auren-research/cyber-sec huggingface dataset:
modified: 2025-04-02T20:34:59.728Z
name: Elise
description: [Elise](https://attack.mitre.org/software/S0081) is a custom backdoor Trojan that appears to be used exclusively by [Lotus Blossom](https://attack.mitre.org/groups/G0030). It is part of a larger group of tools referred to as LStudio, ST Group, and APT0LSTU.(Citation: Lotus Blossom Jun 2015)(Citation: Accenture Dragonfish Jan 2018)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.3
x_mitre_aliases: Elise
BKDR_ESILE
Page
type: malware
spec_version: 2.1
id: malware--7551188b-8f91-4d34-8350-0d0c57b2b913
created: 2017-05-31T21:32:54.416Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0081
external_id: S0081
source_name: Elise
description: (Citation: Accenture Dragonfish Jan 2018)
source_name: BKDR_ESILE
description: (Citation: Lotus Blossom Jun 2015)
source_name: Page
description: (Citation: Lotus Blossom Jun 2015)
source_name: Accenture Dragonfish Jan 2018
description: Accenture Security. (2018, January 27). DRAGONFISH DELIVERS NEW FORM OF ELISE MALWARE TARGETING ASEAN DEFENCE MINISTERS’ MEETING AND ASSOCIATES. Retrieved November 17, 2024.
url: https://web.archive.org/web/20190508165226/https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf
source_name: Lotus Blossom Jun 2015
description: Falcone, R., et al.. (2015, June 16). Operation Lotus Blossom. Retrieved February 15, 2016.
url: https://www.paloaltonetworks.com/resources/research/unit42-operation-lotus-blossom.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--75bba379-4ba1-467e-8c60-ec2b269ee984
created: 2020-05-20T19:54:06.476Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0452
external_id: S0452
source_name: TrendMicro Tropic Trooper May 2020
description: Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.
url: https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:43:47.313Z
name: USBferry
description: [USBferry](https://attack.mitre.org/software/S0452) is an information stealing malware and has been used by [Tropic Trooper](https://attack.mitre.org/groups/G0081) in targeted attacks against Taiwanese and Philippine air-gapped military environments. [USBferry](https://attack.mitre.org/software/S0452) shares an overlapping codebase with [YAHOYAH](https://attack.mitre.org/software/S0388), though it has several features which makes it a distinct piece of malware.(Citation: TrendMicro Tropic Trooper May 2020)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: USBferry
modified: 2024-12-09T02:29:13.859Z
name: WannaCry
description: [WannaCry](https://attack.mitre.org/software/S0366) is ransomware that was first seen in a global attack during May 2017, which affected more than 150 countries. It contains worm-like features to spread itself across a computer network using the SMBv1 exploit EternalBlue.(Citation: LogRhythm WannaCry)(Citation: US-CERT WannaCry 2017)(Citation: Washington Post WannaCry 2017)(Citation: FireEye WannaCry 2017)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
ics-attack
x_mitre_version: 1.1
x_mitre_contributors: Jan Miller, CrowdStrike
x_mitre_aliases: WannaCry
WanaCry
WanaCrypt
WanaCrypt0r
WCry
type: malware
spec_version: 2.1
id: malware--75ecdbf1-c2bb-4afc-a3f9-c8da4de8c661
created: 2019-03-25T17:30:17.004Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0366
external_id: S0366
source_name: WanaCrypt0r
description: (Citation: LogRhythm WannaCry)
source_name: WCry
description: (Citation: LogRhythm WannaCry)(Citation: SecureWorks WannaCry Analysis)
source_name: WanaCry
description: (Citation: SecureWorks WannaCry Analysis)
source_name: WanaCrypt
description: (Citation: SecureWorks WannaCry Analysis)
source_name: FireEye WannaCry 2017
description: Berry, A., Homan, J., and Eitzman, R. (2017, May 23). WannaCry Malware Profile. Retrieved March 15, 2019.
url: https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html
source_name: SecureWorks WannaCry Analysis
description: Counter Threat Unit Research Team. (2017, May 18). WCry Ransomware Analysis. Retrieved March 26, 2019.
url: https://www.secureworks.com/research/wcry-ransomware-analysis
source_name: Washington Post WannaCry 2017
description: Dwoskin, E. and Adam, K. (2017, May 14). More than 150 countries affected by massive cyberattack, Europol says. Retrieved March 25, 2019.
url: https://www.washingtonpost.com/business/economy/more-than-150-countries-affected-by-massive-cyberattack-europol-says/2017/05/14/5091465e-3899-11e7-9e48-c4f199710b69_story.html?utm_term=.7fa16b41cad4
source_name: LogRhythm WannaCry
description: Noerenberg, E., Costis, A., and Quist, N. (2017, May 16). A Technical Analysis of WannaCry Ransomware. Retrieved December 8, 2024.
url: https://web.archive.org/web/20230522041200/https://logrhythm.com/blog/a-technical-analysis-of-wannacry-ransomware/
source_name: US-CERT WannaCry 2017
description: US-CERT. (2017, May 12). Alert (TA17-132A): Indicators Associated With WannaCry Ransomware. Retrieved March 25, 2019.
url: https://www.us-cert.gov/ncas/alerts/TA17-132A
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-04-11T02:28:51.206Z
name: Gazer
description: [Gazer](https://attack.mitre.org/software/S0168) is a backdoor used by [Turla](https://attack.mitre.org/groups/G0010) since at least 2016. (Citation: ESET Gazer Aug 2017)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.3
x_mitre_contributors: Bartosz Jerzman
x_mitre_aliases: Gazer
WhiteBear
type: malware
spec_version: 2.1
id: malware--76abb3ef-dafd-4762-97cb-a35379429db4
created: 2018-01-16T16:13:52.465Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0168
external_id: S0168
source_name: Gazer
description: (Citation: ESET Gazer Aug 2017)
source_name: ESET Gazer Aug 2017
description: ESET. (2017, August). Gazing at Gazer: Turla’s new second stage backdoor. Retrieved September 14, 2017.
url: https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf
source_name: ESET Crutch December 2020
description: Faou, M. (2020, December 2). Turla Crutch: Keeping the “back door” open. Retrieved December 4, 2020.
url: https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/
source_name: Securelist WhiteBear Aug 2017
description: Kaspersky Lab's Global Research & Analysis Team. (2017, August 30). Introducing WhiteBear. Retrieved September 21, 2017.
url: https://securelist.com/introducing-whitebear/81638/
source_name: WhiteBear
description: The term WhiteBear is used both for the activity group (a subset of G0010) as well as the malware observed. Based on similarities in behavior and C2, WhiteBear is assessed to be the same as S0168. (Citation: Securelist WhiteBear Aug 2017)(Citation: ESET Crutch December 2020)
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--76ac7989-c5cc-42e2-93e3-d6c476f01ace
created: 2020-05-06T15:43:49.556Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0436
external_id: S0436
source_name: JPCert PLEAD Downloader June 2018
description: Tomonaga, S. (2018, June 8). PLEAD Downloader Used by BlackTech. Retrieved May 6, 2020.
url: https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html
source_name: JPCert TSCookie March 2018
description: Tomonaga, S. (2018, March 6). Malware “TSCookie”. Retrieved May 6, 2020.
url: https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html
source_name: JPCert BlackTech Malware September 2019
description: Tomonaga, S.. (2019, September 18). Malware Used by BlackTech after Network Intrusion. Retrieved May 6, 2020.
url: https://blogs.jpcert.or.jp/en/2019/09/tscookie-loader.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:18.117Z
name: TSCookie
description: [TSCookie](https://attack.mitre.org/software/S0436) is a remote access tool (RAT) that has been used by [BlackTech](https://attack.mitre.org/groups/G0098) in campaigns against Japanese targets.(Citation: JPCert TSCookie March 2018)(Citation: JPCert BlackTech Malware September 2019). [TSCookie](https://attack.mitre.org/software/S0436) has been referred to as [PLEAD](https://attack.mitre.org/software/S0435) though more recent reporting indicates a separation between the two.(Citation: JPCert PLEAD Downloader June 2018)(Citation: JPCert BlackTech Malware September 2019)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Tatsuya Daitoku, Cyber Defense Institute, Inc.
x_mitre_aliases: TSCookie
modified: 2024-09-30T17:59:30.330Z
name: Latrodectus
description: [Latrodectus](https://attack.mitre.org/software/S1160) is a Windows malware downloader that has been used since at least 2023 to download and execute additional payloads and modules. [Latrodectus](https://attack.mitre.org/software/S1160) has most often been distributed through email campaigns, primarily by [TA577](https://attack.mitre.org/groups/G1037) and [TA578](https://attack.mitre.org/groups/G1038), and has infrastructure overlaps with historic [IcedID](https://attack.mitre.org/software/S0483) operations.(Citation: Latrodectus APR 2024)(Citation: Bleeping Computer Latrodectus April 2024)(Citation: Bitsight Latrodectus June 2024)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_contributors: Riku Katsuse, NEC Corporation
Sareena Karapoola, NEC Corporation India
Pooja Natarajan, NEC Corporation India
Cris Tomboc, Truswave SpiderLabs
x_mitre_aliases: Latrodectus
IceNova
Unidentified 111
type: malware
spec_version: 2.1
id: malware--76fde8df-3495-47c9-82eb-125c4f7fb621
created: 2024-09-16T18:47:30.547Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1160
external_id: S1160
source_name: IceNova
description: (Citation: Bleeping Computer Latrodectus April 2024)
source_name: Unidentified 111
description: (Citation: Bleeping Computer Latrodectus April 2024)
source_name: Bleeping Computer Latrodectus April 2024
description: Abrams, L. (2024, April 30). New Latrodectus malware attacks use Microsoft, Cloudflare themes. Retrieved September 13, 2024.
url: https://www.bleepingcomputer.com/news/security/new-latrodectus-malware-attacks-use-microsoft-cloudflare-themes/
source_name: Bitsight Latrodectus June 2024
description: Batista, J. (2024, June 17). Latrodectus, are you coming back?. Retrieved September 13, 2024.
url: https://www.bitsight.com/blog/latrodectus-are-you-coming-back
source_name: Latrodectus APR 2024
description: Proofpoint Threat Research and Team Cymru S2 Threat Research. (2024, April 4). Latrodectus: This Spider Bytes Like Ice . Retrieved May 31, 2024.
url: https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-10-08T20:10:44.570Z
name: Saint Bot
description: [Saint Bot](https://attack.mitre.org/software/S1018) is a .NET downloader that has been used by [Saint Bear](https://attack.mitre.org/groups/G1031) since at least March 2021.(Citation: Malwarebytes Saint Bot April 2021)(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_aliases: Saint Bot
type: malware
spec_version: 2.1
id: malware--7724581b-06ff-4d2b-b77c-80dc8d53070b
created: 2022-06-09T18:50:58.722Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1018
external_id: S1018
source_name: Malwarebytes Saint Bot April 2021
description: Hasherezade. (2021, April 6). A deep dive into Saint Bot, a new downloader. Retrieved June 9, 2022.
url: https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/
source_name: Palo Alto Unit 42 OutSteel SaintBot February 2022 
description: Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
url: https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--77ca1aa3-280c-4b67-abaa-e8fb891a8f83
created: 2021-01-04T15:12:14.805Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0556
external_id: S0556
source_name: ClearkSky Fox Kitten February 2020
description: ClearSky. (2020, February 16). Fox Kitten – Widespread Iranian Espionage-Offensive Campaign. Retrieved December 21, 2020.
url: https://www.clearskysec.com/fox-kitten/
source_name: Check Point Pay2Key November 2020
description: Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021.
url: https://research.checkpoint.com/2020/ransomware-alert-pay2key/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:43:48.585Z
name: Pay2Key
description: [Pay2Key](https://attack.mitre.org/software/S0556) is a ransomware written in C++ that has been used by [Fox Kitten](https://attack.mitre.org/groups/G0117) since at least July 2020 including campaigns against Israeli companies. [Pay2Key](https://attack.mitre.org/software/S0556) has been incorporated with a leak site to display stolen sensitive information to further pressure victims into payment.(Citation: ClearkSky Fox Kitten February 2020)(Citation: Check Point Pay2Key November 2020)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Pay2Key
type: malware
spec_version: 2.1
id: malware--77e0ecf7-ca91-4c06-8012-8e728986a87a
created: 2021-06-30T16:13:40.232Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0631
external_id: S0631
source_name: Chaes
description: (Citation: Cybereason Chaes Nov 2020)
source_name: Cybereason Chaes Nov 2020
description: Salem, E. (2020, November 17). CHAES: Novel Malware Targeting Latin American E-Commerce. Retrieved June 30, 2021.
url: https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:18.426Z
name: Chaes
description: [Chaes](https://attack.mitre.org/software/S0631) is a multistage information stealer written in several programming languages that collects login credentials, credit card numbers, and other financial information. [Chaes](https://attack.mitre.org/software/S0631) was first observed in 2020, and appears to primarily target victims in Brazil as well as other e-commerce customers in Latin America.(Citation: Cybereason Chaes Nov 2020)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Daniyal Naeem, BT Security
x_mitre_aliases: Chaes
modified: 2024-11-17T19:55:07.590Z
name: Briba
description: [Briba](https://attack.mitre.org/software/S0204) is a trojan used by [Elderwood](https://attack.mitre.org/groups/G0066) to open a backdoor and download files on to compromised hosts. (Citation: Symantec Elderwood Sept 2012) (Citation: Symantec Briba May 2012)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_aliases: Briba
type: malware
spec_version: 2.1
id: malware--79499993-a8d6-45eb-b343-bf58dea5bdde
created: 2018-04-18T17:59:24.739Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0204
external_id: S0204
source_name: Briba
description: (Citation: Symantec Briba May 2012)
source_name: Symantec Briba May 2012
description: Ladley, F. (2012, May 15). Backdoor.Briba. Retrieved February 21, 2018.
url: https://www.symantec.com/security_response/writeup.jsp?docid=2012-051515-2843-99
source_name: Symantec Elderwood Sept 2012
description: O'Gorman, G., and McDonald, G.. (2012, September 6). The Elderwood Project. Retrieved November 17, 2024.
url: https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--7acb15b6-fe2c-4319-b136-6ab36ff0b2d4
created: 2022-01-24T16:56:36.108Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0674
external_id: S0674
source_name: Check Point APT35 CharmPower January 2022
description: Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022.
url: https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-06-06T14:12:30.197Z
name: CharmPower
description: [CharmPower](https://attack.mitre.org/software/S0674) is a PowerShell-based, modular backdoor that has been used by [Magic Hound](https://attack.mitre.org/groups/G0059) since at least 2022.(Citation: Check Point APT35 CharmPower January 2022)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: CharmPower
modified: 2024-04-10T22:26:03.638Z
name: TYPEFRAME
description: [TYPEFRAME](https://attack.mitre.org/software/S0263) is a remote access tool that has been used by [Lazarus Group](https://attack.mitre.org/groups/G0032). (Citation: US-CERT TYPEFRAME June 2018)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.3
x_mitre_aliases: TYPEFRAME
type: malware
spec_version: 2.1
id: malware--7ba0fc46-197d-466d-8b9f-f1c64d5d81e5
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0263
external_id: S0263
source_name: TYPEFRAME
description: (Citation: US-CERT TYPEFRAME June 2018)
source_name: US-CERT TYPEFRAME June 2018
description: US-CERT. (2018, June 14). MAR-10135536-12 – North Korean Trojan: TYPEFRAME. Retrieved July 13, 2018.
url: https://www.us-cert.gov/ncas/analysis-reports/AR18-165A
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--7bec698a-7e20-4fd3-bb6a-12787770fb1a
created: 2017-05-31T21:32:44.131Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0066
external_id: S0066
source_name: CrowdStrike Putter Panda
description: Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.
url: http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:43:49.838Z
name: 3PARA RAT
description: [3PARA RAT](https://attack.mitre.org/software/S0066) is a remote access tool (RAT) programmed in C++ that has been used by [Putter Panda](https://attack.mitre.org/groups/G0024). (Citation: CrowdStrike Putter Panda)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: 3PARA RAT
type: malware
spec_version: 2.1
id: malware--7bef1b56-4870-4e74-b32a-7dd88c390c44
created: 2020-07-01T19:34:28.366Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0482
external_id: S0482
source_name: OSX.Bundlore
description: (Citation: MacKeeper Bundlore Apr 2019)
source_name: MacKeeper Bundlore Apr 2019
description: Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.
url: https://mackeeper.com/blog/post/610-macos-bundlore-adware-analysis/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:43:50.199Z
name: Bundlore
description: [Bundlore](https://attack.mitre.org/software/S0482) is adware written for macOS that has been in use since at least 2015. Though categorized as adware, [Bundlore](https://attack.mitre.org/software/S0482) has many features associated with more traditional backdoors.(Citation: MacKeeper Bundlore Apr 2019)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: macOS
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Bundlore
OSX.Bundlore