NETWIRE

216.73.217.47

The MITRE Corporation · Published 18/04/2018 19:59 · Modified 27/03/2026 01:03 Family

Essential information

Confidence: 100/100
Is family: Yes
Published: 18/04/2018 19:59
Modified: 27/03/2026 01:03
Revoked: No
Author / Source: The MITRE Corporation
Related entities: 81 attack patterns (mitre), 5 intrusion sets (apt), 6 sectors, 4 countries, 95 indicators

Description

[NETWIRE](https://attack.mitre.org/software/S0198) is a publicly available, multiplatform remote administration tool (RAT) that has been used by criminal and APT groups since at least 2012.(Citation: FireEye APT33 Sept 2017)(Citation: McAfee Netwire Mar 2015)(Citation: FireEye APT33 Webinar Sept 2017)

Marking (TLP)

External references

Related entities

The White Company uses

The MITRE Corporation Confidence 100

[The White Company](https://attack.mitre.org/groups/G0089) is a likely state-sponsored threat actor with advanced capabilities. From 2017 through 2018, the group led an espionage campaign called Operation Shaheen targeting government and…

First seen 01/01/1970 · Last seen 16/11/5138 ·
TA577 uses

The MITRE Corporation Confidence 100

[TA577](https://attack.mitre.org/groups/G1037) is an initial access broker (IAB) that has distributed [QakBot](https://attack.mitre.org/software/S0650) and [Pikabot](https://attack.mitre.org/software/S1145), and was among the first observed groups distributing [Latrodectus](https://attack.mitre.org/software/S1160) in 2023.(Citation: Latrodectus APR 2024)

First seen 01/01/1970 · Last seen 16/11/5138 ·
SilverTerrier uses

The MITRE Corporation Confidence 100

[SilverTerrier](https://attack.mitre.org/groups/G0083) is a Nigerian threat group that has been seen active since 2014. [SilverTerrier](https://attack.mitre.org/groups/G0083) mainly targets organizations in high technology, higher education, and manufacturing.(Citation: Unit42 SilverTerrier 2018)(Citation: Unit42…

First seen 01/01/1970 · Last seen 16/11/5138 ·
APT33 uses HOLMIUMElfin

The MITRE Corporation Confidence 100

[APT33](https://attack.mitre.org/groups/G0064) is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States,…

First seen 01/01/1970 · Last seen 16/11/5138 ·
TA2541 uses

The MITRE Corporation Confidence 100

[TA2541](https://attack.mitre.org/groups/G1018) is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. [TA2541](https://attack.mitre.org/groups/G1018) campaigns are typically high volume and…

First seen 01/01/1970 · Last seen 16/11/5138 ·

NETWIRE

Essential information

Description

Marking (TLP)

External references

Related entities

Attack patterns (MITRE) (81)

Intrusion sets (APT) (5)

Sectors (6)

Countries (4)

Indicators (95)