auren-research/cyber-sec huggingface dataset:
type: intrusion-set
spec_version: 2.1
id: intrusion-set--1f21da59-6a13-455b-afd0-d58d0a5a7d27
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0078
external_id: G0078
source_name: Gorgon Group
description: (Citation: Unit 42 Gorgon Group Aug 2018)
source_name: Unit 42 Gorgon Group Aug 2018
description: Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.
url: https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:11.522Z
name: Gorgon Group
description: [Gorgon Group](https://attack.mitre.org/groups/G0078) is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. (Citation: Unit 42 Gorgon Group Aug 2018)
aliases: Gorgon Group
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.5
x_mitre_attack_spec_version: 3.2.0
type: campaign
spec_version: 2.1
id: campaign--712e38c3-a656-426a-9b3b-a6bfb63294c6
created: 2023-03-15T19:23:36.696Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0021
external_id: C0021
source_name: FireEye APT29 Nov 2018
description: Dunwoody, M., et al. (2018, November 19). Not So Cozy: An Uncomfortable Examination of a Suspected APT29 Phishing Campaign. Retrieved November 27, 2018.
url: https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html
source_name: Microsoft Unidentified Dec 2018
description: Microsoft Defender Research Team. (2018, December 3). Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers. Retrieved April 15, 2019.
url: https://www.microsoft.com/security/blog/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:47.096Z
name: C0021
description: [C0021](https://attack.mitre.org/campaigns/C0021) was a spearphishing campaign conducted in November 2018 that targeted public sector institutions, non-governmental organizations (NGOs), educational institutions, and private-sector corporations in the oil and gas, chemical, and hospitality industries. The majority of targets were located in the US, particularly in and around Washington D.C., with other targets located in Europe, Hong Kong, India, and Canada. [C0021](https://attack.mitre.org/campaigns/C0021)'s technical artifacts, tactics, techniques, and procedures (TTPs), and targeting overlap with previous suspected [APT29](https://attack.mitre.org/groups/G0016) activity.(Citation: Microsoft Unidentified Dec 2018)(Citation: FireEye APT29 Nov 2018)
aliases: C0021
first_seen: 2018-11-01T05:00:00.000Z
last_seen: 2018-11-01T05:00:00.000Z
x_mitre_first_seen_citation: (Citation: FireEye APT29 Nov 2018)(Citation: Microsoft Unidentified Dec 2018)
x_mitre_last_seen_citation: (Citation: FireEye APT29 Nov 2018)(Citation: Microsoft Unidentified Dec 2018)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_domains: enterprise-attack
type: campaign
spec_version: 2.1
id: campaign--26d9ebae-de59-427f-ae9a-349456bae4b1
created: 2022-09-07T13:40:09.750Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0001
external_id: C0001
source_name: Talos Frankenstein June 2019
description: Adamitis, D. et al. (2019, June 4). It's alive: Threat actors cobble together open-source pieces into monstrous Frankenstein campaign. Retrieved May 11, 2020.
url: https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:47.239Z
name: Frankenstein
description: [Frankenstein](https://attack.mitre.org/campaigns/C0001) was described by security researchers as a highly-targeted campaign conducted by moderately sophisticated and highly resourceful threat actors in early 2019. The unidentified actors primarily relied on open source tools, including [Empire](https://attack.mitre.org/software/S0363). The campaign name refers to the actors' ability to piece together several unrelated open-source tool components.(Citation: Talos Frankenstein June 2019)
aliases: Frankenstein
first_seen: 2019-01-01T06:00:00.000Z
last_seen: 2019-04-01T05:00:00.000Z
x_mitre_first_seen_citation: (Citation: Talos Frankenstein June 2019)
x_mitre_last_seen_citation: (Citation: Talos Frankenstein June 2019)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_domains: enterprise-attack
type: intrusion-set
spec_version: 2.1
id: intrusion-set--76d59913-1d24-4992-a8ac-05a3eb093f71
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0074
external_id: G0074
source_name: DYMALLOY
description: (Citation: Dragos DYMALLOY )
source_name: Berserk Bear
description: (Citation: Fortune Dragonfly 2.0 Sept 2017)
source_name: IRON LIBERTY
description: (Citation: Secureworks MCMD July 2019)(Citation: Secureworks IRON LIBERTY)
source_name: Dragonfly 2.0
description: (Citation: US-CERT TA18-074A) (Citation: Symantec Dragonfly Sept 2017) (Citation: Fortune Dragonfly 2.0 Sept 2017)
source_name: Dragos DYMALLOY 
description: Dragos. (n.d.). DYMALLOY. Retrieved August 20, 2020.
url: https://www.dragos.com/threat/dymalloy/
source_name: Fortune Dragonfly 2.0 Sept 2017
description: Hackett, R. (2017, September 6). Hackers Have Penetrated Energy Grid, Symantec Warns. Retrieved June 6, 2018.
url: http://fortune.com/2017/09/06/hack-energy-grid-symantec/
source_name: Secureworks MCMD July 2019
description: Secureworks. (2019, July 24). MCMD Malware Analysis. Retrieved August 13, 2020.
url: https://www.secureworks.com/research/mcmd-malware-analysis
source_name: Secureworks IRON LIBERTY
description: Secureworks. (n.d.). IRON LIBERTY. Retrieved October 15, 2020.
url: https://www.secureworks.com/research/threat-profiles/iron-liberty
source_name: Symantec Dragonfly Sept 2017
description: Symantec Security Response. (2017, September 6). Dragonfly: Western energy sector targeted by sophisticated attack group. Retrieved September 9, 2017.
url: https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group
source_name: US-CERT TA18-074A
description: US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.
url: https://www.us-cert.gov/ncas/alerts/TA18-074A
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T17:59:27.618Z
name: Dragonfly 2.0
description: [Dragonfly 2.0](https://attack.mitre.org/groups/G0074) is a suspected Russian group that has targeted government entities and multiple U.S. critical infrastructure sectors since at least December 2015. (Citation: US-CERT TA18-074A) (Citation: Symantec Dragonfly Sept 2017) There is debate over the extent of overlap between [Dragonfly 2.0](https://attack.mitre.org/groups/G0074) and [Dragonfly](https://attack.mitre.org/groups/G0035), but there is sufficient evidence to lead to these being tracked as two separate groups. (Citation: Fortune Dragonfly 2.0 Sept 2017)(Citation: Dragos DYMALLOY )
aliases: Dragonfly 2.0
IRON LIBERTY
DYMALLOY
Berserk Bear
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
ics-attack
x_mitre_version: 2.1
x_mitre_attack_spec_version: 3.2.0
modified: 2024-04-11T00:07:05.918Z
name: Sidewinder
description: [Sidewinder](https://attack.mitre.org/groups/G0121) is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan.(Citation: ATT Sidewinder January 2021)(Citation: Securelist APT Trends April 2018)(Citation: Cyble Sidewinder September 2020)
aliases: Sidewinder
T-APT-04
Rattlesnake
x_mitre_deprecated: no
x_mitre_version: 1.2
x_mitre_contributors: Lacework Labs
Daniyal Naeem, BT Security
type: intrusion-set
spec_version: 2.1
id: intrusion-set--3fc023b2-c5cc-481d-9c3e-70141ae1a87e
created: 2021-01-27T15:57:11.183Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0121
external_id: G0121
source_name: T-APT-04
description: (Citation: Cyble Sidewinder September 2020)
source_name: Rattlesnake
description: (Citation: Cyble Sidewinder September 2020)
source_name: Cyble Sidewinder September 2020
description: Cyble. (2020, September 26). SideWinder APT Targets with futuristic Tactics and Techniques. Retrieved January 29, 2021.
url: https://cybleinc.com/2020/09/26/sidewinder-apt-targets-with-futuristic-tactics-and-techniques/
source_name: Securelist APT Trends April 2018
description: Global Research and Analysis Team . (2018, April 12). APT Trends report Q1 2018. Retrieved January 27, 2021.
url: https://securelist.com/apt-trends-report-q1-2018/85280/
source_name: ATT Sidewinder January 2021
description: Hegel, T. (2021, January 13). A Global Perspective of the SideWinder APT. Retrieved January 27, 2021.
url: https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-11-25T22:07:13.513Z
name: Outer Space
description: [Outer Space](https://attack.mitre.org/campaigns/C0042) was a campaign conducted by [OilRig](https://attack.mitre.org/groups/G0049) throughout 2021 that used the [SampleCheck5000](https://attack.mitre.org/software/S1168) downloader and [Solar](https://attack.mitre.org/software/S1166) backdoor to target Israeli organizations.(Citation: ESET OilRig Campaigns Sep 2023)
aliases: Outer Space
first_seen: 2021-01-01T05:00:00.000Z
last_seen: 2021-12-01T05:00:00.000Z
x_mitre_first_seen_citation: (Citation: ESET OilRig Campaigns Sep 2023)
x_mitre_last_seen_citation: (Citation: ESET OilRig Campaigns Sep 2023)
x_mitre_deprecated: no
x_mitre_version: 1.0
type: campaign
spec_version: 2.1
id: campaign--a1f5df89-ec82-45ef-b229-4ca6a407dc4f
created: 2024-11-21T21:08:27.153Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0042
external_id: C0042
source_name: ESET OilRig Campaigns Sep 2023
description: Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.
url: https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: enterprise-attack
type: intrusion-set
spec_version: 2.1
id: intrusion-set--99910207-1741-4da1-9b5d-537410186b51
created: 2021-11-30T16:25:49.366Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0141
external_id: G0141
source_name: ESET Gelsemium June 2021
description: Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.
url: https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T17:59:27.801Z
name: Gelsemium
description: [Gelsemium](https://attack.mitre.org/groups/G0141) is a cyberespionage group that has been active since at least 2014, targeting governmental institutions, electronics manufacturers, universities, and religious organizations in East Asia and the Middle East.(Citation: ESET Gelsemium June 2021)
aliases: Gelsemium
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--54dfec3e-6464-4f74-9d69-b7c817b7e5a3
created: 2021-03-05T18:54:56.267Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0126
external_id: G0126
source_name: Malwarebytes Higaisa 2020
description: Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.
url: https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/
source_name: PTSecurity Higaisa 2020
description: PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.
url: https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-and-new-year-greetings-the-higaisa-group/
source_name: Zscaler Higaisa 2020
description: Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.
url: https://www.zscaler.com/blogs/security-research/return-higaisa-apt
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-22T02:54:00.893Z
name: Higaisa
description: [Higaisa](https://attack.mitre.org/groups/G0126) is a threat group suspected to have South Korean origins. [Higaisa](https://attack.mitre.org/groups/G0126) has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. [Higaisa](https://attack.mitre.org/groups/G0126) was first disclosed in early 2019 but is assessed to have operated as early as 2009.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)(Citation: PTSecurity Higaisa 2020)
aliases: Higaisa
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.3.0
x_mitre_contributors: Daniyal Naeem, BT Security
x_mitre_domains: enterprise-attack
modified: 2024-11-17T15:05:25.104Z
name: APT30
description: [APT30](https://attack.mitre.org/groups/G0013) is a threat group suspected to be associated with the Chinese government. While [Naikon](https://attack.mitre.org/groups/G0019) shares some characteristics with [APT30](https://attack.mitre.org/groups/G0013), the two groups do not appear to be exact matches.(Citation: FireEye APT30)(Citation: Baumgartner Golovkin Naikon 2015)
aliases: APT30
x_mitre_deprecated: no
x_mitre_version: 1.1
type: intrusion-set
spec_version: 2.1
id: intrusion-set--f047ee18-7985-4946-8bfb-4ed754d3a0dd
created: 2017-05-31T21:31:51.026Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0013
external_id: G0013
source_name: APT30
description: (Citation: FireEye APT30) (Citation: Baumgartner Golovkin Naikon 2015)
source_name: Baumgartner Golovkin Naikon 2015
description: Baumgartner, K., Golovkin, M.. (2015, May 14). The Naikon APT. Retrieved January 14, 2015.
url: https://securelist.com/the-naikon-apt/69953/
source_name: FireEye APT30
description: FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024.
url: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-11-17T14:15:51.850Z
name: Windshift
description: [Windshift](https://attack.mitre.org/groups/G0112) is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.(Citation: SANS Windshift August 2018)(Citation: objective-see windtail1 dec 2018)(Citation: objective-see windtail2 jan 2019)
aliases: Windshift
Bahamut
x_mitre_deprecated: no
x_mitre_version: 1.1
type: intrusion-set
spec_version: 2.1
id: intrusion-set--afec6dc3-a18e-4b62-b1a4-5510e1a498d1
created: 2020-06-25T17:16:39.168Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0112
external_id: G0112
source_name: Bahamut
description: (Citation: SANS Windshift August 2018)
source_name: SANS Windshift August 2018
description: Karim, T. (2018, August). TRAILS OF WINDSHIFT. Retrieved November 17, 2024.
url: https://www.scribd.com/document/661837258/WINDSHIFT-summit-archive-1554718868
source_name: objective-see windtail1 dec 2018
description: Wardle, Patrick. (2018, December 20). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 1). Retrieved October 3, 2019.
url: https://objective-see.com/blog/blog_0x3B.html
source_name: objective-see windtail2 jan 2019
description: Wardle, Patrick. (2019, January 15). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 2). Retrieved October 3, 2019.
url: https://objective-see.com/blog/blog_0x3D.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
mobile-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: intrusion-set
spec_version: 2.1
id: intrusion-set--6eded342-33e5-4451-b6b2-e1c62863129f
created: 2021-12-26T23:11:39.442Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0142
external_id: G0142
source_name: TrendMicro Confucius APT Feb 2018
description: Lunghi, D and Horejsi, J. (2018, February 13). Deciphering Confucius: A Look at the Group's Cyberespionage Operations. Retrieved December 26, 2021.
url: https://www.trendmicro.com/en_us/research/18/b/deciphering-confucius-cyberespionage-operations.html
source_name: TrendMicro Confucius APT Aug 2021
description: Lunghi, D. (2021, August 17). Confucius Uses Pegasus Spyware-related Lures to Target Pakistani Military. Retrieved December 26, 2021.
url: https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html
source_name: Uptycs Confucius APT Jan 2021
description: Uptycs Threat Research Team. (2021, January 12). Confucius APT deploys Warzone RAT. Retrieved December 17, 2021.
url: https://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:36.476Z
name: Confucius
description: [Confucius](https://attack.mitre.org/groups/G0142) is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. Security researchers have noted similarities between [Confucius](https://attack.mitre.org/groups/G0142) and [Patchwork](https://attack.mitre.org/groups/G0040), particularly in their respective custom malware code and targets.(Citation: TrendMicro Confucius APT Feb 2018)(Citation: TrendMicro Confucius APT Aug 2021)(Citation: Uptycs Confucius APT Jan 2021)
aliases: Confucius
Confucius APT
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
mobile-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
modified: 2025-03-10T19:48:56.912Z
name: APT28 Nearest Neighbor Campaign
description: [APT28 Nearest Neighbor Campaign](https://attack.mitre.org/campaigns/C0051) was conducted by [APT28](https://attack.mitre.org/groups/G0007) from early February 2022 to November 2024 against organizations and individuals with expertise on Ukraine. APT28 primarily leveraged living-off-the-land techniques, while leveraging the zero-day exploitation of CVE-2022-38028. Notably, APT28 leveraged Wi-Fi networks in close proximity to the intended target to gain initial access to the victim environment. By daisy-chaining multiple compromised organizations nearby the intended target, APT28 discovered dual-homed systems (with both a wired and wireless network connection) to enable Wi-Fi and use compromised credentials to connect to the victim network.(Citation: Nearest Neighbor Volexity)
aliases: APT28 Nearest Neighbor Campaign
first_seen: 2022-02-01T05:00:00.000Z
last_seen: 2024-11-01T04:00:00.000Z
x_mitre_first_seen_citation: (Citation: Nearest Neighbor Volexity)
x_mitre_last_seen_citation: (Citation: Nearest Neighbor Volexity)
x_mitre_deprecated: no
x_mitre_version: 1.0
type: campaign
spec_version: 2.1
id: campaign--a010610e-22cb-437e-bfde-b78861bdca7a
created: 2025-02-25T17:11:53.066Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0051
external_id: C0051
source_name: Nearest Neighbor Volexity
description: Koessel, Sean. Adair, Steven. Lancaster, Tom. (2024, November 22). The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access. Retrieved February 25, 2025.
url: https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: enterprise-attack