TA577
Essential information
- Confidence
- 100/100
- Published
- 16/12/2025 19:39
- Modified
- 27/03/2026 01:13
- Updated at
- 27/03/2026 01:13
- Revoked
- No
- Author / Source
- The MITRE Corporation
- Resource level
- —
- Primary motivation
- —
- Related entities
- 1 reports, 33 attack patterns (mitre), 11 malware, 2 sectors, 123 indicators
Description
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.
Reports (1)
-
20 MITREs 2 Malwares 76 Observables 1 APT
Attack patterns (MITRE) (33)
-
T1586.002 usesEmail Accounts MITRE
-
T1053.005 usesScheduled Task MITRE
-
T1059.007 usesJavaScript MITRE
-
T1059.005 usesVisual Basic MITRE
-
T1059.001 usesPowerShell MITRE
-
T1110 usesBrute Force MITRE
-
T1135 usesNetwork Share Discovery MITRE
-
T1059.003 usesWindows Command Shell MITRE
-
T1573.002 usesAsymmetric Cryptography MITRE
-
T1204 usesUser Execution MITRE
-
T1059 usesCommand and Scripting Interpreter MITRE
-
T1027 usesObfuscated Files or Information MITRE
Malware (11)
-
Latrodectus usesThe MITRE Corporation Confidence 100
[Latrodectus](https://attack.mitre.org/software/S1160) is a Windows malware downloader that has been used since at least 2023 to download and execute additional payloads and modules. [Latrodectus](https://attack.mitre.org/software/S1160) has most often been distributed…
First seen 01/01/1970 · Last seen 16/11/5138 · -
QuackBot usesThe MITRE Corporation Confidence 100
[QakBot](https://attack.mitre.org/software/S0650) is a modular banking trojan that has been used primarily by financially-motivated actors since at least 2007. [QakBot](https://attack.mitre.org/software/S0650) is continuously maintained and developed and has evolved from…
First seen 01/01/1970 · Last seen 16/11/5138 · -
NETWIRE usesFamily The MITRE Corporation Confidence 100
[NETWIRE](https://attack.mitre.org/software/S0198) is a publicly available, multiplatform remote administration tool (RAT) that has been used by criminal and APT groups since at least 2012.(Citation: FireEye APT33 Sept 2017)(Citation: McAfee…
First seen 01/01/1970 · Last seen 16/11/5138 · -
DOUBLEBACK usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
AsyncRAT usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Matanbuchus usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Pikabot usesThe MITRE Corporation Confidence 100
[Pikabot](https://attack.mitre.org/software/S1145) is a backdoor used for initial access and follow-on tool deployment active since early 2023. [Pikabot](https://attack.mitre.org/software/S1145) is notable for extensive use of multiple encoding, encryption, and defense…
First seen 01/01/1970 · Last seen 16/11/5138 · -
XWorm usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
SocGholish usesThe MITRE Corporation Confidence 100
[SocGholish](https://attack.mitre.org/software/S1124) is a JavaScript-based loader malware that has been used since at least 2017. It has been observed in use against multiple sectors globally for initial access, primarily…
First seen 01/01/1970 · Last seen 16/11/5138 · -
RedLine usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Quasar usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
Sectors (2)
-
Education targets
-
Manufacturing targets
Indicators (123)
-
http://103.124.104.76/wsr6oh/Y.txtindicatesstix 100/100 Revoked· Valid until 20/04/2024 · Source: AlienVault -
mindsmatterphilly.orgindicates -
http://103.124.106.224/uuny19/bb1nG.txtindicates -
stix 100/100 Revoked· Valid until 07/05/2024 · Source: AlienVault
-
iseberkis.comindicates -
pestpatrol1.comindicates -
stix 100/100 Revoked· Valid until 07/05/2024 · Source: AlienVault
-
itter.comindicates -
http://iseberkis.com:62478/medical/plan/oslo/posting/inindicates -
stix 100/100 Revoked· Valid until 07/05/2024 · Source: AlienVault