T1573.002: T1573.002
Essential information
- MITRE technique ID
T1573.002- Confidence
- 100/100
- Revoked
- No
- Published
- 16/03/2020 16:48
- Modified
- 27/03/2026 01:11
- Author / Source
- The MITRE Corporation
Aliases
Asymmetric Cryptography
Platforms
windows macos linux Network Devices ESXi
Description
Kill chain phases
| Kill chain | Phase |
|---|---|
| mitre-attack | command-and-control |
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.
Intrusion sets (APT) (51)
-
The MITRE Corporation Confidence 100
[Tropic Trooper](https://attack.mitre.org/groups/G0081) is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. [Tropic Trooper](https://attack.mitre.org/groups/G0081) focuses on targeting government, healthcare,…
First seen 01/01/1970 · Last seen 16/11/5138 · -
The Gentlemen usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
BladedFeline usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
SmartApeSG usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Earth Estries usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Qbot usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
TaxOff usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
TeamPCP usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Ghostwriter usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
RedCurl usesThe MITRE Corporation Confidence 100
[RedCurl](https://attack.mitre.org/groups/G1039) is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Corlys usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
The MITRE Corporation Confidence 100
[FIN8](https://attack.mitre.org/groups/G0061) is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology,…
First seen 01/01/1970 · Last seen 16/11/5138 ·
Malware (77)
-
Vidar usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
HijackServer usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
DocConnect usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
GTELAM usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Kazuar - S0265 usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Penguish usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
DarkWatchman usesFamily The MITRE Corporation Confidence 100
[DarkWatchman](https://attack.mitre.org/software/S0673) is a lightweight JavaScript-based remote access tool (RAT) that avoids file operations; it was first observed in November 2021.(Citation: Prevailion DarkWatchman 2021)
First seen 01/01/1970 · Last seen 16/11/5138 · -
MARSSTEALER usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
njRAT - S0385 usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
ACRStealer usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
DoraRAT usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
BRICKSTORM usesAlienVault Confidence 100
[BRICKSTORM](https://attack.mitre.org/software/S9015) is a cross-platform backdoor with variants written in Go and Rust that facilitates command and control, the ingress transfer of other malware, and the exfiltration of data.(Citation:…
First seen 01/01/1970 · Last seen 16/11/5138 ·
Reports (50)
-
46 MITREs 6 Malwares 27 Observables 1 APT
-
2 CVEs 21 MITREs 2 Malwares 12 Observables
-
AlienVault Confidence 100 20 MITREs 5 Malwares 15 IOCs 15 Observables 1 APT
-
18 MITREs 1 Malware 1 Observable 1 APT
-
19 MITREs 5 Malwares 22 Observables 1 APT
-
13 MITREs 1 Malware 6 Observables
-
9 MITREs 2 Malwares 8 Observables
-
8 MITREs 3 Malwares 4 Observables
-
1 CVE 12 MITREs 1 Malware 34 Observables 1 APT
-
7 MITREs 1 Malware 3 Observables 1 APT
-
12 MITREs 1 APT
-
4 MITREs 2 Malwares
Vulnerabilities (CVE) (28)
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
- Published
- 03/11/2021
- Modified
- 21/12/2025
A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to …
- Attack vector
- Network
- Published
- 14/08/2025
- Modified
- 27/05/2026
targets
- Published
- 20/12/2025
- Modified
- 21/12/2025
Tool (2)
-
Sliver usesThe MITRE Corporation Confidence 100
[Sliver](https://attack.mitre.org/software/S0633) is an open source, cross-platform, red team command and control (C2) framework written in Golang. [Sliver](https://attack.mitre.org/software/S0633) includes its own package manager, "armory," for staging and downloading additional…
-
Remcos usesThe MITRE Corporation Confidence 100
[Remcos](https://attack.mitre.org/software/S0332) is a closed-source tool that is marketed as a remote control and surveillance software by a company called Breaking Security. [Remcos](https://attack.mitre.org/software/S0332) has been observed being used in…
Course Of Action (1)
-
SSL/TLS Inspection mitigates
Campaign (1)
-
C0021 uses