Reports, blog posts and papers that MITRE cites as evidence.
3865 references
| Citation | Description |
|---|---|
| Cloudflare 2026 Threat Report New Threat Actors March 2026 | Cloudflare. (2026, March 3). Introducing the 2026 Cloudflare Threat Report. Retrieved April 18, 2026. |
| Cloudflare DMARC, DKIM, and SPF | Cloudflare. (n.d.). What are DMARC, DKIM, and SPF?. Retrieved April 8, 2025. |
| Cloudflare DNSamplficationDoS | Cloudflare. (n.d.). What is a DNS amplification attack?. Retrieved April 23, 2019. |
| Cloudflare HTTPflood | Cloudflare. (n.d.). What is an HTTP flood DDoS attack?. Retrieved April 22, 2019. |
| Cloudflare Memcrashed Feb 2018 | Marek Majkowski of Cloudflare. (2018, February 27). Memcrashed - Major amplification attacks from UDP port 11211. Retrieved April 18, 2019. |
| Cloudflare NTPamplifciationDoS | Cloudflare. (n.d.). What is a NTP amplificaiton attack?. Retrieved April 23, 2019. |
| Cloudflare ReflectionDoS May 2017 | Marek Majkowsk, Cloudflare. (2017, May 24). Reflections on reflection (attacks). Retrieved April 23, 2019. |
| Cloudflare SynFlood | Cloudflare. (n.d.). What is a SYN flood attack?. Retrieved April 22, 2019. |
| Cobalt Strike Arguments 2019 | Mudge, R. (2019, January 2). https://blog.cobaltstrike.com/2019/01/02/cobalt-strike-3-13-why-do-we-argue/. Retrieved November 19, 2021. |
| Cobalt Strike Browser Pivot | Mudge, R. (n.d.). Browser Pivoting. Retrieved January 10, 2018. |
| Cobalt Strike DCOM Jan 2017 | Mudge, R. (2017, January 24). Scripting Matt Nelson’s MMC20.Application Lateral Movement Technique. Retrieved November 21, 2017. |
| Cobalt Strike Manual 4.3 November 2020 | Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021. |
| Cobalt Strike TTPs Dec 2017 | Cobalt Strike. (2017, December 8). Tactics, Techniques, and Procedures. Retrieved November 17, 2024. |
| CobaltStrike Daddy May 2017 | Mudge, R. (2017, May 23). Cobalt Strike 3.8 – Who’s Your Daddy?. Retrieved June 4, 2019. |
| CobaltStrike Scripted Web Delivery | Strategic Cyber, LLC. (n.d.). Scripted Web Delivery. Retrieved January 23, 2018. |
| Cocomazzi FIN7 Reboot | Cocomazzi, Antonio. (2024, July 17). FIN7 Reboot | Cybercrime Gang Enhances Ops with New EDR Bypasses and Automated Attacks. Retrieved September 24, 2025. |
| Cofense Agent Tesla | James Arndt. (2023, February 21). The Rise of Agent Tesla: Understanding the Notorious Keylogger. Retrieved January 10, 2024. |
| Cofense Astaroth Sept 2018 | Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024. |
| Cofense NanoCore Mar 2018 | Patel, K. (2018, March 02). The NanoCore RAT Has Resurfaced From the Sewers. Retrieved September 25, 2024. |
| Cofense RevengeRAT Feb 2019 | Gannon, M. (2019, February 11). With Upgrades in Delivery and Support Infrastructure, Revenge RAT Malware is a Bigger Threat. Retrieved November 17, 2024. |
| Cofense SVG Smuggling 2024 | Max Gannon. (2024, March 13). SVG Files Abused in Emerging Campaigns. Retrieved March 25, 2025. |
| Cofense-redirect | Raymond, Nathaniel. (2023, August 16). Major Energy Company Targeted in Large QR Code Phishing Campaign. Retrieved January 17, 2024. |
| CoinLoader: A Sophisticated Malware Loader Campaign | Avira. (2019, November 28). CoinLoader: A Sophisticated Malware Loader Campaign. Retrieved June 5, 2023. |
| CoinTicker 2019 | Thomas Reed. (2018, October 29). Mac cryptocurrency ticker app installs backdoors. Retrieved April 23, 2019. |
| Command Five SK 2011 | Command Five Pty Ltd. (2011, September). SK Hack by an Advanced Persistent Threat. Retrieved November 17, 2024. |
| Comparitech Leak | Bischoff, P. (2020, October 15). Broadvoice database of more than 350 million customer records exposed online. Retrieved October 20, 2020. |
| Comparitech Replay Attack | Justin Schamotta. (2022, October 28). What is a replay attack?. Retrieved September 27, 2023. |
| ComputerWeekly Strider | Warwick Ashford. (2016, August 8). Strider cyber attack group deploying malware for espionage. Retrieved January 10, 2024. |
| Condi-Botnet-binaries | Joie Salvio and Roy Tay. (2023, June 20). Condi DDoS Botnet Spreads via TP-Link's CVE-2023-1389. Retrieved September 5, 2023. |
| Conficker Nuclear Power Plant | Cimpanu, C. (2016, April 26). Malware Shuts Down German Nuclear Power Plant on Chernobyl's 30th Anniversary. Retrieved February 18, 2021. |
| Container Escape | 0xn3va. (n.d.). Escaping. Retrieved May 27, 2022. |
| CopyFromScreen .NET | Microsoft. (n.d.). Graphics.CopyFromScreen Method. Retrieved March 24, 2020. |
| CopyKittens Nov 2015 | Minerva Labs LTD and ClearSky Cyber Security. (2015, November 23). CopyKittens Attack Group. Retrieved November 17, 2024. |
| Core Security Impacket | Core Security. (n.d.). Impacket. Retrieved November 2, 2017. |
| Corero SYN-ACKflood | Corero. (n.d.). What is a SYN-ACK Flood Attack?. Retrieved November 17, 2024. |
| Costa AvosLocker May 2022 | Costa, F. (2022, May 1). RaaS AvosLocker Incident Response Analysis. Retrieved January 11, 2023. |
| Costin Raiu IAmTheKing October 2020 | Costin Raiu. (2020, October 2). Costin Raiu Twitter IAmTheKing SlothfulMedia. Retrieved September 12, 2024. |
| CounterCept PPID Spoofing Dec 2018 | Loh, I. (2018, December 21). Detecting Parent PID Spoofing. Retrieved June 3, 2019. |
| CrowdStrike 2015 Global Threat Report | CrowdStrike Intelligence. (2016). 2015 Global Threat Report. Retrieved April 11, 2018. |
| CrowdStrike AQUATIC PANDA December 2021 | Wiley, B. et al. (2021, December 29). OverWatch Exposes AQUATIC PANDA in Possession of Log4Shell Exploit Tools During Hands-on Intrusion Attempt. Retrieved January 18, 2022. |
| CrowdStrike Access Brokers | CrowdStrike Intelligence Team. (2022, February 23). Access Brokers: Who Are the Targets, and What Are They Worth?. Retrieved March 10, 2023. |
| CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025 | CrowdStrike. (2025, December 4). Unveiling WARP PANDA: A New Sophisticated China-Nexus Adversary. Retrieved April 16, 2026. |
| CrowdStrike Blog | William Thomas, Adrian Liviu Arsene, Farid Hendi. (2022, February 25). CrowdStrike Falcon® Protects from New Wiper Malware Used in Ukraine Cyberattacks. Retrieved September 22, 2025. |
| CrowdStrike BloodHound April 2018 | Red Team Labs. (2018, April 24). Hidden Administrative Accounts: BloodHound to the Rescue. Retrieved October 28, 2020. |
| CrowdStrike Carbon Spider August 2021 | Loui, E. and Reynolds, J. (2021, August 30). CARBON SPIDER Embraces Big Game Hunting, Part 1. Retrieved September 20, 2021. |
| CrowdStrike Deep Panda Web Shells | RYANJ. (2014, February 20). Mo’ Shells Mo’ Problems – Deep Panda Web Shells. Retrieved September 16, 2015. |
| CrowdStrike Downgrade attack 2 | Bart Lenaerts-Bergmans. (2023, March 13). What are Downgrade Attacks?. Retrieved April 15, 2026. |
| CrowdStrike Ember Bear Profile March 2022 | CrowdStrike. (2022, March 30). Who is EMBER BEAR?. Retrieved June 9, 2022. |
| CrowdStrike Evolution of Pinchy Spider July 2021 | Meyers, Adam. (2021, July 6). The Evolution of PINCHY SPIDER from GandCrab to REvil. Retrieved March 28, 2023. |
| CrowdStrike Grim Spider May 2019 | John, E. and Carvey, H. (2019, May 30). Unraveling the Spiderweb: Timelining ATT&CK Artifacts Used by GRIM SPIDER. Retrieved May 12, 2020. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
