2). Exposing POLONIUM activity and infrastructure targeting Israeli organizations. Retrieved July 1, 2022.
url: https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: intrusion-set
spec_version: 2.1
id: intrusion-set--9735c036-8ebe-47e9-9c77-b0ae656dab93
created: 2021-09-21T14:52:49.596Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0135
external_id: G0135
source_name: ESET BackdoorDiplomacy Jun 2021
description: Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021
url: https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:48:58.613Z
name: BackdoorDiplomacy
description: [BackdoorDiplomacy](https://attack.mitre.org/groups/G0135) is a cyber espionage threat group that has been active since at least 2017. [BackdoorDiplomacy](https://attack.mitre.org/groups/G0135) has targeted Ministries of Foreign Affairs and telecommunication companies in Africa, Europe, the Middle East, and Asia.(Citation: ESET BackdoorDiplomacy Jun 2021)
aliases: BackdoorDiplomacy
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Zaw Min Htun, @Z3TAE
modified: 2025-03-14T19:17:33.785Z
name: Storm-1811
description: [Storm-1811](https://attack.mitre.org/groups/G1046) is a financially-motivated entity linked to [Black Basta](https://attack.mitre.org/software/S1070) ransomware deployment. [Storm-1811](https://attack.mitre.org/groups/G1046) is notable for unique phishing and social engineering mechanisms for initial access, such as overloading victim email inboxes with non-malicious spam to prompt a fake "help desk" interaction leading to the deployment of adversary tools and capabilities.(Citation: Microsoft Storm-1811 2024)(Citation: rapid7-email-bombing)(Citation: RedCanary Storm-1811 2024)(Citation: RedCanary June Insights 2024)
aliases: Storm-1811
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_contributors: Liran Ravich, CardinalOps
Joe Gumke, U.S. Bank
type: intrusion-set
spec_version: 2.1
id: intrusion-set--319fd652-edde-46b2-9987-3519493989f5
created: 2025-03-14T12:48:44.771Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1046
external_id: G1046
source_name: Microsoft Storm-1811 2024
description: Microsoft Threat Intelligence. (2024, May 15). Threat actors misusing Quick Assist in social engineering attacks leading to ransomware. Retrieved March 14, 2025.
url: https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/
source_name: RedCanary Storm-1811 2024
description: Red Canary Intelligence. (2024, December 2). Storm-1811 exploits RMM tools to drop Black Basta ransomware. Retrieved March 14, 2025.
url: https://redcanary.com/blog/threat-intelligence/storm-1811-black-basta/
source_name: RedCanary June Insights 2024
description: The Red Canary Team. (2024, June 20). Intelligence Insights: June 2024. Retrieved March 14, 2025.
url: https://redcanary.com/blog/threat-intelligence/intelligence-insights-june-2024/
source_name: rapid7-email-bombing
description: Tyler McGraw, Thomas Elkins, and Evan McCann. (2024, May 10). Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators. Retrieved January 31, 2025.
url: https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: intrusion-set
spec_version: 2.1
id: intrusion-set--d8bc9788-4f7d-41a9-9e9d-ee1ea18a8cf7
created: 2022-06-09T19:14:31.327Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1004
external_id: G1004
source_name: Strawberry Tempest
description: (Citation: Microsoft Threat Actor Naming July 2023)
source_name: DEV-0537
description: (Citation: MSTIC DEV-0537 Mar 2022)
source_name: BBC LAPSUS Apr 2022
description: BBC. (2022, April 1). LAPSUS: Two UK Teenagers Charged with Hacking for Gang. Retrieved June 9, 2022.
url: https://www.bbc.com/news/technology-60953527
source_name: Microsoft Threat Actor Naming July 2023
description: Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
url: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
source_name: MSTIC DEV-0537 Mar 2022
description: MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022.
url: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
source_name: UNIT 42 LAPSUS Mar 2022
description: UNIT 42. (2022, March 24). Threat Brief: Lapsus$ Group. Retrieved May 17, 2022.
url: https://unit42.paloaltonetworks.com/lapsus-group/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-21T19:40:47.538Z
name: LAPSUS$
description: [LAPSUS$](https://attack.mitre.org/groups/G1004) is cyber criminal threat group that has been active since at least mid-2021. [LAPSUS$](https://attack.mitre.org/groups/G1004) specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.(Citation: BBC LAPSUS Apr 2022)(Citation: MSTIC DEV-0537 Mar 2022)(Citation: UNIT 42 LAPSUS Mar 2022)
aliases: LAPSUS$
DEV-0537
Strawberry Tempest
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 2.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: David Hughes, BT Security
Matt Brenton, Zurich Insurance Group
Flávio Costa, @Segurança Descomplicada
Caio Silva
x_mitre_domains: enterprise-attack
mobile-attack
modified: 2025-04-02T15:50:35.356Z
name: RedDelta Modified PlugX Infection Chain Operations
description: [RedDelta Modified PlugX Infection Chain Operations](https://attack.mitre.org/campaigns/C0047) was executed by [Mustang Panda](https://attack.mitre.org/groups/G0129) from mid-2023 through the end of 2024 against multiple entities in East and Southeast Asia. [RedDelta Modified PlugX Infection Chain Operations](https://attack.mitre.org/campaigns/C0047) involved phishing to deliver malicious files or links to users prompting follow-on installer downloads to load [PlugX](https://attack.mitre.org/software/S0013) on victim machines in a persistent state.(Citation: Recorded Future RedDelta 2025)
aliases: RedDelta Modified PlugX Infection Chain Operations
first_seen: 2023-07-01T06:00:00.000Z
last_seen: 2024-12-01T07:00:00.000Z
x_mitre_first_seen_citation: (Citation: Recorded Future RedDelta 2025)
x_mitre_last_seen_citation: (Citation: Recorded Future RedDelta 2025)
x_mitre_deprecated: no
x_mitre_version: 1.0
type: campaign
spec_version: 2.1
id: campaign--276671b5-5425-48db-ad65-c8c2564a969b
created: 2025-01-14T22:38:27.986Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0047
external_id: C0047
source_name: Recorded Future RedDelta 2025
description: Insikt Group. (2025, January 9). Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain. Retrieved January 14, 2025.
url: https://go.recordedfuture.com/hubfs/reports/cta-cn-2025-0109.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: enterprise-attack
modified: 2024-09-12T19:24:40.416Z
name: Chimera
description: [Chimera](https://attack.mitre.org/groups/G0114) is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry.(Citation: Cycraft Chimera April 2020)(Citation: NCC Group Chimera January 2021)
aliases: Chimera
x_mitre_deprecated: no
x_mitre_version: 2.2
type: intrusion-set
spec_version: 2.1
id: intrusion-set--8c1f0187-0826-4320-bddc-5f326cfcfe2c
created: 2020-08-24T17:01:55.842Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0114
external_id: G0114
source_name: Chimera
description: (Citation: NCC Group Chimera January 2021) 
source_name: Cycraft Chimera April 2020
description: Cycraft. (2020, April 15). APT Group Chimera - APT Operation Skeleton key Targets Taiwan Semiconductor Vendors. Retrieved August 24, 2020..
url: https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf
source_name: NCC Group Chimera January 2021
description: Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.
url: https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-04-10T22:38:45.199Z
name: TA2541
description: [TA2541](https://attack.mitre.org/groups/G1018) is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. [TA2541](https://attack.mitre.org/groups/G1018) campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.(Citation: Proofpoint TA2541 February 2022)(Citation: Cisco Operation Layover September 2021)
aliases: TA2541
x_mitre_deprecated: no
x_mitre_version: 1.1
x_mitre_contributors: Pooja Natarajan, NEC Corporation India
Aaron Jornet
type: intrusion-set
spec_version: 2.1
id: intrusion-set--467271fd-47c0-4e90-a3f9-d84f5cf790d0
created: 2023-09-12T17:00:22.615Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1018
external_id: G1018
source_name: Proofpoint TA2541 February 2022
description: Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.
url: https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight
source_name: Cisco Operation Layover September 2021
description: Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.
url: https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-02-14T20:35:53.080Z
name: ToddyCat
description: [ToddyCat](https://attack.mitre.org/groups/G1022) is a sophisticated threat group that has been active since at least 2020 using custom loaders and malware in multi-stage infection chains against government and military targets across Europe and Asia.(Citation: Kaspersky ToddyCat June 2022)(Citation: Kaspersky ToddyCat Check Logs October 2023)
aliases: ToddyCat
x_mitre_deprecated: no
x_mitre_version: 1.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--b516b235-fc7d-4635-aca5-3d33312339c3
created: 2024-01-03T21:34:10.988Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1022
external_id: G1022
source_name: Kaspersky ToddyCat June 2022
description: Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.
url: https://securelist.com/toddycat/106799/
source_name: Kaspersky ToddyCat Check Logs October 2023
description: Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.
url: https://securelist.com/toddycat-keep-calm-and-check-logs/110696/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-04-11T02:52:27.131Z
name: BITTER
description: [BITTER](https://attack.mitre.org/groups/G1002) is a suspected South Asian cyber espionage threat group that has been active since at least 2013. [BITTER](https://attack.mitre.org/groups/G1002) has targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Citation: Forcepoint BITTER Pakistan Oct 2016)
aliases: BITTER
T-APT-17
x_mitre_deprecated: no
x_mitre_version: 1.1
type: intrusion-set
spec_version: 2.1
id: intrusion-set--7f848c02-4d1e-4808-a4ae-4670681370a9
created: 2022-06-01T20:26:53.880Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1002
external_id: G1002
source_name: T-APT-17
description: (Citation: Cisco Talos Bitter Bangladesh May 2022)
source_name: Forcepoint BITTER Pakistan Oct 2016
description: Dela Paz, R. (2016, October 21). BITTER: a targeted attack against Pakistan. Retrieved June 1, 2022.
url: https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan
source_name: Cisco Talos Bitter Bangladesh May 2022
description: Raghuprasad, C . (2022, May 11). Bitter APT adds Bangladesh to their targets. Retrieved June 1, 2022.
url: https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
mobile-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: intrusion-set
spec_version: 2.1
id: intrusion-set--c416b28c-103b-4df1-909e-78089a7e0e5f
created: 2017-05-31T21:32:10.206Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0048
external_id: G0048
source_name: RTM
description: (Citation: ESET RTM Feb 2017)
source_name: ESET RTM Feb 2017
description: Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
url: https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:01.288Z
name: RTM
description: [RTM](https://attack.mitre.org/groups/G0048) is a cybercriminal group that has been active since at least 2015 and is primarily interested in users of remote banking systems in Russia and neighboring countries. The group uses a Trojan by the same name ([RTM](https://attack.mitre.org/software/S0148)). (Citation: ESET RTM Feb 2017)
aliases: RTM
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Oleg Skulkin, Group-IB