NETWIRE
Essential information
- Confidence
- 100/100
- Is family
- Yes
- Published
- 18/04/2018 19:59
- Modified
- 27/03/2026 01:03
- Revoked
- No
- Author / Source
- The MITRE Corporation
- Related entities
- 81 attack patterns (mitre), 5 intrusion sets (apt), 6 sectors, 4 countries, 95 indicators
Description
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Attack patterns, malware, vulnerabilities, indicators, intrusion sets and other entities linked to this malware.
Attack patterns (MITRE) (81)
-
-
T1056 usesInput Capture MITRE
-
T1010 usesApplication Window Discovery MITRE
-
T1547.013 usesXDG Autostart Entries MITRE
-
T1071.001 usesWeb Protocols MITRE
-
T1555.003 usesCredentials from Web Browsers MITRE
-
T1571 usesNon-Standard Port MITRE
-
T1204.002 usesMalicious File MITRE
-
T1049 usesSystem Network Connections Discovery MITRE
-
T1219 usesRemote Access Tools MITRE
-
Login Items uses
-
T1059.003 usesWindows Command Shell MITRE
Intrusion sets (APT) (5)
-
The White Company usesThe MITRE Corporation Confidence 100
[The White Company](https://attack.mitre.org/groups/G0089) is a likely state-sponsored threat actor with advanced capabilities. From 2017 through 2018, the group led an espionage campaign called Operation Shaheen targeting government and…
First seen 01/01/1970 · Last seen 16/11/5138 · -
TA577 usesThe MITRE Corporation Confidence 100
[TA577](https://attack.mitre.org/groups/G1037) is an initial access broker (IAB) that has distributed [QakBot](https://attack.mitre.org/software/S0650) and [Pikabot](https://attack.mitre.org/software/S1145), and was among the first observed groups distributing [Latrodectus](https://attack.mitre.org/software/S1160) in 2023.(Citation: Latrodectus APR 2024)
First seen 01/01/1970 · Last seen 16/11/5138 · -
SilverTerrier usesThe MITRE Corporation Confidence 100
[SilverTerrier](https://attack.mitre.org/groups/G0083) is a Nigerian threat group that has been seen active since 2014. [SilverTerrier](https://attack.mitre.org/groups/G0083) mainly targets organizations in high technology, higher education, and manufacturing.(Citation: Unit42 SilverTerrier 2018)(Citation: Unit42…
First seen 01/01/1970 · Last seen 16/11/5138 · -
The MITRE Corporation Confidence 100
[APT33](https://attack.mitre.org/groups/G0064) is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States,…
First seen 01/01/1970 · Last seen 16/11/5138 · -
TA2541 usesThe MITRE Corporation Confidence 100
[TA2541](https://attack.mitre.org/groups/G1018) is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. [TA2541](https://attack.mitre.org/groups/G1018) campaigns are typically high volume and…
First seen 01/01/1970 · Last seen 16/11/5138 ·
Sectors (6)
-
Culture targets
-
Defense ministries (including the military) targets
-
Finance targets
-
Government targets
-
Manufacturing targets
-
Education targets
Countries (4)
-
Colombia targets
-
Russian Federation targets
-
Hong Kong targets
-
Belarus targets
Indicators (95)
-
stix 100/100 Revoked
Win32:DropperX-gen\ [Drp]
· Valid until 09/04/2024 · Source: AlienVault -
stix 100/100 Revoked· Valid until 06/09/2023 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 07/05/2024 · Source: AlienVault
-
recoveryonpoint.duckdns.orgindicatesstix 100/100 Revoked· Valid until 18/05/2024 · Source: AlienVault -
stix 100/100 Revoked· Valid until 09/04/2024 · Source: AlienVault
-
stix 100/100 Revoked· Valid until 07/05/2024 · Source: AlienVault
-
dc5b-163-123-142-137.ngrok.ioindicatesstix 100/100 Revoked· Valid until 16/09/2023 · Source: AlienVault