auren-research/cyber-sec huggingface dataset:
type: malware
spec_version: 2.1
id: malware--50c44c34-3abb-48ae-9433-a2337de5b0bc
created: 2023-02-28T20:50:36.164Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1068
external_id: S1068
source_name: Noberus
description: (Citation: ACSC BlackCat Apr 2022)
source_name: ALPHV
description: (Citation: Microsoft BlackCat Jun 2022)(Citation: ACSC BlackCat Apr 2022)
source_name: ACSC BlackCat Apr 2022
description: Australian Cyber Security Centre. (2022, April 14). 2022-004: ACSC Ransomware Profile - ALPHV (aka BlackCat). Retrieved December 20, 2022.
url: https://www.cyber.gov.au/about-us/advisories/2022-004-acsc-ransomware-profile-alphv-aka-blackcat
source_name: Sophos BlackCat Jul 2022
description: Brandt, Andrew. (2022, July 14). BlackCat ransomware attacks not merely a byproduct of bad luck. Retrieved December 20, 2022.
url: https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/
source_name: Microsoft BlackCat Jun 2022
description: Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.
url: https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:28:37.027Z
name: BlackCat
description: [BlackCat](https://attack.mitre.org/software/S1068) is ransomware written in Rust that has been offered via the Ransomware-as-a-Service (RaaS) model. First observed November 2021, [BlackCat](https://attack.mitre.org/software/S1068) has been used to target multiple sectors and organizations in various countries and regions in Africa, the Americas, Asia, Australia, and Europe.(Citation: Microsoft BlackCat Jun 2022)(Citation: Sophos BlackCat Jul 2022)(Citation: ACSC BlackCat Apr 2022)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.3.0
x_mitre_contributors: Hiroki Nagahama, NEC Corporation
Josh Arenas, Trustwave Spiderlabs
Manikantan Srinivasan, NEC Corporation India
Pooja Natarajan, NEC Corporation India
x_mitre_aliases: BlackCat
ALPHV
Noberus
modified: 2024-04-11T02:29:45.766Z
name: Fysbis
description: [Fysbis](https://attack.mitre.org/software/S0410) is a Linux-based backdoor used by [APT28](https://attack.mitre.org/groups/G0007) that dates back to at least 2014.(Citation: Fysbis Palo Alto Analysis)
is_family: yes
x_mitre_platforms: Linux
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.4
x_mitre_aliases: Fysbis
type: malware
spec_version: 2.1
id: malware--50d6688b-0985-4f3d-8cbe-0c796b30703b
created: 2019-09-12T17:40:38.303Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0410
external_id: S0410
source_name: Fysbis Palo Alto Analysis
description: Bryan Lee and Rob Downs. (2016, February 12). A Look Into Fysbis: Sofacy’s Linux Backdoor. Retrieved September 10, 2017.
url: https://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--5147ef15-1cae-4707-8ea1-bee8d98b7f1d
created: 2020-07-15T17:55:11.252Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0483
external_id: S0483
source_name: IBM IcedID November 2017
description: Kessem, L., et al. (2017, November 13). New Banking Trojan IcedID Discovered by IBM X-Force Research. Retrieved July 14, 2020.
url: https://securityintelligence.com/new-banking-trojan-icedid-discovered-by-ibm-x-force-research/
source_name: Juniper IcedID June 2020
description: Kimayong, P. (2020, June 18). COVID-19 and FMLA Campaigns used to install new IcedID banking malware. Retrieved July 14, 2020.
url: https://blogs.juniper.net/en-us/threat-research/covid-19-and-fmla-campaigns-used-to-install-new-icedid-banking-malware
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-22T22:16:09.049Z
name: IcedID
description: [IcedID](https://attack.mitre.org/software/S0483) is a modular banking malware designed to steal financial information that has been observed in the wild since at least 2017. [IcedID](https://attack.mitre.org/software/S0483) has been downloaded by [Emotet](https://attack.mitre.org/software/S0367) in multiple campaigns.(Citation: IBM IcedID November 2017)(Citation: Juniper IcedID June 2020)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Jorge Orchilles
Zaw Min Htun, @Z3TAE
Matt Brenton, Zurich Global Information Security
x_mitre_aliases: IcedID
modified: 2024-04-10T22:17:02.480Z
name: VERMIN
description: [VERMIN](https://attack.mitre.org/software/S0257) is a remote access tool written in the Microsoft .NET framework. It is mostly composed of original code, but also has some open source code. (Citation: Unit 42 VERMIN Jan 2018)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_aliases: VERMIN
type: malware
spec_version: 2.1
id: malware--5189f018-fea2-45d7-b0ed-23f9ee0a46f3
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0257
external_id: S0257
source_name: VERMIN
description: (Citation: Unit 42 VERMIN Jan 2018)
source_name: Unit 42 VERMIN Jan 2018
description: Lancaster, T., Cortes, J. (2018, January 29). VERMIN: Quasar RAT and Custom Malware Used In Ukraine. Retrieved July 5, 2018.
url: https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-04-10T22:22:03.759Z
name: UBoatRAT
description: [UBoatRAT](https://attack.mitre.org/software/S0333) is a remote access tool that was identified in May 2017.(Citation: PaloAlto UBoatRAT Nov 2017)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_aliases: UBoatRAT
type: malware
spec_version: 2.1
id: malware--518bb5f1-91f4-4ff2-b09d-5a94e1ebe95f
created: 2019-01-29T19:09:26.355Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0333
external_id: S0333
source_name: UBoatRAT
description: (Citation: PaloAlto UBoatRAT Nov 2017)
source_name: PaloAlto UBoatRAT Nov 2017
description: Hayashi, K. (2017, November 28). UBoatRAT Navigates East Asia. Retrieved January 12, 2018.
url: https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--51f78dfc-52f9-424e-8753-bb4246188313
created: 2024-07-25T22:12:08.779Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1147
external_id: S1147
source_name: ESET EvasivePanda 2024
description: Ahn Ho, Facundo Muñoz, & Marc-Etienne M.Léveillé. (2024, March 7). Evasive Panda leverages Monlam Festival to target Tibetans. Retrieved July 25, 2024.
url: https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/
source_name: Symantec Daggerfly 2024
description: Threat Hunter Team. (2024, July 23). Daggerfly: Espionage Group Makes Major Update to Toolset. Retrieved July 25, 2024.
url: https://symantec-enterprise-blogs.security.com/threat-intelligence/daggerfly-espionage-updated-toolset
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T23:09:37.402Z
name: Nightdoor
description: [Nightdoor](https://attack.mitre.org/software/S1147) is a backdoor exclusively associated with [Daggerfly](https://attack.mitre.org/groups/G1034) operations. [Nightdoor](https://attack.mitre.org/software/S1147) uses common libraries with [MgBot](https://attack.mitre.org/software/S1146) and [MacMa](https://attack.mitre.org/software/S1016), linking these malware families together.(Citation: ESET EvasivePanda 2024)(Citation: Symantec Daggerfly 2024)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.3.0
x_mitre_aliases: Nightdoor
type: malware
spec_version: 2.1
id: malware--532c6004-b1e8-415b-9516-f7c14ba783b1
created: 2021-09-28T17:48:36.547Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0652
external_id: S0652
source_name: Kaspersky Ferocious Kitten Jun 2021
description: GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.
url: https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:43:19.128Z
name: MarkiRAT
description: [MarkiRAT](https://attack.mitre.org/software/S0652) is a remote access Trojan (RAT) compiled with Visual Studio that has been used by [Ferocious Kitten](https://attack.mitre.org/groups/G0137) since at least 2015.(Citation: Kaspersky Ferocious Kitten Jun 2021)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Pooja Natarajan, NEC Corporation India
Manikantan Srinivasan, NEC Corporation India
Hiroki Nagahama, NEC Corporation
x_mitre_aliases: MarkiRAT
type: malware
spec_version: 2.1
id: malware--53486bc7-7748-4716-8190-e4f1fde04c53
created: 2020-05-08T19:27:12.414Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0441
external_id: S0441
source_name: Unit 42 Inception November 2018
description: Lancaster, T. (2018, November 5). Inception Attackers Target Europe with Year-old Office Vulnerability. Retrieved May 8, 2020.
url: https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/
source_name: Kaspersky Cloud Atlas August 2019
description: GReAT. (2019, August 12). Recent Cloud Atlas activity. Retrieved May 8, 2020.
url: https://securelist.com/recent-cloud-atlas-activity/92016/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:43:19.493Z
name: PowerShower
description: [PowerShower](https://attack.mitre.org/software/S0441) is a PowerShell backdoor used by [Inception](https://attack.mitre.org/groups/G0100) for initial reconnaissance and to download and execute second stage payloads.(Citation: Unit 42 Inception November 2018)(Citation: Kaspersky Cloud Atlas August 2019)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: PowerShower
type: malware
spec_version: 2.1
id: malware--536be338-e2ef-4a6b-afb6-8d5568b91eb2
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0265
external_id: S0265
source_name: Kazuar
description: (Citation: Unit 42 Kazuar May 2017)
source_name: Unit 42 Kazuar May 2017
description: Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.
url: https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T23:25:05.477Z
name: Kazuar
description: [Kazuar](https://attack.mitre.org/software/S0265) is a fully featured, multi-platform backdoor Trojan written using the Microsoft .NET framework. (Citation: Unit 42 Kazuar May 2017)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
macOS
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.4
x_mitre_attack_spec_version: 3.3.0
x_mitre_aliases: Kazuar
type: malware
spec_version: 2.1
id: malware--53a42597-1974-4b8e-84fd-3675e8992053
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0247
external_id: S0247
source_name: NavRAT
description: (Citation: Talos NavRAT May 2018)
source_name: Talos NavRAT May 2018
description: Mercer, W., Rascagneres, P. (2018, May 31). NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea. Retrieved June 11, 2018.
url: https://blog.talosintelligence.com/2018/05/navrat.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:43:20.237Z
name: NavRAT
description: [NavRAT](https://attack.mitre.org/software/S0247) is a remote access tool designed to upload, download, and execute files. It has been observed in attacks targeting South Korea. (Citation: Talos NavRAT May 2018)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: NavRAT
type: malware
spec_version: 2.1
id: malware--53ab35c2-d00e-491a-8753-41d35ae7e547
created: 2019-01-29T19:18:28.468Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0334
external_id: S0334
source_name: DarkComet
description: (Citation: TrendMicro DarkComet Sept 2014)
source_name: DarkKomet
description: (Citation: TrendMicro DarkComet Sept 2014)
source_name: Fynloski
description: (Citation: TrendMicro DarkComet Sept 2014)
source_name: Krademok
description: (Citation: TrendMicro DarkComet Sept 2014)
source_name: FYNLOS
description: (Citation: TrendMicro DarkComet Sept 2014)
source_name: TrendMicro DarkComet Sept 2014
description: TrendMicro. (2014, September 03). DARKCOMET. Retrieved November 6, 2018.
url: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/DARKCOMET
source_name: Malwarebytes DarkComet March 2018
description: Kujawa, A. (2018, March 27). You dirty RAT! Part 1: DarkComet. Retrieved November 6, 2018.
url: https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:43:20.605Z
name: DarkComet
description: [DarkComet](https://attack.mitre.org/software/S0334) is a Windows remote administration tool and backdoor.(Citation: TrendMicro DarkComet Sept 2014)(Citation: Malwarebytes DarkComet March 2018)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: DarkComet
DarkKomet
Fynloski
Krademok
FYNLOS
modified: 2024-11-17T15:05:25.106Z
name: NETEAGLE
description: [NETEAGLE](https://attack.mitre.org/software/S0034) is a backdoor developed by [APT30](https://attack.mitre.org/groups/G0013) with compile dates as early as 2008. It has two main variants known as “Scout” and “Norton.” (Citation: FireEye APT30)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_aliases: NETEAGLE
type: malware
spec_version: 2.1
id: malware--53cf6cc4-65aa-445a-bcf8-c3d296f8a7a2
created: 2017-05-31T21:32:27.787Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0034
external_id: S0034
source_name: FireEye APT30
description: FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024.
url: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-11-17T15:01:33.389Z
name: POORAIM
description: [POORAIM](https://attack.mitre.org/software/S0216) is a backdoor used by [APT37](https://attack.mitre.org/groups/G0067) in campaigns since at least 2014. (Citation: FireEye APT37 Feb 2018)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_aliases: POORAIM
type: malware
spec_version: 2.1
id: malware--53d47b09-09c2-4015-8d37-6633ecd53f79
created: 2018-04-18T17:59:24.739Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0216
external_id: S0216
source_name: POORAIM
description: (Citation: FireEye APT37 Feb 2018)
source_name: FireEye APT37 Feb 2018
description: FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.
url: https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-01-02T20:44:36.518Z
name: HUI Loader
description: [HUI Loader](https://attack.mitre.org/software/S1097) is a custom DLL loader that has been used since at least 2015 by China-based threat groups including [Cinnamon Tempest](https://attack.mitre.org/groups/G1021) and [menuPass](https://attack.mitre.org/groups/G0045) to deploy malware on compromised hosts. [HUI Loader](https://attack.mitre.org/software/S1097) has been observed in campaigns loading [SodaMaster](https://attack.mitre.org/software/S0627), [PlugX](https://attack.mitre.org/software/S0013), [Cobalt Strike](https://attack.mitre.org/software/S0154), [Komplex](https://attack.mitre.org/software/S0162), and several strains of ransomware.(Citation: SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_aliases: HUI Loader
type: malware
spec_version: 2.1
id: malware--54089fba-8662-4f37-9a44-6ad25a5f630a
created: 2023-12-22T20:03:48.505Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1097
external_id: S1097
source_name: SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022
description: Counter Threat Unit Research Team . (2022, June 23). BRONZE STARLIGHT RANSOMWARE OPERATIONS USE HUI LOADER. Retrieved December 7, 2023.
url: https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-08-09T17:29:21.238Z
name: CHIMNEYSWEEP
description: [CHIMNEYSWEEP](https://attack.mitre.org/software/S1149) is a backdoor malware that was deployed during [HomeLand Justice](https://attack.mitre.org/campaigns/C0038) along with [ROADSWEEP](https://attack.mitre.org/software/S1150) ransomware, and has been used to target Farsi and Arabic speakers since at least 2012.(Citation: Mandiant ROADSWEEP August 2022)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_aliases: CHIMNEYSWEEP
type: malware
spec_version: 2.1
id: malware--542e3384-341a-455b-bb48-4917b25e3b00
created: 2024-08-07T20:03:17.762Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1149
external_id: S1149
source_name: Mandiant ROADSWEEP August 2022
description: Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.
url: https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--54895630-efd2-4608-9c24-319de972a9eb
created: 2020-06-29T23:30:53.824Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0481
external_id: S0481
source_name: Cynet Ragnar Apr 2020
description: Gold, B. (2020, April 27). Cynet Detection Report: Ragnar Locker Ransomware. Retrieved June 29, 2020.
url: https://www.cynet.com/blog/cynet-detection-report-ragnar-locker-ransomware/
source_name: Sophos Ragnar May 2020
description: SophosLabs. (2020, May 21). Ragnar Locker ransomware deploys virtual machine to dodge security. Retrieved June 29, 2020.
url: https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:08.233Z
name: Ragnar Locker
description: [Ragnar Locker](https://attack.mitre.org/software/S0481) is a ransomware that has been in use since at least December 2019.(Citation: Sophos Ragnar May 2020)(Citation: Cynet Ragnar Apr 2020)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Ragnar Locker