auren-research/cyber-sec huggingface dataset:
modified: 2025-03-27T21:19:26.432Z
name: FLORAHOX Activity
description: [FLORAHOX Activity](https://attack.mitre.org/campaigns/C0053) is conducted using a hybrid operational relay box (ORB) network, which combines two types of infrastructure: compromised devices and leased Virtual Private Servers (VPS). The compromised devices include end-of-life routers and IoT devices, while VPS space is commercially leased and managed by ORB network administrators. This hybrid ORB network allows adversaries to proxy and obscure malicious traffic, making the source of the traffic more difficult to trace.

The FLORAHOX ORB network has been leveraged by multiple cyber threat actors, including China-nexus actors like [ZIRCONIUM](https://attack.mitre.org/groups/G0128). These adversaries conduct espionage campaigns through [FLORAHOX Activity](https://attack.mitre.org/campaigns/C0053), relying on the ORB network's ability to funnel traffic through [Tor](https://attack.mitre.org/software/S0183) nodes, provisioned VPS servers, and compromised routers to obfuscate malicious traffic.(Citation: ORB Mandiant)
aliases: FLORAHOX Activity
first_seen: 2019-01-01T05:00:00.000Z
last_seen: 2024-05-01T04:00:00.000Z
x_mitre_first_seen_citation: (Citation: ORB Mandiant)
x_mitre_last_seen_citation: (Citation: ORB Mandiant)
x_mitre_deprecated: no
x_mitre_version: 1.0
type: campaign
spec_version: 2.1
id: campaign--f494272a-c110-4574-be90-42c4957f7ae7
created: 2025-03-25T22:45:13.091Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0053
external_id: C0053
source_name: ORB Mandiant
description: Raggi, Michael. (2024, May 22). IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders. Retrieved July 8, 2024.
url: https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-orb-networks
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: enterprise-attack
modified: 2024-11-17T15:50:27.600Z
name: Molerats
description: [Molerats](https://attack.mitre.org/groups/G0021) is an Arabic-speaking, politically-motivated threat group that has been operating since 2012. The group's victims have primarily been in the Middle East, Europe, and the United States.(Citation: DustySky)(Citation: DustySky2)(Citation: Kaspersky MoleRATs April 2019)(Citation: Cybereason Molerats Dec 2020)
aliases: Molerats
Operation Molerats
Gaza Cybergang
x_mitre_deprecated: no
x_mitre_version: 2.1
type: intrusion-set
spec_version: 2.1
id: intrusion-set--df71bb3b-813c-45eb-a8bc-f2a419837411
created: 2017-05-31T21:31:55.093Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0021
external_id: G0021
source_name: Molerats
description: (Citation: DustySky)
source_name: Gaza Cybergang
description: (Citation: DustySky)(Citation: Kaspersky MoleRATs April 2019)(Citation: Cybereason Molerats Dec 2020)
source_name: Operation Molerats
description: (Citation: FireEye Operation Molerats)(Citation: Cybereason Molerats Dec 2020)
source_name: DustySky2
description: ClearSky Cybersecurity. (2016, June 9). Operation DustySky - Part 2. Retrieved August 3, 2016.
url: http://www.clearskysec.com/wp-content/uploads/2016/06/Operation-DustySky2_-6.2016_TLP_White.pdf
source_name: DustySky
description: ClearSky. (2016, January 7). Operation DustySky. Retrieved January 8, 2016.
url: https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf
source_name: Cybereason Molerats Dec 2020
description: Cybereason Nocturnus Team. (2020, December 9). MOLERATS IN THE CLOUD: New Malware Arsenal Abuses Cloud Platforms in Middle East Espionage Campaign. Retrieved December 22, 2020.
url: https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf
source_name: Kaspersky MoleRATs April 2019
description: GReAT. (2019, April 10). Gaza Cybergang Group1, operation SneakyPastes. Retrieved May 13, 2020.
url: https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/
source_name: FireEye Operation Molerats
description: Villeneuve, N., Haq, H., Moran, N. (2013, August 23). OPERATION MOLERATS: MIDDLE EAST CYBER ATTACKS USING POISON IVY. Retrieved November 17, 2024.
url: https://web.archive.org/web/20201031075438/https://www.fireeye.com/blog/threat-research/2013/08/operation-molerats-middle-east-cyber-attacks-using-poison-ivy.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: intrusion-set
spec_version: 2.1
id: intrusion-set--894aab42-3371-47b1-8859-a4a074c804c8
created: 2017-05-31T21:32:06.390Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0038
external_id: G0038
source_name: Stealth Falcon
description: (Citation: Citizen Lab Stealth Falcon May 2016)
source_name: Citizen Lab Stealth Falcon May 2016
description: Marczak, B. and Scott-Railton, J.. (2016, May 29). Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents. Retrieved June 8, 2016.
url: https://citizenlab.org/2016/05/stealth-falcon/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:04.710Z
name: Stealth Falcon
description: [Stealth Falcon](https://attack.mitre.org/groups/G0038) is a threat group that has conducted targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012. Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates (UAE) government, but that has not been confirmed. (Citation: Citizen Lab Stealth Falcon May 2016)
aliases: Stealth Falcon
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.2.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--813636db-3939-4a45-bea9-6113e970c029
created: 2020-05-15T13:07:26.651Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0105
external_id: G0105
source_name: DarkVishnya
description: (Citation: Securelist DarkVishnya Dec 2018)
source_name: Securelist DarkVishnya Dec 2018
description: Golovanov, S. (2018, December 6). DarkVishnya: Banks attacked through direct connection to local network. Retrieved May 15, 2020.
url: https://securelist.com/darkvishnya/89169/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:05.248Z
name: DarkVishnya
description: [DarkVishnya](https://attack.mitre.org/groups/G0105) is a financially motivated threat actor targeting financial institutions in Eastern Europe. In 2017-2018 the group attacked at least 8 banks in this region.(Citation: Securelist DarkVishnya Dec 2018)
aliases: DarkVishnya
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--d519164e-f5fa-4b8c-a1fb-cf0172ad0983
created: 2017-05-31T21:31:59.120Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0028
external_id: G0028
source_name: Threat Group-1314
description: (Citation: Dell TG-1314)
source_name: TG-1314
description: (Citation: Dell TG-1314)
source_name: Dell TG-1314
description: Dell SecureWorks Counter Threat Unit Special Operations Team. (2015, May 28). Living off the Land. Retrieved January 26, 2016.
url: http://www.secureworks.com/resources/blog/living-off-the-land/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:05.962Z
name: Threat Group-1314
description: [Threat Group-1314](https://attack.mitre.org/groups/G0028) is an unattributed threat group that has used compromised credentials to log into a victim's remote access infrastructure. (Citation: Dell TG-1314)
aliases: Threat Group-1314
TG-1314
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
modified: 2024-10-28T19:03:08.838Z
name: INC Ransom
description: [INC Ransom](https://attack.mitre.org/groups/G1032) is a ransomware and data extortion threat group associated with the deployment of [INC Ransomware](https://attack.mitre.org/software/S1139) that has been active since at least July 2023. [INC Ransom](https://attack.mitre.org/groups/G1032) has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.(Citation: Bleeping Computer INC Ransomware March 2024)(Citation: Cybereason INC Ransomware November 2023)(Citation: Secureworks GOLD IONIC April 2024)(Citation: SentinelOne INC Ransomware)
aliases: INC Ransom
GOLD IONIC
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_contributors: Matt Anderson, @‌nosecurething, Huntress
type: intrusion-set
spec_version: 2.1
id: intrusion-set--cb41e991-65f4-4668-a65f-f4200545b5a1
created: 2024-06-06T17:16:38.704Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1032
external_id: G1032
source_name: GOLD IONIC
description: (Citation: Secureworks GOLD IONIC April 2024)
source_name: Secureworks GOLD IONIC April 2024
description: Counter Threat Unit Research Team. (2024, April 15). GOLD IONIC DEPLOYS INC RANSOMWARE. Retrieved June 5, 2024.
url: https://www.secureworks.com/blog/gold-ionic-deploys-inc-ransomware
source_name: Cybereason INC Ransomware November 2023
description: Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.
url: https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf
source_name: SentinelOne INC Ransomware
description: SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024.
url: https://www.sentinelone.com/anthology/inc-ransom/
source_name: Bleeping Computer INC Ransomware March 2024
description: Toulas, B. (2024, March 27). INC Ransom threatens to leak 3TB of NHS Scotland stolen data. Retrieved June 5, 2024.
url: https://www.bleepingcomputer.com/news/security/inc-ransom-threatens-to-leak-3tb-of-nhs-scotland-stolen-data/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2023-09-29T19:08:47.861Z
name: FIN13
description: [FIN13](https://attack.mitre.org/groups/G1016) is a financially motivated cyber threat group that has targeted the financial, retail, and hospitality industries in Mexico and Latin America, as early as 2016. [FIN13](https://attack.mitre.org/groups/G1016) achieves its objectives by stealing intellectual property, financial data, mergers and acquisition information, or PII.(Citation: Mandiant FIN13 Aug 2022)(Citation: Sygnia Elephant Beetle Jan 2022)
aliases: FIN13
Elephant Beetle
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_contributors: Oren Biderman, Sygnia
Noam Lifshitz, Sygnia
type: intrusion-set
spec_version: 2.1
id: intrusion-set--fd66436e-4d33-450e-ac4c-f7810f1c85f4
created: 2023-07-27T15:24:02.162Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1016
external_id: G1016
source_name: Elephant Beetle
description: (Citation: Sygnia Elephant Beetle Jan 2022)
source_name: Sygnia Elephant Beetle Jan 2022
description: Sygnia Incident Response Team. (2022, January 5). TG2003: ELEPHANT BEETLE UNCOVERING AN ORGANIZED FINANCIAL-THEFT OPERATION. Retrieved February 9, 2023.
url: https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf?__hstc=147695848.3e8f1a482c8f8d4531507747318e660b.1680005306711.1680005306711.1680005306711.1&__hssc=147695848.1.1680005306711&__hsfp=3000179024&hsCtaTracking=189ec409-ae2d-4909-8bf1-62dcdd694372%7Cca91d317-8f10-4a38-9f80-367f551ad64d
source_name: Mandiant FIN13 Aug 2022
description: Ta, V., et al. (2022, August 8). FIN13: A Cybercriminal Threat Actor Focused on Mexico. Retrieved February 9, 2023.
url: https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-04-11T02:23:59.598Z
name: Group5
description: [Group5](https://attack.mitre.org/groups/G0043) is a threat group with a suspected Iranian nexus, though this attribution is not definite. The group has targeted individuals connected to the Syrian opposition via spearphishing and watering holes, normally using Syrian and Iranian themes. [Group5](https://attack.mitre.org/groups/G0043) has used two commonly available remote access tools (RATs), [njRAT](https://attack.mitre.org/software/S0385) and [NanoCore](https://attack.mitre.org/software/S0336), as well as an Android RAT, DroidJack. (Citation: Citizen Lab Group5)
aliases: Group5
x_mitre_deprecated: no
x_mitre_version: 1.3
type: intrusion-set
spec_version: 2.1
id: intrusion-set--7331c66a-5601-4d3f-acf6-ad9e3035eb40
created: 2017-05-31T21:32:08.304Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0043
external_id: G0043
source_name: Group5
description: (Citation: Citizen Lab Group5)
source_name: Citizen Lab Group5
description: Scott-Railton, J., et al. (2016, August 2). Group5: Syria and the Iranian Connection. Retrieved September 26, 2016.
url: https://citizenlab.ca/2016/08/group5-syria/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: intrusion-set
spec_version: 2.1
id: intrusion-set--f9c06633-dcff-48a1-8588-759e7cec5694
created: 2018-04-18T17:59:24.739Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0068
external_id: G0068
source_name: PLATINUM
description: (Citation: Microsoft PLATINUM April 2016)
source_name: Microsoft PLATINUM April 2016
description: Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
url: https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:07.040Z
name: PLATINUM
description: [PLATINUM](https://attack.mitre.org/groups/G0068) is an activity group that has targeted victims since at least 2009. The group has focused on targets associated with governments and related organizations in South and Southeast Asia. (Citation: Microsoft PLATINUM April 2016)
aliases: PLATINUM
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.3
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Ryan Becwar
modified: 2024-04-17T22:10:27.139Z
name: GALLIUM
description: [GALLIUM](https://attack.mitre.org/groups/G0093) is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. This group is particularly known for launching Operation Soft Cell, a long-term campaign targeting telecommunications providers.(Citation: Cybereason Soft Cell June 2019) Security researchers have identified [GALLIUM](https://attack.mitre.org/groups/G0093) as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019)(Citation: Unit 42 PingPull Jun 2022)
aliases: GALLIUM
Granite Typhoon
x_mitre_deprecated: no
x_mitre_version: 4.0
x_mitre_contributors: Daniyal Naeem, BT Security
Cybereason Nocturnus, @nocturnus
type: intrusion-set
spec_version: 2.1
id: intrusion-set--06a11b7e-2a36-47fe-8d3e-82c265df3258
created: 2019-07-18T20:47:50.050Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0093
external_id: G0093
source_name: GALLIUM
description: (Citation: Microsoft GALLIUM December 2019)
source_name: Granite Typhoon
description: (Citation: Microsoft Threat Actor Naming July 2023)
source_name: Cybereason Soft Cell June 2019
description: Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019.
url: https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers
source_name: Microsoft Threat Actor Naming July 2023
description: Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
url: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
source_name: Microsoft GALLIUM December 2019
description: MSTIC. (2019, December 12). GALLIUM: Targeting global telecom. Retrieved January 13, 2021.
url: https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/
source_name: Unit 42 PingPull Jun 2022
description: Unit 42. (2022, June 13). GALLIUM Expands Targeting Across Telecommunications, Government and Finance Sectors With New PingPull Tool. Retrieved August 7, 2022.
url: https://unit42.paloaltonetworks.com/pingpull-gallium/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-11-17T14:57:09.164Z
name: FIN10
description: [FIN10](https://attack.mitre.org/groups/G0051) is a financially motivated threat group that has targeted organizations in North America since at least 2013 through 2016. The group uses stolen data exfiltrated from victims to extort organizations. (Citation: FireEye FIN10 June 2017)
aliases: FIN10
x_mitre_deprecated: no
x_mitre_version: 1.3
type: intrusion-set
spec_version: 2.1
id: intrusion-set--fbe9387f-34e6-4828-ac28-3080020c597b
created: 2017-12-14T16:46:06.044Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0051
external_id: G0051
source_name: FIN10
description: (Citation: FireEye FIN10 June 2017)
source_name: FireEye FIN10 June 2017
description: FireEye iSIGHT Intelligence. (2017, June 16). FIN10: Anatomy of a Cyber Extortion Operation. Retrieved November 17, 2024.
url: https://services.google.com/fh/files/misc/rpt-fin-10-anatomy-of-a-cyber-en.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: campaign
spec_version: 2.1
id: campaign--78068e68-4124-4243-b6f4-76e4e5be8a06
created: 2022-09-29T16:42:29.364Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0015
external_id: C0015
source_name: DFIR Conti Bazar Nov 2021
description: DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.
url: https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:46.910Z
name: C0015
description: [C0015](https://attack.mitre.org/campaigns/C0015) was a ransomware intrusion during which the unidentified attackers used [Bazar](https://attack.mitre.org/software/S0534), [Cobalt Strike](https://attack.mitre.org/software/S0154), and [Conti](https://attack.mitre.org/software/S0575), along with other tools, over a 5 day period. Security researchers assessed the actors likely used the widely-circulated [Conti](https://attack.mitre.org/software/S0575) ransomware playbook based on the observed pattern of activity and operator errors.(Citation: DFIR Conti Bazar Nov 2021)
aliases: C0015
first_seen: 2021-08-01T05:00:00.000Z
last_seen: 2021-08-01T05:00:00.000Z
x_mitre_first_seen_citation: (Citation: DFIR Conti Bazar Nov 2021)
x_mitre_last_seen_citation: (Citation: DFIR Conti Bazar Nov 2021)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Matt Brenton, Zurich Insurance Group
x_mitre_domains: enterprise-attack