TA0003: TA0003
Essential information
- MITRE technique ID
TA0003- Confidence
- 100/100
- Revoked
- No
- Published
- 20/12/2025 21:59
- Modified
- 27/05/2026 15:52
- Author / Source
- AlienVault
Description
No description.
Marking (TLP)
TLP:GREEN
External references
Related entities
Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.
Intrusion sets (APT) (15)
-
8220 Gang usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
GoldenJackal usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
UTA0178 usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
The MITRE Corporation Confidence 100
[FIN7](https://attack.mitre.org/groups/G0046) is a financially-motivated threat group that has been active since 2013. [FIN7](https://attack.mitre.org/groups/G0046) has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media,…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Metador usesThe MITRE Corporation Confidence 100
[Metador](https://attack.mitre.org/groups/G1013) is a suspected cyber espionage group that was first reported in September 2022. [Metador](https://attack.mitre.org/groups/G1013) has targeted a limited number of telecommunication companies, internet service providers, and universities…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Sandworm usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
RedEyes usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
RomCom usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
The MITRE Corporation Confidence 100
[Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European,…
First seen 01/01/1970 · Last seen 16/11/5138 · -
The MITRE Corporation Confidence 100
[APT-C-36](https://attack.mitre.org/groups/G0099) is a suspected South America espionage group that has been active since at least 2018. The group mainly targets Colombian government institutions as well as important corporations…
First seen 01/01/1970 · Last seen 16/11/5138 · -
The MITRE Corporation Confidence 100
[APT33](https://attack.mitre.org/groups/G0064) is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States,…
First seen 01/01/1970 · Last seen 16/11/5138 · -
VexTrio usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
Malware (38)
-
BellaCiao usesFamily
-
GreyEnergy - S0342 uses
-
Kapeka uses
-
LockBit usesFamily
-
WIREFIRE uses
-
Redline usesFamily
-
Lumma Stealer usesFamily
-
Rubeus usesFamily
-
SilverRAT uses
-
SharpHound usesFamily
-
Jackal uses
-
RAT usesFamily
Reports (6)
-
Threat landscape — insurance relatedConfidence 100 199 MITREs 11 APTs
-
22 MITREs 3 Malwares 1 APT
-
4 MITREs 1 Malware 1 APT
-
5 MITREs 50 Observables
-
8 MITREs 6 Malwares
-
2 CVEs 4 MITREs 37 Observables
Vulnerabilities (CVE) (8)
Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code …
- Published
- 02/06/2022
- Modified
- 27/05/2026
A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user …
- Attack vector
- NETWORK
- Published
- 31/01/2024
- Modified
- 21/12/2025
Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile.
- Attack vector
- LOCAL
- Complexity
- LOW
- Published
- 27/04/2017
- Modified
- 22/04/2026
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) …
- Attack vector
- Network
- Published
- 31/01/2024
- Modified
- 27/05/2026
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web …
- Attack vector
- Network
- Published
- 10/01/2024
- Modified
- 27/05/2026
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the …
- Attack vector
- Network
- Published
- 10/01/2024
- Modified
- 27/05/2026
Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts …
- Attack vector
- Network
- Published
- 05/10/2023
- Modified
- 21/12/2025
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) …
- Attack vector
- Network
- Published
- 13/02/2024
- Modified
- 27/05/2026