T1588.006: T1588.006
Essential information
- MITRE technique ID
T1588.006- Confidence
- 100/100
- Revoked
- No
- Published
- 15/10/2020 04:59
- Modified
- 30/03/2026 12:12
- Author / Source
- The MITRE Corporation
Aliases
Vulnerabilities
Platforms
PRE
Description
Kill chain phases
| Kill chain | Phase |
|---|---|
| mitre-attack | resource-development |
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.
Intrusion sets (APT) (8)
-
The MITRE Corporation Confidence 100
[APT32](https://attack.mitre.org/groups/G0050) is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments,…
First seen 01/01/1970 · Last seen 16/11/5138 · -
RomCom usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
The MITRE Corporation Confidence 100
[Sandworm Team](https://attack.mitre.org/groups/G0034) is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.(Citation:…
First seen 01/01/1970 · Last seen 16/11/5138 · -
The MITRE Corporation Confidence 100
[Volt Typhoon](https://attack.mitre.org/groups/G1017) is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021 primarily targeting critical infrastructure organizations in the US and…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Prometei usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Storm-0501 usesThe MITRE Corporation Confidence 100
[Storm-0501](https://attack.mitre.org/groups/G1053) is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. [Storm-0501](https://attack.mitre.org/groups/G1053) has been active since 2021 and has previously been…
First seen 01/01/1970 · Last seen 16/11/5138 · -
mimo usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
TeamPCP usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
Malware (7)
-
SnipBot usesFamily
-
RustyClaw usesFamily
-
Mythic C2 agent usesFamily
-
IPRoyal usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Minus Ransomware usesFamily
-
XMRig usesFamily
-
jest-fet-mock usesFamily
Reports (8)
-
Threat landscape — Belgium relatedConfidence 100 18 CVEs 200 MITREs 200 Malwares 20 APTs 26 Tools
-
Threat landscape — insurance relatedConfidence 100 199 MITREs 11 APTs
-
AlienVault Confidence 100 1 CVE 20 MITREs 9 IOCs 9 Observables
-
AlienVault Confidence 100 15 MITREs 9 IOCs 9 Observables
-
Adobe Reader 0-day related1 MITRE 4 Observables
-
13 MITREs 3 Observables 1 APT
-
8 MITREs 2 Observables
-
11 MITREs 1 Malware 4 Observables
Vulnerabilities (CVE) (25)
Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account …
- Attack vector
- Adjacent
- Published
- 25/08/2025
- Modified
- 27/05/2026
Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary …
- Attack vector
- NETWORK
- Complexity
- Low
- Published
- 28/08/2025
- Modified
- 18/06/2026
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 …
- Attack vector
- LOCAL
- Complexity
- LOW
- EPSS
- 0.0001 (P0.6%)
- Published
- 22/04/2026
- Modified
- 23/05/2026
Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway when an attacker can get access to the …
- Published
- 20/12/2025
- Modified
- 27/05/2026
D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service …
- Published
- 05/08/2025
- Modified
- 27/05/2026
Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files.
- Attack vector
- Network
- Published
- 25/08/2025
- Modified
- 27/05/2026
D-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands …
- Attack vector
- Network
- Published
- 05/08/2025
- Modified
- 27/05/2026
Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must …
- Attack vector
- Adjacent
- Published
- 25/08/2025
- Modified
- 27/05/2026
A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to …
- Attack vector
- Network
- Published
- 14/08/2025
- Modified
- 27/05/2026
Microsoft Internet Explorer contains a memory corruption vulnerability that allows for remote code execution. The impacted products could be end-of-life (EoL) and/or …
- Attack vector
- Network
- Complexity
- Low
- Published
- 18/09/2013
- Modified
- 27/05/2026
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through …
- Attack vector
- Network
- Published
- 12/08/2025
- Modified
- 27/05/2026
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before …
- Attack vector
- NETWORK
- Complexity
- LOW
- Published
- 25/04/2025
- Modified
- 27/03/2026
Campaign (1)
-
Leviathan Australian Intrusions uses
Course Of Action (1)
-
Pre-compromise mitigates