auren-research/cyber-sec huggingface dataset:
type: malware
spec_version: 2.1
id: malware--15c7bcdb-23e1-4ce3-81a7-b109b4d2a4f1
created: 2025-06-16T20:20:54.148Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1224
external_id: S1224
source_name: Mandiant Fortinet Zero Day
description: Marvi, A. et al.. (2023, March 16). Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation. Retrieved March 22, 2023.
url: https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-06-16T20:21:39.051Z
name: CASTLETAP
description: [CASTLETAP](https://attack.mitre.org/software/S1224) is an ICMP port knocking backdoor that has been installed on compromised FortiGate firewalls by [UNC3886](https://attack.mitre.org/groups/G1048).(Citation: Mandiant Fortinet Zero Day)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Network Devices
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: CASTLETAP
modified: 2024-04-10T22:32:30.915Z
name: ThreatNeedle
description: [ThreatNeedle](https://attack.mitre.org/software/S0665) is a backdoor that has been used by [Lazarus Group](https://attack.mitre.org/groups/G0032) since at least 2019 to target cryptocurrency, defense, and mobile gaming organizations. It is considered to be an advanced cluster of [Lazarus Group](https://attack.mitre.org/groups/G0032)'s Manuscrypt (a.k.a. NukeSped) malware family.(Citation: Kaspersky ThreatNeedle Feb 2021)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_aliases: ThreatNeedle
type: malware
spec_version: 2.1
id: malware--16040b1c-ed28-4850-9d8f-bb8b81c42092
created: 2021-11-30T15:46:36.159Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0665
external_id: S0665
source_name: Kaspersky ThreatNeedle Feb 2021
description: Vyacheslav Kopeytsev and Seongsu Park. (2021, February 25). Lazarus targets defense industry with ThreatNeedle. Retrieved October 27, 2021.
url: https://securelist.com/lazarus-threatneedle/100803/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2025-03-27T14:29:41.961Z
name: RansomHub
description: [RansomHub](https://attack.mitre.org/software/S1212) is a ransomware-as-a-service (RaaS) offering with Windows, ESXi, Linux, and FreeBSD versions that has been in use since at least 2024 to target organizations in multiple sectors globally. [RansomHub](https://attack.mitre.org/software/S1212) operators may have purchased and rebranded resources from Knight (formerly Cyclops) Ransomware which shares infrastructure, feature, and code overlaps with [RansomHub](https://attack.mitre.org/software/S1212).(Citation: CISA RansomHub AUG 2024)(Citation: Group-IB RansomHub FEB 2025)
is_family: yes
x_mitre_platforms: Linux
Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_aliases: RansomHub
type: malware
spec_version: 2.1
id: malware--16662bee-9d15-4564-a128-1fce214866e9
created: 2025-03-17T19:03:28.707Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1212
external_id: S1212
source_name: Group-IB RansomHub FEB 2025
description: Alfano, V. et al. (2025, February 12). RansomHub Never Sleeps Episode 1: The evolution of modern ransomware. Retrieved March 17, 2025.
url: https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/
source_name: CISA RansomHub AUG 2024
description: CISA et al. (2024, August 29). #StopRansomware: RansomHub Ransomware. Retrieved March 17, 2025.
url: https://www.cisa.gov/sites/default/files/2024-09/aa24-242a-stopransomware-ransomhub-ransomware_1.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--166c0eca-02fd-424a-92c0-6b5106994d31
created: 2017-05-31T21:32:56.394Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0086
external_id: S0086
source_name: Cylance Dust Storm
description: Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.
url: https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:56.750Z
name: ZLib
description: [ZLib](https://attack.mitre.org/software/S0086) is a full-featured backdoor that was used as a second-stage implant during [Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) since at least 2014. [ZLib](https://attack.mitre.org/software/S0086) is malware and should not be confused with the legitimate compression library from which its name is derived.(Citation: Cylance Dust Storm)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: ZLib
modified: 2024-09-12T19:32:28.614Z
name: RedLeaves
description: [RedLeaves](https://attack.mitre.org/software/S0153) is a malware family used by [menuPass](https://attack.mitre.org/groups/G0045). The code overlaps with [PlugX](https://attack.mitre.org/software/S0013) and may be based upon the open source tool Trochilus. (Citation: PWC Cloud Hopper Technical Annex April 2017) (Citation: FireEye APT10 April 2017)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_contributors: Edward Millington
x_mitre_aliases: RedLeaves
BUGJUICE
type: malware
spec_version: 2.1
id: malware--17b40f60-729f-4fe8-8aea-cc9ee44a95d5
created: 2017-12-14T16:46:06.044Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0153
external_id: S0153
source_name: RedLeaves
description: (Citation: PWC Cloud Hopper Technical Annex April 2017)
source_name: BUGJUICE
description: Based on similarities in reported malware behavior and open source reporting, it is assessed that the malware named BUGJUICE by FireEye is likely the same as the malware RedLeaves. (Citation: FireEye APT10 April 2017) (Citation: Twitter Nick Carr APT10)
source_name: Twitter Nick Carr APT10
description: Carr, N.. (2017, April 6). Retrieved September 12, 2024.
url: https://x.com/ItsReallyNick/status/850105140589633536
source_name: FireEye APT10 April 2017
description: FireEye iSIGHT Intelligence. (2017, April 6). APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat. Retrieved June 29, 2017.
url: https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html
source_name: PWC Cloud Hopper Technical Annex April 2017
description: PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.
url: https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-09-12T15:19:00.433Z
name: Miner-C
description: [Miner-C](https://attack.mitre.org/software/S0133) is malware that mines victims for the Monero cryptocurrency. It has targeted FTP servers and Network Attached Storage (NAS) devices to spread. (Citation: Softpedia MinerC)
is_family: yes
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_aliases: Miner-C
type: malware
spec_version: 2.1
id: malware--17dec760-9c8f-4f1b-9b4b-0ac47a453234
created: 2017-05-31T21:33:16.315Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0133
external_id: S0133
source_name: Softpedia MinerC
description: Cimpanu, C.. (2016, September 9). Cryptocurrency Mining Malware Discovered Targeting Seagate NAS Hard Drives. Retrieved September 12, 2024.
url: https://news.softpedia.com/news/cryptocurrency-mining-malware-discovered-targeting-seagate-nas-hard-drives-508119.shtml
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--17e919aa-4a49-445c-b103-dbb8df9e7351
created: 2017-05-31T21:33:24.739Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0145
external_id: S0145
source_name: POWERSOURCE
description: (Citation: FireEye FIN7 March 2017)
source_name: DNSMessenger
description: Based on similar descriptions of functionality, it appears S0145, as named by FireEye, is the same as the first stages of a backdoor named DNSMessenger by Cisco's Talos Intelligence Group. However, FireEye appears to break DNSMessenger into two parts: S0145 and S0146. (Citation: Cisco DNSMessenger March 2017) (Citation: FireEye FIN7 March 2017)
source_name: Cisco DNSMessenger March 2017
description: Brumaghin, E. and Grady, C.. (2017, March 2). Covert Channels and Poor Decisions: The Tale of DNSMessenger. Retrieved March 8, 2017.
url: http://blog.talosintelligence.com/2017/03/dnsmessenger.html
source_name: FireEye FIN7 March 2017
description: Miller, S., et al. (2017, March 7). FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings. Retrieved March 8, 2017.
url: https://web.archive.org/web/20180808125108/https:/www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:56.902Z
name: POWERSOURCE
description: [POWERSOURCE](https://attack.mitre.org/software/S0145) is a PowerShell backdoor that is a heavily obfuscated and modified version of the publicly available tool DNS_TXT_Pwnage. It was observed in February 2017 in spearphishing campaigns against personnel involved with United States Securities and Exchange Commission (SEC) filings at various organizations. The malware was delivered when macros were enabled by the victim and a VBS script was dropped. (Citation: FireEye FIN7 March 2017) (Citation: Cisco DNSMessenger March 2017)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: POWERSOURCE
DNSMessenger
type: malware
spec_version: 2.1
id: malware--19256855-65e9-48f2-8b74-9f3d0a994428
created: 2024-03-13T18:41:57.589Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1121
external_id: S1121
source_name: Mandiant Cutting Edge Part 3 February 2024
description: Lin, M. et al. (2024, February 27). Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts. Retrieved March 1, 2024.
url: https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-15T19:46:33.606Z
name: LITTLELAMB.WOOLTEA
description: [LITTLELAMB.WOOLTEA](https://attack.mitre.org/software/S1121) is a backdoor that was used by UNC5325 during [Cutting Edge](https://attack.mitre.org/campaigns/C0029) to deploy malware on targeted Ivanti Connect Secure VPNs and to establish persistence across system upgrades and patches.(Citation: Mandiant Cutting Edge Part 3 February 2024)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Network Devices
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: LITTLELAMB.WOOLTEA
type: malware
spec_version: 2.1
id: malware--196f1f32-e0c2-4d46-99cd-234d4b6befe1
created: 2018-01-16T16:13:52.465Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0171
external_id: S0171
source_name: Felismus
description: (Citation: Symantec Sowbug Nov 2017) (Citation: Forcepoint Felismus Mar 2017)
source_name: Symantec Sowbug Nov 2017
description: Symantec Security Response. (2017, November 7). Sowbug: Cyber espionage group targets South American and Southeast Asian governments. Retrieved November 16, 2017.
url: https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments
source_name: Forcepoint Felismus Mar 2017
description: Somerville, L. and Toro, A. (2017, March 30). Playing Cat & Mouse: Introducing the Felismus Malware. Retrieved November 16, 2017.
url: https://blogs.forcepoint.com/security-labs/playing-cat-mouse-introducing-felismus-malware
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:42:46.344Z
name: Felismus
description: [Felismus](https://attack.mitre.org/software/S0171) is a modular backdoor that has been used by [Sowbug](https://attack.mitre.org/groups/G0054). (Citation: Symantec Sowbug Nov 2017) (Citation: Forcepoint Felismus Mar 2017)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Felismus
modified: 2024-04-10T20:31:00.234Z
name: Zeus Panda
description: [Zeus Panda](https://attack.mitre.org/software/S0330) is a Trojan designed to steal banking information and other sensitive credentials for exfiltration. [Zeus Panda](https://attack.mitre.org/software/S0330)’s original source code was leaked in 2011, allowing threat actors to use its source code as a basis for new malware variants. It is mainly used to target Windows operating systems ranging from Windows XP through Windows 10.(Citation: Talos Zeus Panda Nov 2017)(Citation: GDATA Zeus Panda June 2017)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.4
x_mitre_aliases: Zeus Panda
type: malware
spec_version: 2.1
id: malware--198db886-47af-4f4c-bff5-11b891f85946
created: 2019-01-29T17:59:43.600Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0330
external_id: S0330
source_name: Zeus Panda
description: (Citation: Talos Zeus Panda Nov 2017)(Citation: GDATA Zeus Panda June 2017)
source_name: Talos Zeus Panda Nov 2017
description: Brumaghin, E., et al. (2017, November 02). Poisoning the Well: Banking Trojan Targets Google Search Results. Retrieved November 5, 2018.
url: https://blog.talosintelligence.com/2017/11/zeus-panda-campaign.html#More
source_name: GDATA Zeus Panda June 2017
description: Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018.
url: https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--199463de-d9be-46d6-bb41-07234c1dd5a6
created: 2017-05-31T21:32:36.177Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0049
external_id: S0049
source_name: F-Secure The Dukes
description: F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.
url: https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:42:46.881Z
name: GeminiDuke
description: [GeminiDuke](https://attack.mitre.org/software/S0049) is malware that was used by [APT29](https://attack.mitre.org/groups/G0016) from 2009 to 2012. (Citation: F-Secure The Dukes)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: GeminiDuke
type: malware
spec_version: 2.1
id: malware--1996aed9-6234-4c1d-a145-e8a4913679dd
created: 2025-08-05T18:12:15.228Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1229
external_id: S1229
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T03:07:43.276Z
name: Havoc
description: [Havoc](https://attack.mitre.org/software/S1229) is an open-source post-exploitation command and control (C2) framework first released on GitHub in October 2022 by C5pider (Paul Ungur), who continues to maintain and develop it with community contributors. [Havoc](https://attack.mitre.org/software/S1229) provides a wide range of offensive security capabilities and has been adopted by multiple threat actors to establish and maintain control over compromised systems.
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
macOS
Linux
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_contributors: Enis Aksu
x_mitre_aliases: Havoc
modified: 2024-04-11T02:46:42.264Z
name: CARROTBAT
description: [CARROTBAT](https://attack.mitre.org/software/S0462) is a customized dropper that has been in use since at least 2017. [CARROTBAT](https://attack.mitre.org/software/S0462) has been used to install [SYSCON](https://attack.mitre.org/software/S0464) and has infrastructure overlap with [KONNI](https://attack.mitre.org/software/S0356).(Citation: Unit 42 CARROTBAT November 2018)(Citation: Unit 42 CARROTBAT January 2020)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_aliases: CARROTBAT
type: malware
spec_version: 2.1
id: malware--1b9f0800-035e-4ed1-9648-b18294cc5bc8
created: 2020-06-02T14:11:40.581Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0462
external_id: S0462
source_name: Unit 42 CARROTBAT November 2018
description: Grunzweig, J. and Wilhoit, K. (2018, November 29). The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia. Retrieved June 2, 2020.
url: https://unit42.paloaltonetworks.com/unit42-the-fractured-block-campaign-carrotbat-malware-used-to-deliver-malware-targeting-southeast-asia/
source_name: Unit 42 CARROTBAT January 2020
description: McCabe, A. (2020, January 23). The Fractured Statue Campaign: U.S. Government Agency Targeted in Spear-Phishing Attacks. Retrieved June 2, 2020.
url: https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-11-17T12:44:07.639Z
name: Matryoshka
description: [Matryoshka](https://attack.mitre.org/software/S0167) is a malware framework used by [CopyKittens](https://attack.mitre.org/groups/G0052) that consists of a dropper, loader, and RAT. It has multiple versions; v1 was seen in the wild from July 2016 until January 2017. v2 has fewer commands and other minor differences. (Citation: ClearSky Wilted Tulip July 2017) (Citation: CopyKittens Nov 2015)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_aliases: Matryoshka
type: malware
spec_version: 2.1
id: malware--1cc934e4-b01d-4543-a011-b988dfc1a458
created: 2018-01-16T16:13:52.465Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0167
external_id: S0167
source_name: Matryoshka
description: (Citation: ClearSky Wilted Tulip July 2017)
source_name: ClearSky Wilted Tulip July 2017
description: ClearSky Cyber Security and Trend Micro. (2017, July). Operation Wilted Tulip: Exposing a cyber espionage apparatus. Retrieved August 21, 2017.
url: http://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf
source_name: CopyKittens Nov 2015
description: Minerva Labs LTD and ClearSky Cyber Security. (2015, November 23). CopyKittens Attack Group. Retrieved November 17, 2024.
url: https://cdn2.hubspot.net/hubfs/1903456/Whitepapers/CopyKittens.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--1cdbbcab-903a-414d-8eb0-439a97343737
created: 2020-09-08T14:55:46.094Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0503
external_id: S0503
source_name: Trinity
description: (Citation: SentinelOne FrameworkPOS September 2019)
source_name: SentinelOne FrameworkPOS September 2019
description: Kremez, V. (2019, September 19). FIN6 “FrameworkPOS”: Point-of-Sale Malware Analysis & Internals. Retrieved September 8, 2020.
url: https://labs.sentinelone.com/fin6-frameworkpos-point-of-sale-malware-analysis-internals-2/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:42:47.607Z
name: FrameworkPOS
description: [FrameworkPOS](https://attack.mitre.org/software/S0503) is a point of sale (POS) malware used by [FIN6](https://attack.mitre.org/groups/G0037) to steal payment card data from sytems that run physical POS devices.(Citation: SentinelOne FrameworkPOS September 2019)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_aliases: FrameworkPOS
Trinity