T1573.002: T1573.002
Essential information
- MITRE technique ID
T1573.002- Confidence
- 100/100
- Revoked
- No
- Published
- 16/03/2020 16:48
- Modified
- 27/03/2026 01:11
- Author / Source
- The MITRE Corporation
Aliases
Asymmetric Cryptography
Platforms
windows macos linux Network Devices ESXi
Description
Kill chain phases
| Kill chain | Phase |
|---|---|
| mitre-attack | command-and-control |
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.
Intrusion sets (APT) (51)
-
Earth Kasha relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Earth Longzhi relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
FAMOUS CHOLLIMA relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
The MITRE Corporation Confidence 100
[FIN6](https://attack.mitre.org/groups/G0037) is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point…
First seen 01/01/1970 · Last seen 16/11/5138 · -
GlassWorm relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Hive0147 relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Homeland Justice relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Horabot relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Khmer Shadow relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Kimsuky and Andariel relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
LapDogs relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Lazarus relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
Malware (77)
-
COBEACON usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Shahmaran usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
filecoauthx86.exe usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
BianLian usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
BlueLoader usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
PsExec usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
TorNet usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
RemcosRAT usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
PowerShell RAT usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Hi-Zor usesFamily The MITRE Corporation Confidence 100
[Hi-Zor](https://attack.mitre.org/software/S0087) is a remote access tool (RAT) that has characteristics similar to [Sakula](https://attack.mitre.org/software/S0074). It was used in a campaign named INOCNATION. (Citation: Fidelis Hi-Zor)
First seen 01/01/1970 · Last seen 16/11/5138 · -
Katz Stealer usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
LummaC2 usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
Reports (50)
-
AlienVault Confidence 100 1 CVE 19 MITREs 2 Malwares 4 IOCs 2 Observables
-
AlienVault Confidence 100 1 CVE 20 MITREs 1 Malware 8 IOCs 8 Observables 1 APT
-
AlienVault Confidence 100 18 MITREs 3 Malwares 8 IOCs 8 Observables 1 APT
-
AlienVault Confidence 100 19 MITREs 1 Malware 34 IOCs 34 Observables
-
19 MITREs 3 Malwares 32 Observables 1 APT
-
Threat landscape — Belgium relatedConfidence 100 18 CVEs 200 MITREs 200 Malwares 20 APTs 26 Tools
-
Threat landscape — insurance relatedConfidence 100 199 MITREs 11 APTs
-
Latest PyPi Compromise relatedAlienVault Confidence 100 20 MITREs 3 Malwares 9 IOCs 9 Observables 1 APT
-
AlienVault Confidence 100 18 MITREs 3 Malwares 4 IOCs 4 Observables 1 APT
-
AlienVault Confidence 100 20 MITREs 7 IOCs 7 Observables 1 APT
-
19 MITREs 10 Observables 1 APT
-
AlienVault Confidence 100 16 MITREs 3 IOCs 3 Observables 1 APT
Vulnerabilities (CVE) (28)
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
- Published
- 03/11/2021
- Modified
- 21/12/2025
A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to …
- Attack vector
- Network
- Published
- 14/08/2025
- Modified
- 27/05/2026
targets
- Published
- 20/12/2025
- Modified
- 21/12/2025
Tool (2)
-
Sliver usesThe MITRE Corporation Confidence 100
[Sliver](https://attack.mitre.org/software/S0633) is an open source, cross-platform, red team command and control (C2) framework written in Golang. [Sliver](https://attack.mitre.org/software/S0633) includes its own package manager, "armory," for staging and downloading additional…
-
Remcos usesThe MITRE Corporation Confidence 100
[Remcos](https://attack.mitre.org/software/S0332) is a closed-source tool that is marketed as a remote control and surveillance software by a company called Breaking Security. [Remcos](https://attack.mitre.org/software/S0332) has been observed being used in…
Course Of Action (1)
-
SSL/TLS Inspection mitigates
Campaign (1)
-
C0021 uses