auren-research/cyber-sec huggingface dataset:
type: attack-pattern
spec_version: 2.1
id: attack-pattern--efbf7888-f61b-4572-9c80-7e2965c60707
created: 2020-05-21T17:43:26.506Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T0839
external_id: T0839
source_name: Daniel Peck, Dale Peterson January 2009
description: Daniel Peck, Dale Peterson 2009, January 28 Leveraging Ethernet Card Vulnerabilities in Field Devices Retrieved. 2017/12/19 
url: https://www.researchgate.net/publication/228849043_Leveraging_ethernet_card_vulnerabilities_in_field_devices
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:20.310Z
name: Module Firmware
description: Adversaries may install malicious or vulnerable firmware onto modular hardware devices. Control system devices often contain modular hardware devices. These devices may have their own set of firmware that is separate from the firmware of the main control system equipment. 

This technique is similar to [System Firmware](https://attack.mitre.org/techniques/T0857), but is conducted on other system components that may not have the same capabilities or level of integrity checking. Although it results in a device re-image, malicious device firmware may provide persistent access to remaining devices. (Citation: Daniel Peck, Dale Peterson January 2009) 

An easy point of access for an adversary is the Ethernet card, which may have its own CPU, RAM, and operating system. The adversary may attack and likely exploit the computer on an Ethernet card. Exploitation of the Ethernet card computer may enable the adversary to accomplish additional attacks, such as the following: (Citation: Daniel Peck, Dale Peterson January 2009) 

* Delayed Attack - The adversary may stage an attack in advance and choose when to launch it, such as at a particularly damaging time. 
* Brick the Ethernet Card - Malicious firmware may be programmed to result in an Ethernet card failure, requiring a factory return. 
* Random Attack or Failure - The adversary may load malicious firmware onto multiple field devices. Execution of an attack and the time it occurs is generated by a pseudo-random number generator. 
* A Field Device Worm - The adversary may choose to identify all field devices of the same model, with the end goal of performing a device-wide compromise. 
* Attack Other Cards on the Field Device - Although it is not the most important module in a field device, the Ethernet card is most accessible to the adversary and malware. Compromise of the Ethernet card may provide a more direct route to compromising other modules, such as the CPU module.
kill_chain_phases: kill_chain_name: mitre-ics-attack
phase_name: persistence
kill_chain_name: mitre-ics-attack
phase_name: impair-process-control
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: None
x_mitre_version: 1.1
type: attack-pattern
spec_version: 2.1
id: attack-pattern--fa3aa267-da22-4bdd-961f-03223322a8d5
created: 2023-03-30T18:56:02.424Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T0893
external_id: T0893
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-15T19:59:23.577Z
name: Data from Local System
description: Adversaries may target and collect data from local system sources, such as file systems, configuration files, or local databases. This can include sensitive data such as specifications, schematics, or diagrams of control system layouts, devices, and processes.

Adversaries may do this using [Command-Line Interface](https://attack.mitre.org/techniques/T0807) or [Scripting](https://attack.mitre.org/techniques/T0853) techniques to interact with the file system to gather information. Adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T0802) on the local system. 
kill_chain_phases: kill_chain_name: mitre-ics-attack
phase_name: collection
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: None
x_mitre_version: 1.0
type: attack-pattern
spec_version: 2.1
id: attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f
created: 2023-03-30T14:04:17.023Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T0892
external_id: T0892
source_name: German BAS Lockout Dec 2021
description: Kelly Jackson Higgins. (2021, December 20). Lights Out: Cyberattacks Shut Down Building Automation Systems. Retrieved March 30, 2023.
url: https://www.darkreading.com/attacks-breaches/lights-out-cyberattacks-shut-down-building-automation-systems
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:20.690Z
name: Change Credential
description: Adversaries may modify software and device credentials to prevent operator and responder access. Depending on the device, the modification or addition of this password could prevent any device configuration actions from being accomplished and may require a factory reset or replacement of hardware. These credentials are often built-in features provided by the device vendors as a means to restrict access to management interfaces.

An adversary with access to valid or hardcoded credentials could change the credential to prevent future authorized device access. Change Credential may be especially damaging when paired with other techniques such as Modify Program, Data Destruction, or Modify Controller Tasking. In these cases, a device’s configuration may be destroyed or include malicious actions for the process environment, which cannot not be removed through normal device configuration actions. 

Additionally, recovery of the device and original configuration may be difficult depending on the features provided by the device. In some cases, these passwords cannot be removed onsite and may require that the device be sent back to the vendor for additional recovery steps.


A chain of incidents occurred in Germany, where adversaries locked operators out of their building automation system (BAS) controllers by enabling a previously unset BCU key. (Citation: German BAS Lockout Dec 2021) 

kill_chain_phases: kill_chain_name: mitre-ics-attack
phase_name: inhibit-response-function
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Felix Eberstaller
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: None
x_mitre_version: 1.0
type: attack-pattern
spec_version: 2.1
id: attack-pattern--fc5fda7e-6b2c-4457-b036-759896a2efa2
created: 2021-04-13T11:15:26.506Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T0889
external_id: T0889
source_name: IEC February 2013
description: IEC 2013, February 20 IEC 61131-3:2013 Programmable controllers - Part 3: Programming languages Retrieved. 2019/10/22 
url: https://webstore.iec.ch/publication/4552
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-15T19:59:24.213Z
name: Modify Program
description: Adversaries may modify or add a program on a controller to affect how it interacts with the physical process, peripheral devices and other hosts on the network. Modification to controller programs can be accomplished using a Program Download in addition to other types of program modification such as online edit and program append. 

Program modification encompasses the addition and modification of instructions and logic contained in Program Organization Units (POU) (Citation: IEC February 2013) and similar programming elements found on controllers. This can include, for example, adding new functions to a controller, modifying the logic in existing functions and making new calls from one function to another. 

Some programs may allow an adversary to interact directly with the native API of the controller to take advantage of obscure features or vulnerabilities.
kill_chain_phases: kill_chain_name: mitre-ics-attack
phase_name: persistence
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: None
x_mitre_version: 1.2
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--4c12c1c8-bcef-4daf-8e5b-fca235f71d9e
created: 2022-05-11T16:22:58.802Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0109
external_id: DC0109
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Process/Event Alarm
description: This includes a list of any process alarms or alerts produced to indicate unusual or concerning activity within the operational process (e.g., increased temperature/pressure)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Operational Databases
channel: None
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--8ed4e6d0-56d7-4e6b-8fa6-41f41631f30d
created: 2022-09-23T16:36:08.632Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0111
external_id: DC0111
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Software
description: This includes sources of current and expected software or application programs deployed to a device, along with information on the version and patch level for vendor products, full source code for any application programs, and unique identifiers (e.g., hashes, signatures).
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Asset
channel: None
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--931b3fc6-ad68-42a8-9018-e98515eedc95
created: 2022-05-11T16:22:58.802Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0107
external_id: DC0107
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Process History/Live Data
description: This includes any data stores that maintain historical or real-time events and telemetry recorded from various sensors or devices
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Operational Databases
channel: None
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--9d56be63-3501-4dd3-bb5f-63c580833298
created: 2022-05-11T16:22:58.802Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0108
external_id: DC0108
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Device Alarm
description: This includes alarms associated with unexpected device functions, such as shutdowns, restarts, failures, or configuration changes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Operational Databases
channel: None
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--b05a614b-033c-4578-b4f2-c63a9feee706
created: 2022-09-23T16:34:00.912Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0110
external_id: DC0110
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Asset Inventory
description: This includes sources of current and expected devices on the network, including the manufacturer, model, and necessary identifiers (e.g., IP and hardware addresses)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Asset
channel: None
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--1b8c9f31-ad35-4850-bf8c-80c565ad3552
created: 2022-05-11T16:22:58.802Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0040
external_id: DS0040
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Operational Databases
description: Operational databases contain information about the status of the operational process and associated devices, including any measurements, events, history, or alarms that have occurred
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_collection_layers: Host
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--b1717cb4-d536-4e2b-b5e5-07e67e26183c
created: 2022-05-11T16:22:58.802Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0039
external_id: DS0039
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Asset
description: Data sources with information about the set of devices found within the network, along with their current software and configurations
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_collection_layers: Host
type: intrusion-set
spec_version: 2.1
id: intrusion-set--190242d7-73fc-4738-af68-20162f7a5aae
created: 2017-05-31T21:31:57.307Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1000
external_id: G1000
source_name: Dragos
description: Dragos Allanite Retrieved. 2019/10/27 
url: https://dragos.com/resource/allanite/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:23.407Z
name: ALLANITE
description: [ALLANITE](https://attack.mitre.org/groups/G1000) is a suspected Russian cyber espionage group, that has primarily targeted the electric utility sector within the United States and United Kingdom. The group's tactics and techniques are reportedly similar to [Dragonfly](https://attack.mitre.org/groups/G0035), although [ALLANITE](https://attack.mitre.org/groups/G1000)s technical capabilities have not exhibited disruptive or destructive abilities. It has been suggested that the group maintains a presence in ICS for the purpose of gaining understanding of processes and to maintain persistence. (Citation: Dragos)
aliases: ALLANITE
Palmetto Fusion
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Dragos Threat Intelligence
type: campaign
spec_version: 2.1
id: campaign--70cab19e-1745-425e-b3db-c02cd5ff157a
created: 2023-03-10T20:01:08.133Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0020
external_id: C0020
source_name: Marshall Abrams July 2008
description: Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 
url: https://www.mitre.org/sites/default/files/pdf/08_1145.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:23.900Z
name: Maroochy Water Breach
description: [Maroochy Water Breach](https://attack.mitre.org/campaigns/C0020) was an incident in 2000 where an adversary leveraged the local government’s wastewater control system and stolen engineering equipment to disrupt and eventually release 800,000 liters of raw sewage into the local community.(Citation: Marshall Abrams July 2008)
aliases: Maroochy Water Breach
first_seen: 2000-02-01T05:00:00.000Z
last_seen: 2000-04-01T05:00:00.000Z
x_mitre_first_seen_citation: (Citation: Marshall Abrams July 2008)
x_mitre_last_seen_citation: (Citation: Marshall Abrams July 2008)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_domains: ics-attack
modified: 2024-04-15T19:37:46.084Z
name: Unitronics Defacement Campaign
description: The [Unitronics Defacement Campaign](https://attack.mitre.org/campaigns/C0031) was a collection of intrusions across multiple sectors by the [CyberAv3ngers](https://attack.mitre.org/groups/G1027), where threat actors engaged in a seemingly opportunistic and global targeting and defacement of Unitronics Vision Series [Programmable Logic Controller (PLC)](https://attack.mitre.org/assets/A0003) with [Human-Machine Interface (HMI)](https://attack.mitre.org/assets/A0002). The sectors that these PLCs can be commonly found in are water and wastewater, energy, food and beverage manufacturing, and healthcare. The most notable feature of this attack was the defacement of the PLCs' HMIs.(Citation: CISA AA23-335A IRGC-Affiliated December 2023)(Citation: Frank Bajak and Marc Levy December 2023)
aliases: Unitronics Defacement Campaign
first_seen: 2023-11-01T04:00:00.000Z
last_seen: 2023-11-01T04:00:00.000Z
x_mitre_first_seen_citation: (Citation: CISA AA23-335A IRGC-Affiliated December 2023)
x_mitre_last_seen_citation: (Citation: Lisa Zahner December 2023)
x_mitre_deprecated: no
x_mitre_version: 1.0
type: campaign
spec_version: 2.1
id: campaign--8fda050f-470d-4401-994e-35c1a6c301de
created: 2024-03-25T19:58:53.090Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0031
external_id: C0031
source_name: CISA AA23-335A IRGC-Affiliated December 2023
description: DHS/CISA. (2023, December 1). IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities. Retrieved March 25, 2024.
url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a
source_name: Frank Bajak and Marc Levy December 2023
description: Frank Bajak and Marc Levy. (2023, December 2). Breaches by Iran-affiliated hackers spanned multiple U.S. states, federal agencies say. Retrieved March 25, 2024.
url: https://apnews.com/article/hackers-iran-israel-water-utilities-critical-infrastructure-cisa-554b2aa969c8220016ab2ef94bd7635b
source_name: Lisa Zahner December 2023
description: Lisa Zahner. (2023, December 15). Hackers in Iran attack computer at Vero Utilities. Retrieved March 25, 2024.
url: https://veronews.com/2023/12/15/hackers-in-iran-attack-computer-at-vero-utilities/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: ics-attack
type: campaign
spec_version: 2.1
id: campaign--65281d3e-b03c-46b8-8cd8-716363ac3cb2
created: 2022-09-20T20:53:14.373Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0009
external_id: C0009
source_name: CISA AA21-042A Water Treatment Intrusion Feb 2021
description: CISA. (2021, February 11). Compromise of U.S. Water Treatment Facility . Retrieved October 18, 2022.
url: https://www.cisa.gov/uscert/ncas/alerts/aa21-042a
source_name: Pinellas County Sheriffs Office February 2021
description: Pinellas County Sheriffs Office 2021, February 8 Treatment Plant Intrusion Press Conference Retrieved. 2021/10/08 
url: https://www.youtube.com/watch?v=MkXDSOgLQ6M
source_name: Dragos Oldsmar Feb 2021
description: Serino, G., et al . (2021, February 8). Recommendations Following the Oldsmar Water Treatment Facility Cyber Attack. Retrieved October 21, 2022.
url: https://www.dragos.com/blog/industry-news/recommendations-following-the-oldsmar-water-treatment-facility-cyber-attack/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T18:00:54.375Z
name: Oldsmar Treatment Plant Intrusion
description: [Oldsmar Treatment Plant Intrusion](https://attack.mitre.org/campaigns/C0009) was a cyber incident involving a water treatment facility in Florida. During this incident, unidentified threat actors leveraged features of the system to access and modify setpoints for a specific chemical required in the treatment process. The incident was detected immediately and prevented before it could cause any harm to the public.(Citation: Pinellas County Sheriffs Office February 2021)(Citation: CISA AA21-042A Water Treatment Intrusion Feb 2021)(Citation: Dragos Oldsmar Feb 2021)
aliases: Oldsmar Treatment Plant Intrusion
first_seen: 2021-02-01T05:00:00.000Z
last_seen: 2021-02-01T05:00:00.000Z
x_mitre_first_seen_citation: (Citation: Pinellas County Sheriffs Office February 2021)
x_mitre_last_seen_citation: (Citation: Pinellas County Sheriffs Office February 2021)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_domains: ics-attack
type: intrusion-set
spec_version: 2.1
id: intrusion-set--68ba94ab-78b8-43e7-83e2-aed3466882c6
created: 2018-01-16T16:13:52.465Z
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0057
external_id: G0057
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:40:07.627Z
name: APT34
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0