TA577
Essential information
- Confidence
- 100/100
- Published
- 16/12/2025 19:39
- Modified
- 27/03/2026 01:13
- Updated at
- 27/03/2026 01:13
- Revoked
- No
- Author / Source
- The MITRE Corporation
- Resource level
- —
- Primary motivation
- —
- Related entities
- 1 reports, 33 attack patterns (mitre), 11 malware, 2 sectors, 123 indicators
Description
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.
Reports (1)
-
20 MITREs 2 Malwares 76 Observables 1 APT
Attack patterns (MITRE) (33)
-
T1003 usesOS Credential Dumping MITRE
-
T1204.001 usesMalicious Link MITRE
-
T1497.001 usesSystem Checks MITRE
-
T1129 usesShared Modules MITRE
-
T1083 usesFile and Directory Discovery MITRE
-
T1566 usesPhishing MITRE
-
T1055 usesProcess Injection MITRE
-
T1078 usesValid Accounts MITRE
-
T1489 usesService Stop MITRE
-
T1219 usesRemote Access Tools MITRE
-
T1547 usesBoot or Logon Autostart Execution MITRE
-
T1027.005 usesIndicator Removal from Tools MITRE
Malware (11)
-
Latrodectus usesThe MITRE Corporation Confidence 100
[Latrodectus](https://attack.mitre.org/software/S1160) is a Windows malware downloader that has been used since at least 2023 to download and execute additional payloads and modules. [Latrodectus](https://attack.mitre.org/software/S1160) has most often been distributed…
First seen 01/01/1970 · Last seen 16/11/5138 · -
QuackBot usesThe MITRE Corporation Confidence 100
[QakBot](https://attack.mitre.org/software/S0650) is a modular banking trojan that has been used primarily by financially-motivated actors since at least 2007. [QakBot](https://attack.mitre.org/software/S0650) is continuously maintained and developed and has evolved from…
First seen 01/01/1970 · Last seen 16/11/5138 · -
NETWIRE usesFamily The MITRE Corporation Confidence 100
[NETWIRE](https://attack.mitre.org/software/S0198) is a publicly available, multiplatform remote administration tool (RAT) that has been used by criminal and APT groups since at least 2012.(Citation: FireEye APT33 Sept 2017)(Citation: McAfee…
First seen 01/01/1970 · Last seen 16/11/5138 · -
DOUBLEBACK usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
AsyncRAT usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Matanbuchus usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Pikabot usesThe MITRE Corporation Confidence 100
[Pikabot](https://attack.mitre.org/software/S1145) is a backdoor used for initial access and follow-on tool deployment active since early 2023. [Pikabot](https://attack.mitre.org/software/S1145) is notable for extensive use of multiple encoding, encryption, and defense…
First seen 01/01/1970 · Last seen 16/11/5138 · -
XWorm usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
SocGholish usesThe MITRE Corporation Confidence 100
[SocGholish](https://attack.mitre.org/software/S1124) is a JavaScript-based loader malware that has been used since at least 2017. It has been observed in use against multiple sectors globally for initial access, primarily…
First seen 01/01/1970 · Last seen 16/11/5138 · -
RedLine usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Quasar usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
Sectors (2)
-
Education targets
-
Manufacturing targets
Indicators (123)
-
mavrin-occentus.netindicates -
http://89.117.1.160/zkf2r4j/VmD.txtindicatesstix 100/100 Revoked· Valid until 20/04/2024 · Source: AlienVault -
http://103.124.105.208/wha5uxh/D.txtindicates -
http://89.117.1.160/4bvt1yw/iC.txtindicates -
http://176.123.2.146/5aohv/9mn.txtindicates -
http://itter.com/Iindicates -
http://103.124.104.22/zjxb/bO.txtindicates -
poolsbydesignaz.comindicates -
http://988.skins.com/admin/view/stylesheet/50k.pngindicates -
stix 100/100 Revoked· Valid until 07/05/2024 · Source: AlienVault