TA577
Essential information
- Confidence
- 100/100
- Published
- 16/12/2025 19:39
- Modified
- 27/03/2026 01:13
- Updated at
- 27/03/2026 01:13
- Revoked
- No
- Author / Source
- The MITRE Corporation
- Resource level
- —
- Primary motivation
- —
- Related entities
- 1 reports, 33 attack patterns (mitre), 11 malware, 2 sectors, 123 indicators
Description
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.
Reports (1)
-
20 MITREs 2 Malwares 76 Observables 1 APT
Attack patterns (MITRE) (33)
Malware (11)
-
Latrodectus usesThe MITRE Corporation Confidence 100
[Latrodectus](https://attack.mitre.org/software/S1160) is a Windows malware downloader that has been used since at least 2023 to download and execute additional payloads and modules. [Latrodectus](https://attack.mitre.org/software/S1160) has most often been distributed…
First seen 01/01/1970 · Last seen 16/11/5138 · -
QuackBot usesThe MITRE Corporation Confidence 100
[QakBot](https://attack.mitre.org/software/S0650) is a modular banking trojan that has been used primarily by financially-motivated actors since at least 2007. [QakBot](https://attack.mitre.org/software/S0650) is continuously maintained and developed and has evolved from…
First seen 01/01/1970 · Last seen 16/11/5138 · -
NETWIRE usesFamily The MITRE Corporation Confidence 100
[NETWIRE](https://attack.mitre.org/software/S0198) is a publicly available, multiplatform remote administration tool (RAT) that has been used by criminal and APT groups since at least 2012.(Citation: FireEye APT33 Sept 2017)(Citation: McAfee…
First seen 01/01/1970 · Last seen 16/11/5138 · -
DOUBLEBACK usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
AsyncRAT usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Matanbuchus usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Pikabot usesThe MITRE Corporation Confidence 100
[Pikabot](https://attack.mitre.org/software/S1145) is a backdoor used for initial access and follow-on tool deployment active since early 2023. [Pikabot](https://attack.mitre.org/software/S1145) is notable for extensive use of multiple encoding, encryption, and defense…
First seen 01/01/1970 · Last seen 16/11/5138 · -
XWorm usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
SocGholish usesThe MITRE Corporation Confidence 100
[SocGholish](https://attack.mitre.org/software/S1124) is a JavaScript-based loader malware that has been used since at least 2017. It has been observed in use against multiple sectors globally for initial access, primarily…
First seen 01/01/1970 · Last seen 16/11/5138 · -
RedLine usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Quasar usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
Sectors (2)
-
Education targets
-
Manufacturing targets
Indicators (123)
-
torontoclub.vipindicates -
stix 100/100 Revoked· Valid until 07/05/2024 · Source: AlienVault
-
http://89.117.1.161/epxq/A.txtindicates -
http://89.117.2.34/4qp/8Y.txtindicates -
http://89.117.1.161/mtdi/ZQCw.txtindicatesstix 100/100 Revoked· Valid until 20/04/2024 · Source: AlienVault -
stix 100/100 Revoked· Valid until 07/05/2024 · Source: AlienVault
-
http://176.123.2.146/vbcsn/UOx.txtindicatesstix 100/100 Revoked· Valid until 20/04/2024 · Source: AlienVault -
stix 100/100 Revoked· Valid until 07/05/2024 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 07/05/2024 · Source: AlienVault
-
research.openanalysis.netindicates