TA0001: TA0001
Essential information
- MITRE technique ID
TA0001- Confidence
- 100/100
- Revoked
- No
- Published
- 20/12/2025 23:19
- Modified
- 27/05/2026 15:52
- Author / Source
- AlienVault
Description
No description.
Marking (TLP)
TLP:CLEAR
External references
Related entities
Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.
Intrusion sets (APT) (7)
-
SnakeKeylogger usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
RomCom usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Unfading Sea Haze usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
The MITRE Corporation Confidence 100
[APT29](https://attack.mitre.org/groups/G0016) is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).(Citation: White House Imposing Costs RU Gov April 2021)(Citation: UK Gov Malign RIS Activity April…
First seen 01/01/1970 · Last seen 16/11/5138 · -
gunra usesAlienVault Confidence 100
No description available
First seen 01/01/1970 · Last seen 16/11/5138 · -
DPRK usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
interlock usesRansomware.Live Confidence 100
No description available
First seen 01/01/1970 · Last seen 16/11/5138 ·
Malware (29)
-
SharpJSHandler usesFamily
-
AlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Gunra Ransomware usesFamily
-
SerialPktdoor uses
-
SharpZulip uses
-
DeerStealer usesFamily
-
DPRK uses
-
Gh0st Army uses
-
Mydoor usesFamily
-
Active Hoze uses
-
xkeylog Keylogger uses
-
Rubeus usesFamily
Reports (9)
-
Threat landscape — insurance relatedConfidence 100 199 MITREs 11 APTs
-
22 MITREs 3 Malwares 1 APT
-
17 MITREs 1 Malware 5 Observables 1 APT
-
5 MITREs 1 Malware 1 APT
-
5 MITREs 50 Observables
-
8 MITREs 6 Malwares
-
2 CVEs 6 MITREs 37 Observables
-
9 MITREs 1 Malware 5 Observables
-
2 CVEs 4 MITREs 37 Observables
Vulnerabilities (CVE) (7)
A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by …
- Published
- 01/07/2024
- Modified
- 01/07/2024
Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts …
- Attack vector
- Network
- Published
- 05/10/2023
- Modified
- 21/12/2025
TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.
- Attack vector
- Network
- Published
- 10/02/2023
- Modified
- 20/12/2025
Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.
- Attack vector
- Network
- Published
- 10/12/2021
- Modified
- 27/05/2026
SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution.
- Published
- 28/01/2022
- Modified
- 20/12/2025
Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code …
- Published
- 02/06/2022
- Modified
- 27/05/2026
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma …
- Attack vector
- NETWORK
- Published
- 29/03/2024
- Modified
- 21/12/2025