Reports, blog posts and papers that MITRE cites as evidence.
3865 references
| Citation | Description |
|---|---|
| IBM Ransomware Trends September 2020 | Singleton, C. and Kiefer, C. (2020, September 28). Ransomware 2020: Attack Trends Affecting Organizations Worldwide. Retrieved September 20, 2021. |
| IBM Storwize | IBM Support. (2017, April 26). Storwize USB Initialization Tool may contain malicious code. Retrieved May 28, 2019. |
| IBM StrelaStealer 2024 | Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024. |
| IBM TA505 April 2020 | Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020. |
| IBM TrickBot Nov 2016 | Keshet, L. (2016, November 09). Tricks of the Trade: A Deeper Look Into TrickBot’s Machinations. Retrieved August 2, 2018. |
| IBM ZeroCleare Wiper December 2019 | Kessem, L. (2019, December 4). New Destructive Wiper ZeroCleare Targets Energy Sector in the Middle East. Retrieved September 4, 2024. |
| IC3-AI24 | IC3. (2024, December 3). Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud. Retrieved March 18, 2025. |
| ICANNDomainNameHijacking | ICANN Security and Stability Advisory Committee. (2005, July 12). Domain Name Hijacking: Incidents, Threats, Risks and Remediation. Retrieved November 17, 2024. |
| ICEBRG Chrome Extensions | De Tore, M., Warner, J. (2018, January 15). MALICIOUS CHROME EXTENSIONS ENABLE CRIMINALS TO IMPACT OVER HALF A MILLION USERS AND GLOBAL BUSINESSES. Retrieved January 17, 2018. |
| ICIT China's Espionage Jul 2016 | Scott, J. and Spaniel, D. (2016, July 28). ICIT Brief - China’s Espionage Dynasty: Economic Death by a Thousand Cuts. Retrieved June 7, 2018. |
| ICS Mutexes 2015 | Lenny Zeltser. (2015, March 9). How Malware Generates Mutex Names to Evade Detection. Retrieved September 19, 2024. |
| IIS Backdoor 2011 | Julien. (2011, February 2). IIS Backdoor. Retrieved June 3, 2021. |
| INCIBE-CERT LockBit MAR 2024 | INCIBE-CERT. (2024, March 14). LockBit: response and recovery actions. Retrieved February 5, 2025. |
| IRED API Hashing | spotheplanet. (n.d.). Windows API Hashing in Malware. Retrieved August 22, 2022. |
| ISACA Malware Tricks | Kolbitsch, C. (2017, November 1). Evasive Malware Tricks: How Malware Evades Detection by Sandboxes. Retrieved March 30, 2021. |
| ITOCHU Hack the Sandbox | ITOCHU Cyber & Intelligence Inc.. (2025, March 12). Hack The Sandbox: Unveiling the Truth Behind Disappearing Artifacts. Retrieved November 5, 2025. |
| ITOCHU LODEINFO JAN 2024 | ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026. |
| ITOCHU Sandbox PPT | ITOCHU Cyber & Intelligence Inc.. (n.d.). Hack The Sandbox: Unveiling the Truth Behind Disappearing Artifacts. Retrieved November 5, 2025. |
| Ignacio Udev research 2024 | Eder P. Ignacio. (2024, February 21). Leveraging Linux udev for persistence. Retrieved September 26, 2024. |
| Immersive Labs Havoc C2 APR 2024 | Immersive Content Team. (2024, April 9). Havoc C2 Framework – A Defensive Operator’s Guide. Retrieved August 13, 2025. |
| Imminent Unit42 Dec2019 | Unit 42. (2019, December 2). Imminent Monitor – a RAT Down Under. Retrieved May 5, 2020. |
| Impacket Tools | SecureAuth. (n.d.). Retrieved January 15, 2019. |
| Imperva DDoS for Hire | Imperva. (n.d.). Booters, Stressers and DDoSers. Retrieved October 4, 2020. |
| Industroyer2 Blackhat ESET | Anton Cherepanov, Robert Lipovsky. (2022, August). Industroyer2: Sandworm's Cyberwarfare Targets Ukraine's Power Grid. Retrieved April 6, 2023. |
| Industroyer2 Mandiant April 2022 | Daniel Kapellmann Zafra, Raymond Leong, Chris Sistrunk, Ken Proska, Corey Hildebrandt, Keith Lunden, Nathan Brubaker. (2022, April 25). INDUSTROYER.V2: Old Malware Learns New Tricks. Retrieved March 30, 2023. |
| Infoblox Lokibot January 2019 | Hoang, M. (2019, January 31). Malicious Activity Report: Elements of Lokibot Infostealer. Retrieved May 15, 2020. |
| Infosecinstitute RTLO Technique | Security Ninja. (2015, April 16). Spoof Using Right to Left Override (RTLO) Technique. Retrieved April 22, 2019. |
| InsiderThreat ChangeNTLM July 2017 | Warren, J. (2017, July 11). Manipulating User Passwords with Mimikatz. Retrieved December 4, 2017. |
| Installer Package Scripting Rich Trouton | Rich Trouton. (2019, August 9). Installer Package Scripting: Making your deployments easier, one ! at a time. Retrieved September 27, 2022. |
| Int SP - chat apps | Microsoft Threat Intelligence. (2023, August 2). Midnight Blizzard conducts targeted social engineering over Microsoft Teams. Retrieved February 16, 2024. |
| Intego Shlayer Apr 2018 | Vrijenhoek, Jay. (2018, April 24). New OSX/Shlayer Malware Variant Found Using a Dirty New Trick. Retrieved September 6, 2019. |
| Intego Shlayer Feb 2018 | Long, Joshua. (2018, February 21). OSX/Shlayer: New Mac malware comes out of its shell. Retrieved August 28, 2019. |
| Intel 471 REvil March 2020 | Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020. |
| Intel471 Medusa Ransomware May 2025 | Intel471. (2025, May 14). Threat hunting case study: Medusa ransomware. Retrieved October 15, 2025. |
| Intel471_SH_Aug2021 | Intel 471. (2021, August 23). Here’s how to guard your enterprise against ShinyHunters. Retrieved July 29, 2026. |
| Internet crime report 2022 | IC3. (2022). 2022 Internet Crime Report. Retrieved August 18, 2023. |
| Intezer | Nicole Fishbein. (2020, July 28). Watch Your Containers: Doki Infecting Docker Servers in the Cloud. Retrieved June 15, 2025. |
| Intezer ACBackdoor | Sanmillan, I. (2019, November 18). ACBackdoor: Analysis of a New Multiplatform Backdoor. Retrieved October 4, 2021. |
| Intezer App Service Phishing | Paul Litvak. (2020, October 8). Kud I Enter Your Server? New Vulnerabilities in Microsoft Azure. Retrieved August 18, 2022. |
| Intezer Aurora Sept 2017 | Rosenberg, J. (2017, September 20). Evidence Aurora Operation Still Active: Supply Chain Attack Through CCleaner. Retrieved February 13, 2018. |
| Intezer Doki July 20 | Fishbein, N., Kajiloti, M.. (2020, July 28). Watch Your Containers: Doki Infecting Docker Servers in the Cloud. Retrieved March 30, 2021. |
| Intezer HiddenWasp Map 2019 | Sanmillan, I. (2019, May 29). HiddenWasp Malware Stings Targeted Linux Systems. Retrieved June 24, 2019. |
| Intezer RedXOR 2021 | Joakim Kennedy and Avigayil Mechtinger. (2021, March 10). New Linux Backdoor RedXOR Likely Operated by Chinese Nation-State Actor. Retrieved September 19, 2024. |
| Intezer Russian APT Dec 2020 | Kennedy, J. (2020, December 9). A Zebra in Gopher's Clothing: Russian APT Uses COVID-19 Lures to Deliver Zebrocy. Retrieved February 22, 2021. |
| Intezer Symbiote 2022 | Joakim Kennedy and The BlackBerry Threat Research & Intelligence Team. (2022, June 9). Symbiote Deep-Dive: Analysis of a New, Nearly-Impossible-to-Detect Linux Threat. Retrieved March 24, 2025. |
| Intezer TeamTNT Explosion September 2021 | Intezer. (2021, September 1). TeamTNT Cryptomining Explosion. Retrieved October 15, 2021. |
| Intezer TeamTNT September 2020 | Fishbein, N. (2020, September 8). Attackers Abusing Legitimate Cloud Monitoring Tools to Conduct Cyber Attacks. Retrieved September 22, 2021. |
| Intrinsec Egregor Nov 2020 | Bichet, J. (2020, November 12). Egregor – Prolock: Fraternal Twins ?. Retrieved January 6, 2021. |
| Introducing Donut | The Wover. (2019, May 9). Donut - Injecting .NET Assemblies as Shellcode. Retrieved October 4, 2021. |
| Inversecos Linux Timestomping | inversecos. (2022, August 4). Detecting Linux Anti-Forensics: Timestomping. Retrieved March 26, 2025. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
