auren-research/cyber-sec huggingface dataset:
type: intrusion-set
spec_version: 2.1
id: intrusion-set--e5603ea8-4c36-40e7-b7af-a077d24fedc1
created: 2021-09-24T21:41:34.797Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0136
external_id: G0136
source_name: IndigoZebra
description: (Citation: HackerNews IndigoZebra July 2021)(Citation: Checkpoint IndigoZebra July 2021)(Citation: Securelist APT Trends Q2 2017)
source_name: HackerNews IndigoZebra July 2021
description: Lakshmanan, R.. (2021, July 1). IndigoZebra APT Hacking Campaign Targets the Afghan Government. Retrieved September 24, 2021.
url: https://thehackernews.com/2021/07/indigozebra-apt-hacking-campaign.html
source_name: Checkpoint IndigoZebra July 2021
description: CheckPoint Research. (2021, July 1). IndigoZebra APT continues to attack Central Asia with evolving tools. Retrieved September 24, 2021.
url: https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/
source_name: Securelist APT Trends Q2 2017
description: Kaspersky Lab's Global Research & Analysis Team. (2017, August 8). APT Trends report Q2 2017. Retrieved February 15, 2018.
url: https://securelist.com/apt-trends-report-q2-2017/79332/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:40.589Z
name: IndigoZebra
description: [IndigoZebra](https://attack.mitre.org/groups/G0136) is a suspected Chinese cyber espionage group that has been targeting Central Asian governments since at least 2014.(Citation: HackerNews IndigoZebra July 2021)(Citation: Checkpoint IndigoZebra July 2021)(Citation: Securelist APT Trends Q2 2017)
aliases: IndigoZebra
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Pooja Natarajan, NEC Corporation India
Yoshihiro Kori, NEC Corporation
Manikantan Srinivasan, NEC Corporation India
modified: 2025-03-27T21:18:00.302Z
name: SPACEHOP Activity
description: [SPACEHOP Activity](https://attack.mitre.org/campaigns/C0052) is conducted through commercially leased Virtual Private Servers (VPS), otherwise known as provisioned Operational Relay Box (ORB) networks. The network leveraged for SPACEHOP Activity enabled China-nexus cyber threat actors – such as [APT5](https://attack.mitre.org/groups/G1023) and [Ke3chang](https://attack.mitre.org/groups/G0004) – to perform network reconnaissance scanning and vulnerability exploitation. SPACEHOP Activity has historically targeted entities in North America, Europe, and the Middle East.(Citation: ORB Mandiant) 
aliases: SPACEHOP Activity
first_seen: 2019-01-01T05:00:00.000Z
last_seen: 2024-05-01T04:00:00.000Z
x_mitre_first_seen_citation: (Citation: ORB Mandiant)
x_mitre_last_seen_citation: (Citation: ORB Mandiant)
x_mitre_deprecated: no
x_mitre_version: 1.0
type: campaign
spec_version: 2.1
id: campaign--83e1f587-34da-44cc-b65b-a72479cb1616
created: 2025-03-25T22:32:28.946Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0052
external_id: C0052
source_name: ORB Mandiant
description: Raggi, Michael. (2024, May 22). IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders. Retrieved July 8, 2024.
url: https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-orb-networks
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: enterprise-attack
modified: 2023-09-27T20:22:05.127Z
name: SilverTerrier
description: [SilverTerrier](https://attack.mitre.org/groups/G0083) is a Nigerian threat group that has been seen active since 2014. [SilverTerrier](https://attack.mitre.org/groups/G0083) mainly targets organizations in high technology, higher education, and manufacturing.(Citation: Unit42 SilverTerrier 2018)(Citation: Unit42 SilverTerrier 2016)
aliases: SilverTerrier
x_mitre_deprecated: no
x_mitre_version: 1.2
type: intrusion-set
spec_version: 2.1
id: intrusion-set--76565741-3452-4069-ab08-80c0ea95bbeb
created: 2019-01-29T21:36:59.793Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0083
external_id: G0083
source_name: SilverTerrier
description: (Citation: Unit42 SilverTerrier 2018)(Citation: Unit42 SilverTerrier 2016)
source_name: Unit42 SilverTerrier 2016
description: Renals, P., Conant, S. (2016). SILVERTERRIER: The Next Evolution in Nigerian Cybercrime. Retrieved November 13, 2018.
url: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/silverterrier-next-evolution-in-nigerian-cybercrime.pdf
source_name: Unit42 SilverTerrier 2018
description: Unit42. (2016). SILVERTERRIER: THE RISE OF NIGERIAN BUSINESS EMAIL COMPROMISE. Retrieved November 13, 2018.
url: https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/whitepapers/unit42-silverterrier-rise-of-nigerian-business-email-compromise
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: intrusion-set
spec_version: 2.1
id: intrusion-set--277d2f87-2ae5-4730-a3aa-50c1fdff9656
created: 2017-05-31T21:32:07.541Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0041
external_id: G0041
source_name: Strider
description: (Citation: Symantec Strider Blog) (Citation: Kaspersky ProjectSauron Blog)
source_name: ProjectSauron
description: ProjectSauron is used to refer both to the threat group also known as G0041 as well as the malware platform also known as S0125. (Citation: Kaspersky ProjectSauron Blog) (Citation: Kaspersky ProjectSauron Full Report)
source_name: Symantec Strider Blog
description: Symantec Security Response. (2016, August 7). Strider: Cyberespionage group turns eye of Sauron on targets. Retrieved August 17, 2016.
url: http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets
source_name: Kaspersky ProjectSauron Blog
description: Kaspersky Lab's Global Research & Analysis Team. (2016, August 8). ProjectSauron: top level cyber-espionage platform covertly extracts encrypted government comms. Retrieved August 17, 2016.
url: https://securelist.com/faq-the-projectsauron-apt/75533/
source_name: Kaspersky ProjectSauron Full Report
description: Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.
url: https://securelist.com/files/2016/07/The-ProjectSauron-APT_research_KL.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:43.099Z
name: Strider
description: [Strider](https://attack.mitre.org/groups/G0041) is a threat group that has been active since at least 2011 and has targeted victims in Russia, China, Sweden, Belgium, Iran, and Rwanda.(Citation: Symantec Strider Blog)(Citation: Kaspersky ProjectSauron Blog)
aliases: Strider
ProjectSauron
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
modified: 2024-10-28T19:02:07.114Z
name: Pikabot Distribution February 2024
description: [Pikabot](https://attack.mitre.org/software/S1145) was distributed in [Pikabot Distribution February 2024](https://attack.mitre.org/campaigns/C0036) using malicious emails with embedded links leading to malicious ZIP archives requiring user interaction for follow-on infection. The version of [Pikabot](https://attack.mitre.org/software/S1145) distributed featured significant changes over the 2023 variant, including reduced code complexity and simplified obfuscation mechanisms.(Citation: Elastic Pikabot 2024)(Citation: Zscaler Pikabot 2024)
aliases: Pikabot Distribution February 2024
first_seen: 2024-02-01T05:00:00.000Z
last_seen: 2024-02-01T05:00:00.000Z
x_mitre_first_seen_citation: (Citation: Elastic Pikabot 2024)
x_mitre_last_seen_citation: (Citation: Elastic Pikabot 2024)
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_contributors: Inna Danilevich, U.S. Bank
type: campaign
spec_version: 2.1
id: campaign--81e89fb4-8d07-4d8a-82f4-bf084f9d5d53
created: 2024-07-17T19:42:07.269Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0036
external_id: C0036
source_name: Elastic Pikabot 2024
description: Daniel Stepanic & Salim Bitam. (2024, February 23). PIKABOT, I choose you!. Retrieved July 12, 2024.
url: https://www.elastic.co/security-labs/pikabot-i-choose-you
source_name: Zscaler Pikabot 2024
description: Nikolaos Pantazopoulos. (2024, February 12). The (D)Evolution of Pikabot. Retrieved July 17, 2024.
url: https://www.zscaler.com/blogs/security-research/d-evolution-pikabot
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: enterprise-attack
modified: 2024-04-11T15:10:14.209Z
name: C0033
description: [C0033](https://attack.mitre.org/campaigns/C0033) was a [PROMETHIUM](https://attack.mitre.org/groups/G0056) campaign during which they used [StrongPity](https://attack.mitre.org/software/S0491) to target Android users. [C0033](https://attack.mitre.org/campaigns/C0033) was the first publicly documented mobile campaign for [PROMETHIUM](https://attack.mitre.org/groups/G0056), who previously used Windows-based techniques.(Citation: welivesec_strongpity)
aliases: C0033
first_seen: 2016-05-01T07:00:00.000Z
last_seen: 2023-01-01T08:00:00.000Z
x_mitre_first_seen_citation: (Citation: securelist_strongpity)
x_mitre_last_seen_citation: (Citation: welivesec_strongpity)
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_contributors: Hiroki Nagahama, NEC Corporation
Manikantan Srinivasan, NEC Corporation India
Pooja Natarajan, NEC Corporation India
type: campaign
spec_version: 2.1
id: campaign--a82bc5ad-5f95-4c6a-9f25-aaf6f476a3c4
created: 2024-03-28T18:00:04.123Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0033
external_id: C0033
source_name: securelist_strongpity
description: Baumgartner, K. (2016, October 3). On the StrongPity Waterhole Attacks Targeting Italian and Belgian Encryption Users. Retrieved March 28, 2024.
url: https://securelist.com/on-the-strongpity-waterhole-attacks-targeting-italian-and-belgian-encryption-users/76147/
source_name: welivesec_strongpity
description: Stefanko, L. (2023, January 10). StrongPity espionage campaign targeting Android users. Retrieved January 31, 2023.
url: https://www.welivesecurity.com/2023/01/10/strongpity-espionage-campaign-targeting-android-users/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: mobile-attack
enterprise-attack
type: intrusion-set
spec_version: 2.1
id: intrusion-set--c5574ca0-d5a4-490a-b207-e4658e5fd1d7
created: 2017-05-31T21:32:00.677Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0029
external_id: G0029
source_name: Scarlet Mimic
description: (Citation: Scarlet Mimic Jan 2016)
source_name: Scarlet Mimic Jan 2016
description: Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016.
url: http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:45.222Z
name: Scarlet Mimic
description: [Scarlet Mimic](https://attack.mitre.org/groups/G0029) is a threat group that has targeted minority rights activists. This group has not been directly linked to a government source, but the group's motivations appear to overlap with those of the Chinese government. While there is some overlap between IP addresses used by [Scarlet Mimic](https://attack.mitre.org/groups/G0029) and [Putter Panda](https://attack.mitre.org/groups/G0024), it has not been concluded that the groups are the same. (Citation: Scarlet Mimic Jan 2016)
aliases: Scarlet Mimic
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.2.0
modified: 2024-09-17T17:55:58.333Z
name: TA578
description: [TA578](https://attack.mitre.org/groups/G1038) is a threat actor that has used contact forms and email to initiate communications with victims and to distribute malware including [Latrodectus](https://attack.mitre.org/software/S1160), [IcedID](https://attack.mitre.org/software/S0483), and [Bumblebee](https://attack.mitre.org/software/S1039).(Citation: Latrodectus APR 2024)(Citation: Bitsight Latrodectus June 2024)
aliases: TA578
x_mitre_deprecated: no
x_mitre_version: 1.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--a5cfbc79-316c-42f2-915d-6e8fef4085f8
created: 2024-09-17T17:55:44.833Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1038
external_id: G1038
source_name: Bitsight Latrodectus June 2024
description: Batista, J. (2024, June 17). Latrodectus, are you coming back?. Retrieved September 13, 2024.
url: https://www.bitsight.com/blog/latrodectus-are-you-coming-back
source_name: Latrodectus APR 2024
description: Proofpoint Threat Research and Team Cymru S2 Threat Research. (2024, April 4). Latrodectus: This Spider Bytes Like Ice . Retrieved May 31, 2024.
url: https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: intrusion-set
spec_version: 2.1
id: intrusion-set--d6e88e18-81e8-4709-82d8-973095da1e70
created: 2017-05-31T21:31:56.270Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0023
external_id: G0023
source_name: APT16
description: (Citation: FireEye EPS Awakens Part 2)
source_name: FireEye EPS Awakens Part 2
description: Winters, R. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.
url: https://web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:41.686Z
name: APT16
description: [APT16](https://attack.mitre.org/groups/G0023) is a China-based threat group that has launched spearphishing campaigns targeting Japanese and Taiwanese organizations. (Citation: FireEye EPS Awakens Part 2)
aliases: APT16
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--2e5d3a83-fe00-41a5-9b60-237efc84832f
created: 2017-05-31T21:31:46.025Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0002
external_id: G0002
source_name: Moafee
description: (Citation: Haq 2014)
source_name: Haq 2014
description: Haq, T., Moran, N., Scott, M., & Vashisht, S. O. (2014, September 10). The Path to Mass-Producing Cyber Attacks [Blog]. Retrieved November 12, 2014.
url: https://www.fireeye.com/blog/threat-research/2014/09/the-path-to-mass-producing-cyber-attacks.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:46.105Z
name: Moafee
description: [Moafee](https://attack.mitre.org/groups/G0002) is a threat group that appears to operate from the Guandong Province of China. Due to overlapping TTPs, including similar custom tools, Moafee is thought to have a direct or indirect relationship with the threat group [DragonOK](https://attack.mitre.org/groups/G0017). (Citation: Haq 2014)
aliases: Moafee
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--025bdaa9-897d-4bad-afa6-013ba5734653
created: 2018-01-16T16:13:52.465Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0055
external_id: G0055
source_name: NEODYMIUM
description: (Citation: Microsoft NEODYMIUM Dec 2016) (Citation: Microsoft SIR Vol 21)
source_name: Microsoft NEODYMIUM Dec 2016
description: Microsoft. (2016, December 14). Twin zero-day attacks: PROMETHIUM and NEODYMIUM target individuals in Europe. Retrieved November 27, 2017.
url: https://blogs.technet.microsoft.com/mmpc/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/
source_name: Microsoft SIR Vol 21
description: Anthe, C. et al. (2016, December 14). Microsoft Security Intelligence Report Volume 21. Retrieved November 27, 2017.
url: http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf
source_name: CyberScoop BlackOasis Oct 2017
description: Bing, C. (2017, October 16). Middle Eastern hacking group is using FinFisher malware to conduct international espionage. Retrieved February 15, 2018.
url: https://www.cyberscoop.com/middle-eastern-hacking-group-using-finfisher-malware-conduct-international-espionage/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:46.469Z
name: NEODYMIUM
description: [NEODYMIUM](https://attack.mitre.org/groups/G0055) is an activity group that conducted a campaign in May 2016 and has heavily targeted Turkish victims. The group has demonstrated similarity to another activity group called [PROMETHIUM](https://attack.mitre.org/groups/G0056) due to overlapping victim and campaign characteristics. (Citation: Microsoft NEODYMIUM Dec 2016) (Citation: Microsoft SIR Vol 21) [NEODYMIUM](https://attack.mitre.org/groups/G0055) is reportedly associated closely with [BlackOasis](https://attack.mitre.org/groups/G0063) operations, but evidence that the group names are aliases has not been identified. (Citation: CyberScoop BlackOasis Oct 2017)
aliases: NEODYMIUM
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
modified: 2024-11-17T16:27:34.666Z
name: DragonOK
description: [DragonOK](https://attack.mitre.org/groups/G0017) is a threat group that has targeted Japanese organizations with phishing emails. Due to overlapping TTPs, including similar custom tools, [DragonOK](https://attack.mitre.org/groups/G0017) is thought to have a direct or indirect relationship with the threat group [Moafee](https://attack.mitre.org/groups/G0002). (Citation: Operation Quantum Entanglement) It is known to use a variety of malware, including Sysget/HelloBridge, PlugX, PoisonIvy, FormerFirstRat, NFlog, and NewCT. (Citation: New DragonOK)
aliases: DragonOK
x_mitre_deprecated: no
x_mitre_version: 1.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--f3bdec95-3d62-42d9-a840-29630f6cdc1a
created: 2017-05-31T21:31:53.197Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0017
external_id: G0017
source_name: DragonOK
description: (Citation: Operation Quantum Entanglement) (Citation: New DragonOK)
source_name: Operation Quantum Entanglement
description: Haq, T., Moran, N., Vashisht, S., Scott, M. (2014, September). OPERATION QUANTUM ENTANGLEMENT. Retrieved November 17, 2024.
url: https://web.archive.org/web/20210920193513/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-quantum-entanglement.pdf
source_name: New DragonOK
description: Miller-Osborn, J., Grunzweig, J.. (2015, April). Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese Targets. Retrieved November 4, 2015.
url: http://researchcenter.paloaltonetworks.com/2015/04/unit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: intrusion-set
spec_version: 2.1
id: intrusion-set--59140a2e-d117-4206-9b2c-2a8662bd9d46
created: 2017-05-31T21:31:52.018Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0015
external_id: G0015
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T17:59:28.548Z
name: Taidoor
description: [Taidoor](https://attack.mitre.org/groups/G0015) has been deprecated, as the only technique it was linked to was deprecated in ATT&CK v7.
aliases: Taidoor
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--9559ecaf-2e75-48a7-aee8-9974020bc772
created: 2017-05-31T21:32:07.928Z
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0042
external_id: G0042
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:59.530Z
name: MONSOON
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0