auren-research/cyber-sec huggingface dataset:
modified: 2024-04-11T00:44:30.028Z
name: Metamorfo
description: [Metamorfo](https://attack.mitre.org/software/S0455) is a Latin-American banking trojan operated by a Brazilian cybercrime group that has been active since at least April 2018. The group focuses on targeting banks and cryptocurrency services in Brazil and Mexico.(Citation: Medium Metamorfo Apr 2020)(Citation: ESET Casbaneiro Oct 2019) 
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.1
x_mitre_contributors: Jose Luis Sánchez Martinez
Chen Erlich, @chen_erlich, enSilo
x_mitre_aliases: Metamorfo
Casbaneiro
type: malware
spec_version: 2.1
id: malware--81c57a96-fc8c-4f91-af8e-63e24c2927c2
created: 2020-05-26T17:34:19.044Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0455
external_id: S0455
source_name: Casbaneiro
description: (Citation: ESET Casbaneiro Oct 2019)
source_name: Metamorfo
description: (Citation: Medium Metamorfo Apr 2020)(Citation: ESET Casbaneiro Oct 2019) 
source_name: Medium Metamorfo Apr 2020
description: Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020.
url: https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767
source_name: ESET Casbaneiro Oct 2019
description: ESET Research. (2019, October 3). Casbaneiro: peculiarities of this banking Trojan that affects Brazil and Mexico. Retrieved September 23, 2021.
url: https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-06-18T20:03:31.986Z
name: Spica
description: [Spica](https://attack.mitre.org/software/S1140) is a custom backdoor written in Rust that has been used by [Star Blizzard](https://attack.mitre.org/groups/G1033) since at least 2023.(Citation: Google TAG COLDRIVER January 2024) 
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_aliases: Spica
type: malware
spec_version: 2.1
id: malware--824a230d-0f6a-4fd0-99df-8d464db2265e
created: 2024-06-18T20:03:12.865Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1140
external_id: S1140
source_name: Google TAG COLDRIVER January 2024
description: Shields, W. (2024, January 18). Russian threat group COLDRIVER expands its targeting of Western officials to include the use of malware. Retrieved June 13, 2024.
url: https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--82adb90e-43b8-4bce-9efe-afeba65457b2
created: 2025-10-19T20:17:15.905Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1247
external_id: S1247
source_name: Cyble Embargo Ransomware May 2024
description: Cyble. (2024, May 24). The Rust Revolution: New Embargo Ransomware Steps In. Retrieved October 19, 2025.
url: https://cyble.com/blog/the-rust-revolution-new-embargo-ransomware-steps-in/
source_name: ESET Embargo Ransomware October 2024
description: Jan Holman, Tomas Zvara. (2024, October 23). Embargo ransomware: Rock’n’Rust. Retrieved October 19, 2025.
url: https://www.welivesecurity.com/en/eset-research/embargo-ransomware-rocknrust/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-20T15:39:50.311Z
name: Embargo
description: [Embargo](https://attack.mitre.org/software/S1247) is a ransomware variant written in Rust that has been active since at least May 2024.(Citation: Cyble Embargo Ransomware May 2024)(Citation: ESET Embargo Ransomware October 2024) [Embargo](https://attack.mitre.org/software/S1247) ransomware operations are associated with “double extortion” ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid.(Citation: Cyble Embargo Ransomware May 2024)(Citation: ESET Embargo Ransomware October 2024) [Embargo](https://attack.mitre.org/software/S1247) ransomware has been known to be delivered through a loader known as MDeployer which also leverages a malware component known as MS4Killer that facilitates termination of processes operating on the victim hosts.(Citation: ESET Embargo Ransomware October 2024) [Embargo](https://attack.mitre.org/software/S1247) is also reportedly a Ransomware as a Service (RaaS).(Citation: ESET Embargo Ransomware October 2024)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: ESXi
Linux
Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_aliases: Embargo
type: malware
spec_version: 2.1
id: malware--82cb34ba-02b5-432b-b2d2-07f55cbf674d
created: 2017-05-31T21:33:00.176Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0094
external_id: S0094
source_name: xFrost
description: (Citation: Secureworks Karagany July 2019)
source_name: Karagany
description: (Citation: Secureworks Karagany July 2019)
source_name: Dragos DYMALLOY 
description: Dragos. (n.d.). DYMALLOY. Retrieved August 20, 2020.
url: https://www.dragos.com/threat/dymalloy/
source_name: Secureworks Karagany July 2019
description: Secureworks. (2019, July 24). Updated Karagany Malware Targets Energy Sector. Retrieved August 12, 2020.
url: https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector
source_name: Symantec Dragonfly
description: Symantec Security Response. (2014, June 30). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.
url: https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:20.519Z
name: Trojan.Karagany
description: [Trojan.Karagany](https://attack.mitre.org/software/S0094) is a modular remote access tool used for recon and linked to [Dragonfly](https://attack.mitre.org/groups/G0035). The source code for [Trojan.Karagany](https://attack.mitre.org/software/S0094) originated from Dream Loader malware which was leaked in 2010 and sold on underground forums. (Citation: Symantec Dragonfly)(Citation: Secureworks Karagany July 2019)(Citation: Dragos DYMALLOY )
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 3.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Trojan.Karagany
xFrost
Karagany
type: malware
spec_version: 2.1
id: malware--835a79f1-842d-472d-b8f4-d54b545c341b
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0234
external_id: S0234
source_name: Lookout Dark Caracal Jan 2018
description: Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.
url: https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf
source_name: CheckPoint Bandook Nov 2020
description: Check Point. (2020, November 26). Bandook: Signed & Delivered. Retrieved May 31, 2021.
url: https://research.checkpoint.com/2020/bandook-signed-delivered/
source_name: EFF Manul Aug 2016
description: Galperin, E., Et al.. (2016, August). I Got a Letter From the Government the Other Day.... Retrieved April 25, 2018.
url: https://www.eff.org/files/2016/08/03/i-got-a-letter-from-the-government.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:43:54.316Z
name: Bandook
description: [Bandook](https://attack.mitre.org/software/S0234) is a commercially available RAT, written in Delphi and C++, that has been available since at least 2007. It has been used against government, financial, energy, healthcare, education, IT, and legal organizations in the US, South America, Europe, and Southeast Asia. [Bandook](https://attack.mitre.org/software/S0234) has been used by [Dark Caracal](https://attack.mitre.org/groups/G0070), as well as in a separate campaign referred to as "Operation Manul".(Citation: EFF Manul Aug 2016)(Citation: Lookout Dark Caracal Jan 2018)(Citation: CheckPoint Bandook Nov 2020)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Bandook
revoked: no
modified: 2024-04-11T00:26:37.214Z
name: PipeMon
description: [PipeMon](https://attack.mitre.org/software/S0501) is a multi-stage modular backdoor used by [Winnti Group](https://attack.mitre.org/groups/G0044).(Citation: ESET PipeMon May 2020)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_contributors: Mathieu Tartare, ESET
Martin Smolár, ESET
x_mitre_aliases: PipeMon
type: malware
spec_version: 2.1
id: malware--8393dac0-0583-456a-9372-fd81691bca20
created: 2020-08-24T13:15:51.706Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0501
external_id: S0501
source_name: ESET PipeMon May 2020
description: Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti Group. Retrieved August 24, 2020.
url: https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--84c1ecc6-e5a2-4e8a-bf4b-651a618e0053
created: 2020-10-19T16:38:11.279Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0519
external_id: S0519
source_name: Mandiant - Synful Knock
description: Bill Hau, Tony Lee, Josh Homan. (2015, September 15). SYNful Knock - A Cisco router implant - Part I. Retrieved November 17, 2024.
url: https://cloud.google.com/blog/topics/threat-intelligence/synful-knock-acis/
source_name: Cisco Synful Knock Evolution
description: Graham Holmes. (2015, October 8). Evolution of attacks on Cisco IOS devices. Retrieved October 19, 2020.
url: https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-15T19:46:34.695Z
name: SYNful Knock
description: [SYNful Knock](https://attack.mitre.org/software/S0519) is a stealthy modification of the operating system of network devices that can be used to maintain persistence within a victim's network and provide new capabilities to the adversary.(Citation: Mandiant - Synful Knock)(Citation: Cisco Synful Knock Evolution)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Network Devices
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: SYNful Knock
type: malware
spec_version: 2.1
id: malware--858b0f9d-3a2a-437e-a058-afe72154f6da
created: 2024-12-30T19:36:12.999Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1182
external_id: S1182
source_name: Cisco MagicRAT 2022
description: Asheer Malhotra, Vitor Ventura & Jungsoo An, Cisco Talos. (2022, September 7). MagicRAT: Lazarus’ latest gateway into victim networks. Retrieved December 30, 2024.
url: https://blog.talosintelligence.com/lazarus-magicrat/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-10T21:36:18.962Z
name: MagicRAT
description: [MagicRAT](https://attack.mitre.org/software/S1182) is a remote access tool developed in C++ and exclusively used by the [Lazarus Group](https://attack.mitre.org/groups/G0032) threat actor in operations. [MagicRAT](https://attack.mitre.org/software/S1182) allows for arbitrary command execution on victim machines and provides basic remote access functionality.(Citation: Cisco MagicRAT 2022)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Adam Lichters
x_mitre_aliases: MagicRAT
modified: 2024-04-10T22:32:05.321Z
name: TINYTYPHON
description: [TINYTYPHON](https://attack.mitre.org/software/S0131) is a backdoor that has been used by the actors responsible for the MONSOON campaign. The majority of its code was reportedly taken from the MyDoom worm. (Citation: Forcepoint Monsoon)
is_family: yes
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_aliases: TINYTYPHON
type: malware
spec_version: 2.1
id: malware--85b39628-204a-48d2-b377-ec368cbcb7ca
created: 2017-05-31T21:33:15.467Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0131
external_id: S0131
source_name: Forcepoint Monsoon
description: Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.
url: https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--86b92f6c-9c05-4c51-b361-4c7bb13e21a1
created: 2019-01-31T00:36:39.771Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0356
external_id: S0356
source_name: KONNI
description: (Citation: Talos Konni May 2017)(Citation: Malwarebytes Konni Aug 2021)
source_name: Unit 42 Nokki Oct 2018
description: Grunzweig, J. (2018, October 01). NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT. Retrieved November 5, 2018.
url: https://researchcenter.paloaltonetworks.com/2018/10/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/
source_name: Unit 42 NOKKI Sept 2018
description: Grunzweig, J., Lee, B. (2018, September 27). New KONNI Malware attacking Eurasia and Southeast Asia. Retrieved November 5, 2018.
url: https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/
source_name: Medium KONNI Jan 2020
description: Karmi, D. (2020, January 4). A Look Into Konni 2019 Campaign. Retrieved April 28, 2020.
url: https://medium.com/d-hunter/a-look-into-konni-2019-campaign-b45a0f321e9b
source_name: Talos Konni May 2017
description: Rascagneres, P. (2017, May 03). KONNI: A Malware Under The Radar For Years. Retrieved November 5, 2018.
url: https://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html
source_name: Malwarebytes Konni Aug 2021
description: Threat Intelligence Team. (2021, August 23). New variant of Konni malware used in campaign targetting Russia. Retrieved January 5, 2022.
url: https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T03:20:18.481Z
name: KONNI
description: [KONNI](https://attack.mitre.org/software/S0356) is a remote access tool that security researchers assess has been used by North Korean cyber actors since at least 2014. [KONNI](https://attack.mitre.org/software/S0356) has significant code overlap with the [NOKKI](https://attack.mitre.org/software/S0353) malware family, and has been linked to several suspected North Korean campaigns targeting political organizations in Russia, East Asia, Europe and the Middle East; there is some evidence potentially linking [KONNI](https://attack.mitre.org/software/S0356) to [APT37](https://attack.mitre.org/groups/G0067).(Citation: Talos Konni May 2017)(Citation: Unit 42 NOKKI Sept 2018)(Citation: Unit 42 Nokki Oct 2018)(Citation: Medium KONNI Jan 2020)(Citation: Malwarebytes Konni Aug 2021)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.2
x_mitre_attack_spec_version: 3.3.0
x_mitre_contributors: Doron Karmi, @DoronKarmi
x_mitre_aliases: KONNI
type: malware
spec_version: 2.1
id: malware--876f6a77-fbc5-4e13-ab1a-5611986730a3
created: 2017-05-31T21:33:01.951Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0098
external_id: S0098
source_name: FireEye admin@338 March 2014
description: Moran, N. and Lanstein, A.. (2014, March 25). Spear Phishing the News Cycle: APT Actors Leverage Interest in the Disappearance of Malaysian Flight MH 370. Retrieved April 15, 2016.
url: https://www.fireeye.com/blog/threat-research/2014/03/spear-phishing-the-news-cycle-apt-actors-leverage-interest-in-the-disappearance-of-malaysian-flight-mh-370.html
source_name: Palo Alto T9000 Feb 2016
description: Grunzweig, J. and Miller-Osborn, J.. (2016, February 4). T9000: Advanced Modular Backdoor Uses Complex Anti-Analysis Techniques. Retrieved April 15, 2016.
url: http://researchcenter.paloaltonetworks.com/2016/02/t9000-advanced-modular-backdoor-uses-complex-anti-analysis-techniques/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:43:55.595Z
name: T9000
description: [T9000](https://attack.mitre.org/software/S0098) is a backdoor that is a newer variant of the T5000 malware family, also known as Plat1. Its primary function is to gather information about the victim. It has been used in multiple targeted attacks against U.S.-based organizations. (Citation: FireEye admin@338 March 2014) (Citation: Palo Alto T9000 Feb 2016)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: T9000
modified: 2024-04-10T20:36:12.150Z
name: Winnti for Linux
description: [Winnti for Linux](https://attack.mitre.org/software/S0430) is a trojan, seen since at least 2015, designed specifically for targeting Linux systems. Reporting indicates the winnti malware family is shared across a number of actors including [Winnti Group](https://attack.mitre.org/groups/G0044). The Windows variant is tracked separately under [Winnti for Windows](https://attack.mitre.org/software/S0141).(Citation: Chronicle Winnti for Linux May 2019)
is_family: yes
x_mitre_platforms: Linux
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_aliases: Winnti for Linux
type: malware
spec_version: 2.1
id: malware--8787e86d-8475-4f13-acea-d33eb83b6105
created: 2020-04-29T15:06:59.171Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0430
external_id: S0430
source_name: Chronicle Winnti for Linux May 2019
description: Chronicle Blog. (2019, May 15). Winnti: More than just Windows and Gates. Retrieved April 29, 2020.
url: https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--880f7b3e-ad27-4158-8b03-d44c9357950b
created: 2024-02-13T17:50:25.350Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1113
external_id: S1113
source_name: Mandiant Pulse Secure Update May 2021
description: Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.
url: https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-15T19:46:34.778Z
name: RAPIDPULSE
description: [RAPIDPULSE](https://attack.mitre.org/software/S1113) is a web shell that exists as a modification to a legitimate Pulse Secure file that has been used by [APT5](https://attack.mitre.org/groups/G1023) since at least 2021.(Citation: Mandiant Pulse Secure Update May 2021)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Network Devices
Linux
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: RAPIDPULSE