auren-research/cyber-sec huggingface dataset:
type: malware
spec_version: 2.1
id: malware--edf5aee2-9b1c-4252-8e64-25b12f14c8b3
created: 2020-06-02T18:46:58.489Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0464
external_id: S0464
source_name: Unit 42 CARROTBAT November 2018
description: Grunzweig, J. and Wilhoit, K. (2018, November 29). The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia. Retrieved June 2, 2020.
url: https://unit42.paloaltonetworks.com/unit42-the-fractured-block-campaign-carrotbat-malware-used-to-deliver-malware-targeting-southeast-asia/
source_name: Unit 42 CARROTBAT January 2020
description: McCabe, A. (2020, January 23). The Fractured Statue Campaign: U.S. Government Agency Targeted in Spear-Phishing Attacks. Retrieved June 2, 2020.
url: https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:41.948Z
name: SYSCON
description: [SYSCON](https://attack.mitre.org/software/S0464) is a backdoor that has been in use since at least 2017 and has been associated with campaigns involving North Korean themes. [SYSCON](https://attack.mitre.org/software/S0464) has been delivered by the [CARROTBALL](https://attack.mitre.org/software/S0465) and [CARROTBAT](https://attack.mitre.org/software/S0462) droppers.(Citation: Unit 42 CARROTBAT November 2018)(Citation: Unit 42 CARROTBAT January 2020)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: SYSCON
type: malware
spec_version: 2.1
id: malware--eedc01d5-95e6-4d21-bcd4-1121b1df4586
created: 2020-07-22T19:00:00.779Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0492
external_id: S0492
source_name: Unit42 CookieMiner Jan 2019
description: Chen, y., et al. (2019, January 31). Mac Malware Steals Cryptocurrency Exchanges’ Cookies. Retrieved July 22, 2020.
url: https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:42.106Z
name: CookieMiner
description: [CookieMiner](https://attack.mitre.org/software/S0492) is mac-based malware that targets information associated with cryptocurrency exchanges as well as enabling cryptocurrency mining on the victim system itself. It was first discovered in the wild in 2019.(Citation: Unit42 CookieMiner Jan 2019)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: macOS
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: CookieMiner
type: malware
spec_version: 2.1
id: malware--ef2247bf-8062-404b-894f-d65d00564817
created: 2020-08-12T19:32:56.301Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0499
external_id: S0499
source_name: Chanitor
description: (Citation: FireEye Hancitor)
source_name: Threatpost Hancitor
description: Tom Spring. (2017, January 11). Spammers Revive Hancitor Downloader Campaigns. Retrieved August 13, 2020.
url: https://threatpost.com/spammers-revive-hancitor-downloader-campaigns/123011/
source_name: FireEye Hancitor
description: Anubhav, A., Jallepalli, D. (2016, September 23). Hancitor (AKA Chanitor) observed using multiple attack approaches. Retrieved August 13, 2020.
url: https://www.fireeye.com/blog/threat-research/2016/09/hancitor_aka_chanit.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:45:01.455Z
name: Hancitor
description: [Hancitor](https://attack.mitre.org/software/S0499) is a downloader that has been used by [Pony](https://attack.mitre.org/software/S0453) and other information stealing malware.(Citation: Threatpost Hancitor)(Citation: FireEye Hancitor)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Hancitor
Chanitor
modified: 2024-04-11T02:28:01.735Z
name: Gelsemium
description: [Gelsemium](https://attack.mitre.org/software/S0666) is a modular malware comprised of a dropper (Gelsemine), a loader (Gelsenicine), and main (Gelsevirine) plug-ins written using the Microsoft Foundation Class (MFC) framework. [Gelsemium](https://attack.mitre.org/software/S0666) has been used by the Gelsemium group since at least 2014.(Citation: ESET Gelsemium June 2021)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_aliases: Gelsemium
Gelsevirine
Gelsenicine
Gelsemine
type: malware
spec_version: 2.1
id: malware--efa7c4d6-8e30-41d9-a8fd-26dc337f4a1b
created: 2021-11-30T19:02:16.138Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0666
external_id: S0666
source_name: Gelsevirine
description: (Citation: ESET Gelsemium June 2021)
source_name: Gelsenicine
description: (Citation: ESET Gelsemium June 2021)
source_name: Gelsemine
description: (Citation: ESET Gelsemium June 2021)
source_name: ESET Gelsemium June 2021
description: Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.
url: https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2023-10-03T19:38:43.114Z
name: jRAT
description: [jRAT](https://attack.mitre.org/software/S0283) is a cross-platform, Java-based backdoor originally available for purchase in 2012. Variants of [jRAT](https://attack.mitre.org/software/S0283) have been distributed via a software-as-a-service platform, similar to an online subscription model.(Citation: Kaspersky Adwind Feb 2016) (Citation: jRAT Symantec Aug 2018)
is_family: yes
x_mitre_platforms: Linux
Windows
macOS
Android
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.2
x_mitre_aliases: jRAT
JSocket
AlienSpy
Frutas
Sockrat
Unrecom
jFrutas
Adwind
jBiFrost
Trojan.Maljava
type: malware
spec_version: 2.1
id: malware--efece7e8-e40b-49c2-9f84-c55c5c93d05c
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0283
external_id: S0283
source_name: jRAT
description: (Citation: jRAT Symantec Aug 2018)
source_name: Trojan.Maljava
description: (Citation: jRAT Symantec Aug 2018)
source_name: JSocket
description: (Citation: Kaspersky Adwind Feb 2016)
source_name: AlienSpy
description: (Citation: Kaspersky Adwind Feb 2016)
source_name: Frutas
description: (Citation: Kaspersky Adwind Feb 2016)
source_name: Sockrat
description: (Citation: Kaspersky Adwind Feb 2016)
source_name: Unrecom
description: (Citation: Kaspersky Adwind Feb 2016)
source_name: jFrutas
description: (Citation: Kaspersky Adwind Feb 2016)
source_name: Adwind
description: (Citation: Kaspersky Adwind Feb 2016)
source_name: jBiFrost
description: (Citation: NCSC Joint Report Public Tools)
source_name: Kaspersky Adwind Feb 2016
description: Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.
url: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07195002/KL_AdwindPublicReport_2016.pdf
source_name: jRAT Symantec Aug 2018
description: Sharma, R. (2018, August 15). Revamped jRAT Uses New Anti-Parsing Techniques. Retrieved September 21, 2018.
url: https://www.symantec.com/blogs/threat-intelligence/jrat-new-anti-parsing-techniques
source_name: NCSC Joint Report Public Tools
description: The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.
url: https://www.ncsc.gov.uk/report/joint-report-on-publicly-available-hacking-tools
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-04-11T02:22:38.177Z
name: Helminth
description: [Helminth](https://attack.mitre.org/software/S0170) is a backdoor that has at least two variants - one written in VBScript and PowerShell that is delivered via a macros in Excel spreadsheets, and one that is a standalone Windows executable. (Citation: Palo Alto OilRig May 2016)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_contributors: Robert Falcone
x_mitre_aliases: Helminth
type: malware
spec_version: 2.1
id: malware--eff1a885-6f90-42a1-901f-eef6e7a1905e
created: 2018-01-16T16:13:52.465Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0170
external_id: S0170
source_name: Helminth
description: (Citation: Palo Alto OilRig May 2016)
source_name: Palo Alto OilRig May 2016
description: Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
url: http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--f01e2711-4b48-4192-a2e8-5f56c945ca19
created: 2019-05-30T19:47:37.192Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0384
external_id: S0384
source_name: Bugat v5
description: (Citation: Dell Dridex Oct 2015)
source_name: Dridex
description: (Citation: Dell Dridex Oct 2015)(Citation: Kaspersky Dridex May 2017)(Citation: Checkpoint Dridex Jan 2021)
source_name: Checkpoint Dridex Jan 2021
description: Check Point Research. (2021, January 4). Stopping Serial Killer: Catching the Next Strike. Retrieved September 7, 2021.
url: https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/
source_name: Dell Dridex Oct 2015
description: Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, October 13). Dridex (Bugat v5) Botnet Takeover Operation. Retrieved May 31, 2019.
url: https://www.secureworks.com/research/dridex-bugat-v5-botnet-takeover-operation
source_name: Kaspersky Dridex May 2017
description: Slepogin, N. (2017, May 25). Dridex: A History of Evolution. Retrieved May 31, 2019.
url: https://securelist.com/dridex-a-history-of-evolution/78531/
source_name: Treasury EvilCorp Dec 2019
description: U.S. Department of Treasury. (2019, December 5). Treasury Sanctions Evil Corp, the Russia-Based Cybercriminal Group Behind Dridex Malware. Retrieved September 15, 2021.
url: https://home.treasury.gov/news/press-releases/sm845
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:42.420Z
name: Dridex
description: [Dridex](https://attack.mitre.org/software/S0384) is a prolific banking Trojan that first appeared in 2014. By December 2019, the US Treasury estimated [Dridex](https://attack.mitre.org/software/S0384) had infected computers in hundreds of banks and financial institutions in over 40 countries, leading to more than $100 million in theft. [Dridex](https://attack.mitre.org/software/S0384) was created from the source code of the Bugat banking Trojan (also known as Cridex).(Citation: Dell Dridex Oct 2015)(Citation: Kaspersky Dridex May 2017)(Citation: Treasury EvilCorp Dec 2019)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Daniyal Naeem, BT Security
Jennifer Kim Roman, CrowdStrike
x_mitre_aliases: Dridex
Bugat v5
type: malware
spec_version: 2.1
id: malware--f0fc920e-57a3-4af5-89be-9ea594c8b1ea
created: 2020-06-10T18:00:28.497Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0470
external_id: S0470
source_name: Trend Micro Tick November 2019
description: Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.
url: https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:45:02.531Z
name: BBK
description: [BBK](https://attack.mitre.org/software/S0470) is a downloader that has been used by [BRONZE BUTLER](https://attack.mitre.org/groups/G0060) since at least 2019.(Citation: Trend Micro Tick November 2019)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: BBK
type: malware
spec_version: 2.1
id: malware--f108215f-3487-489d-be8b-80e346d32518
created: 2017-12-14T16:46:06.044Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0162
external_id: S0162
source_name: XAgentOSX 2017
description: Robert Falcone. (2017, February 14). XAgentOSX: Sofacy's Xagent macOS Tool. Retrieved July 12, 2017.
url: https://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/
source_name: Sofacy Komplex Trojan
description: Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
url: https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:45:02.893Z
name: Komplex
description: [Komplex](https://attack.mitre.org/software/S0162) is a backdoor that has been used by [APT28](https://attack.mitre.org/groups/G0007) on OS X and appears to be developed in a similar manner to [XAgentOSX](https://attack.mitre.org/software/S0161) (Citation: XAgentOSX 2017) (Citation: Sofacy Komplex Trojan).
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: macOS
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Komplex
type: malware
spec_version: 2.1
id: malware--f1314e75-ada8-49f4-b281-b1fb8b48f2a7
created: 2019-08-29T18:52:20.879Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0402
external_id: S0402
source_name: OSX/Shlayer
description: (Citation: Carbon Black Shlayer Feb 2019)(Citation: Intego Shlayer Feb 2018)
source_name: Crossrider
description: (Citation: Intego Shlayer Apr 2018)(Citation: Malwarebytes Crossrider Apr 2018)
source_name: Zshlayer
description: (Citation: sentinelone shlayer to zshlayer)
source_name: Carbon Black Shlayer Feb 2019
description: Carbon Black Threat Analysis Unit. (2019, February 12). New macOS Malware Variant of Shlayer (OSX) Discovered. Retrieved August 8, 2019.
url: https://blogs.vmware.com/security/2020/02/vmware-carbon-black-tau-threat-analysis-shlayer-macos.html
source_name: Intego Shlayer Feb 2018
description: Long, Joshua. (2018, February 21). OSX/Shlayer: New Mac malware comes out of its shell. Retrieved August 28, 2019.
url: https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/
source_name: sentinelone shlayer to zshlayer
description: Phil Stokes. (2020, September 8). Coming Out of Your Shell: From Shlayer to ZShlayer. Retrieved September 13, 2021.
url: https://www.sentinelone.com/blog/coming-out-of-your-shell-from-shlayer-to-zshlayer/
source_name: Malwarebytes Crossrider Apr 2018
description: Reed, Thomas. (2018, April 24). New Crossrider variant installs configuration profiles on Macs. Retrieved September 6, 2019.
url: https://blog.malwarebytes.com/threat-analysis/2018/04/new-crossrider-variant-installs-configuration-profiles-on-macs/
source_name: Intego Shlayer Apr 2018
description: Vrijenhoek, Jay. (2018, April 24). New OSX/Shlayer Malware Variant Found Using a Dirty New Trick. Retrieved September 6, 2019.
url: https://www.intego.com/mac-security-blog/new-osxshlayer-malware-variant-found-using-a-dirty-new-trick/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:42.935Z
name: OSX/Shlayer
description: [OSX/Shlayer](https://attack.mitre.org/software/S0402) is a Trojan designed to install adware on macOS that was first discovered in 2018.(Citation: Carbon Black Shlayer Feb 2019)(Citation: Intego Shlayer Feb 2018)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: macOS
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.4
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: OSX/Shlayer
Zshlayer
Crossrider
type: malware
spec_version: 2.1
id: malware--f25aab1a-0cef-4910-a85d-bb38b32ea41a
created: 2019-01-30T20:01:44.815Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0354
external_id: S0354
source_name: Denis
description: (Citation: Cybereason Oceanlotus May 2017)
source_name: Cybereason Oceanlotus May 2017
description: Dahan, A. (2017, May 24). OPERATION COBALT KITTY: A LARGE-SCALE APT IN ASIA CARRIED OUT BY THE OCEANLOTUS GROUP. Retrieved November 5, 2018.
url: https://www.cybereason.com/blog/operation-cobalt-kitty-apt
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:43.085Z
name: Denis
description: [Denis](https://attack.mitre.org/software/S0354) is a Windows backdoor and Trojan used by [APT32](https://attack.mitre.org/groups/G0050). [Denis](https://attack.mitre.org/software/S0354) shares several similarities to the [SOUNDBITE](https://attack.mitre.org/software/S0157) backdoor and has been used in conjunction with the [Goopy](https://attack.mitre.org/software/S0477) backdoor.(Citation: Cybereason Oceanlotus May 2017)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Denis
modified: 2024-10-28T19:03:40.175Z
name: INC Ransomware
description: [INC Ransomware](https://attack.mitre.org/software/S1139) is a ransomware strain that has been used by the [INC Ransom](https://attack.mitre.org/groups/G1032) group since at least 2023 against multiple industry sectors worldwide. [INC Ransomware](https://attack.mitre.org/software/S1139) can employ partial encryption combined with multi-threading to speed encryption.(Citation: SentinelOne INC Ransomware)(Citation: Huntress INC Ransom Group August 2023)(Citation: Secureworks GOLD IONIC April 2024)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_contributors: Matt Anderson, @‌nosecurething, Huntress
x_mitre_aliases: INC Ransomware
type: malware
spec_version: 2.1
id: malware--f25d4207-25b2-4bb0-a17a-403943c670ad
created: 2024-06-06T18:28:58.878Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1139
external_id: S1139
source_name: Secureworks GOLD IONIC April 2024
description: Counter Threat Unit Research Team. (2024, April 15). GOLD IONIC DEPLOYS INC RANSOMWARE. Retrieved June 5, 2024.
url: https://www.secureworks.com/blog/gold-ionic-deploys-inc-ransomware
source_name: SentinelOne INC Ransomware
description: SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024.
url: https://www.sentinelone.com/anthology/inc-ransom/
source_name: Huntress INC Ransom Group August 2023
description: Team Huntress. (2023, August 11). Investigating New INC Ransom Group Activity. Retrieved June 5, 2024.
url: https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-08-26T18:34:46.859Z
name: DEADWOOD
description: [DEADWOOD](https://attack.mitre.org/software/S1134) is wiper malware written in C++ using Boost libraries. [DEADWOOD](https://attack.mitre.org/software/S1134) was first observed in an unattributed wiping event in Saudi Arabia in 2019, and has since been incorporated into [Agrius](https://attack.mitre.org/groups/G1030) operations.(Citation: SentinelOne Agrius 2021)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_aliases: DEADWOOD
type: malware
spec_version: 2.1
id: malware--f2e6af17-3828-4f10-88e7-343591618ddb
created: 2024-05-22T21:27:28.050Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1134
external_id: S1134
source_name: SentinelOne Agrius 2021
description: Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.
url: https://assets.sentinelone.com/sentinellabs/evol-agrius
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-08-28T14:16:00.884Z
name: GLOOXMAIL
description: [GLOOXMAIL](https://attack.mitre.org/software/S0026) is malware used by [APT1](https://attack.mitre.org/groups/G0006) that mimics legitimate Jabber/XMPP traffic. (Citation: Mandiant APT1)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_aliases: GLOOXMAIL
Trojan.GTALK
type: malware
spec_version: 2.1
id: malware--f2e8c7a1-cae1-45c4-baf0-6f21bdcbb2c2
created: 2017-05-31T21:32:20.526Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0026
external_id: S0026
source_name: Mandiant APT1
description: Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
url: https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5