Real-world descriptions of how a group, tool or campaign used a technique.
10 examples
| Technique | Used by | Procedure example |
|---|---|---|
| T1027.015 Compression |
GroupKimsuky | Kimsuky has delivered malicious payloads within Zip archives. |
| T1027.015 Compression |
GroupGamaredon Group | Gamaredon Group has delivered malicious payloads within compressed archives and zip files. |
| T1027.015 Compression |
GroupTA2541 | TA2541 has used compressed and char-encoded scripts in operations. |
| T1027.015 Compression |
GroupHigaisa | Higaisa used Base64 encoded compressed payloads. |
| T1027.015 Compression |
GroupLeviathan | Leviathan has obfuscated code using gzip compression. |
| T1027.015 Compression |
GroupMofang | Mofang has compressed the ShimRat executable within malicious email attachments. |
| T1027.015 Compression |
GroupMolerats | Molerats has delivered compressed executables within ZIP files to victims. |
| T1027.015 Compression |
GroupVOID MANTICORE | VOID MANTICORE has compressed their payloads by leveraging zip files. |
| T1027.015 Compression |
GroupWIRTE | WIRTE has compressed malicious files within RAR and ZIP archives for obfuscation. |
| T1027.015 Compression |
GroupThreat Group-3390 | Threat Group-3390 malware is compressed with LZNT1 compression. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
