Reports, blog posts and papers that MITRE cites as evidence.
3865 references
| Citation | Description |
|---|---|
| Threatexpress MetaTwin 2017 | Vest, J. (2017, October 9). Borrowing Microsoft MetaData and Signatures to Hide Binary Payloads. Retrieved September 10, 2019. |
| Threatpost Hancitor | Tom Spring. (2017, January 11). Spammers Revive Hancitor Downloader Campaigns. Retrieved August 13, 2020. |
| Threatpost Lizar May 2021 | Seals, T. (2021, May 14). FIN7 Backdoor Masquerades as Ethical Hacking Tool. Retrieved February 2, 2022. |
| Threatpost New Op Sharpshooter Data March 2019 | L. O'Donnell. (2019, March 3). RSAC 2019: New Operation Sharpshooter Data Reveals Higher Complexity, Scope. Retrieved September 26, 2022. |
| Threatpost Sauron | Michael Mimoso. (2016, August 8). ProjectSauron APT On Par With Equation, Flame, Duqu. Retrieved January 10, 2024. |
| Tilbury 2014 | Tilbury, C. (2014, August 28). Registry Analysis with CrowdResponse. Retrieved November 17, 2024. |
| Tilbury Windows Credentials | Chad Tilbury. (2017, August 8). 1Windows Credentials: Attack, Mitigation, Defense. Retrieved February 21, 2020. |
| Timac DYLD_INSERT_LIBRARIES | Timac. (2012, December 18). Simple code injection using DYLD_INSERT_LIBRARIES. Retrieved March 26, 2020. |
| Token tactics | Microsoft Incident Response. (2022, November 16). Token tactics: How to prevent, detect, and respond to cloud token theft. Retrieved December 26, 2023. |
| Trails-DNS | SecurityTrails. (2018, March 14). Wrong Bind Configuration Exposes the Complete List of Russian TLD's to the Internet. Retrieved June 5, 2024. |
| Trap Manual | ss64. (n.d.). trap. Retrieved May 21, 2019. |
| Treasury EvilCorp Dec 2019 | U.S. Department of Treasury. (2019, December 5). Treasury Sanctions Evil Corp, the Russia-Based Cybercriminal Group Behind Dridex Malware. Retrieved September 15, 2021. |
| Treasury North Korean Cyber Groups September 2019 | US Treasury . (2019, September 13). Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups. Retrieved September 29, 2021. |
| Trellix Darkgate 2023 | Ernesto Fernández Provecho, Pham Duy Phuc, Ciana Driscoll & Vinoo Thomas. (2023, November 21). The Continued Evolution of the DarkGate Malware-as-a-Service. Retrieved February 9, 2024. |
| Trellix Rnasomhouse 2024 | Pham Duy Phuc, Max Kersten, Noël Keijzer, and Michaël Schrijver. (2024, February 14). RansomHouse am See. Retrieved March 26, 2025. |
| Trellix Scattered Spider MO August 2023 | Trellix et. al.. (2023, August 17). Scattered Spider: The Modus Operandi. Retrieved March 18, 2024. |
| Trellix-Qakbot | Pham Duy Phuc, John Fokker J.E., Alejandro Houspanossian and Mathanraj Thangaraju. (2023, March 7). Qakbot Evolves to OneNote Malware Distribution. Retrieved June 7, 2024. |
| TrellixQakbot | Pham Duy Phuc, John Fokker J.E., Alejandro Houspanossian and Mathanraj Thangaraju. (2023, March 7). Qakbot Evolves to OneNote Malware Distribution. Retrieved August 1, 2024. |
| Trend Micro | Karen Victor. (2020, May 18). Reflective Loading Runs Netwalker Fileless Ransomware. Retrieved September 30, 2022. |
| Trend Micro - Int SP | Trend Micro. (n.d.). Retrieved February 16, 2024. |
| Trend Micro 3CX AppleJeus ICONICSTEALER March 2023 | Trend Micro Research. (2023, March 30). Preventing and Detecting Attacks Involving 3CX Desktop App. Retrieved October 21, 2025. |
| Trend Micro APT Attack Tools | Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools of the Trade. Retrieved December 2, 2015. |
| Trend Micro Agenda Ransomware AUG 2022 | Magdy, S. et al. (2022, August 25). New Golang Ransomware Agenda Customizes Attacks. Retrieved September 26, 2025. |
| Trend Micro Agenda Ransomware OCT 2025 | Trend Micro. (2025, October 23). Agenda Ransomware Deploys Linux Variant on Windows Systems Through Remote Management Tools and BYOVD Techniques. Retrieved March 26, 2026. |
| Trend Micro AvosLocker Apr 2022 | Trend Micro Research. (2022, April 4). Ransomware Spotlight AvosLocker. Retrieved January 11, 2023. |
| Trend Micro Banking Malware Jan 2019 | Salvio, J.. (2014, June 27). New Banking Malware Uses Network Sniffing for Data Theft. Retrieved March 25, 2019. |
| Trend Micro Black Basta May 2022 | Gonzalez, I., Chavez I., et al. (2022, May 9). Examining the Black Basta Ransomware’s Infection Routine. Retrieved March 7, 2023. |
| Trend Micro Black Basta October 2022 | Kenefick, I. et al. (2022, October 12). Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike. Retrieved February 6, 2023. |
| Trend Micro Black Basta Spotlight September 2022 | Trend Micro. (2022, September 1). Ransomware Spotlight Black Basta. Retrieved March 8, 2023. |
| Trend Micro CPL | Merces, F. (2014). CPL Malware Malicious Control Panel Items. Retrieved November 1, 2017. |
| Trend Micro Carberp February 2014 | Trend Micro. (2014, February 27). CARBERP. Retrieved July 29, 2020. |
| Trend Micro Cheerscrypt May 2022 | Dela Cruz, A. et al. (2022, May 25). New Linux-Based Ransomware Cheerscrypt Targeting ESXi Devices Linked to Leaked Babuk Source Code. Retrieved December 19, 2023. |
| Trend Micro Conficker | Trend Micro. (2014, March 18). Conficker. Retrieved February 18, 2021. |
| Trend Micro Cyclops Blink March 2022 | Haquebord, F. et al. (2022, March 17). Cyclops Blink Sets Sights on Asus Routers. Retrieved March 17, 2022. |
| Trend Micro DRBControl February 2020 | Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021. |
| Trend Micro Daserf Nov 2017 | Chen, J. and Hsieh, M. (2017, November 7). REDBALDKNIGHT/BRONZE BUTLER’s Daserf Backdoor Now Using Steganography. Retrieved December 27, 2017. |
| Trend Micro Deep Dive Into Defacement | Marco Balduzzi, Ryan Flores, Lion Gu, Federico Maggi, Vincenzo Ciancaglini, Roel Reyes, Akira Urano. (n.d.). A Deep Dive into Defacement: How Geopolitical Events Trigger Web Attacks. Retrieved April 19, 2019. |
| Trend Micro Earth Kasha Anel NOV 2024 | Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026. |
| Trend Micro Earth Kasha NOV 2024 | Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026. |
| Trend Micro Earth Kasha Updates APR 2025 | Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026. |
| Trend Micro Earth Simnavaz October 2024 | Fahmy, M. et al. (2024, October 11). Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against Middle East. Retrieved November 27, 2024. |
| Trend Micro Emotet 2020 | Cybercrime & Digital Threat Team. (2020, February 13). Emotet Now Spreads via Wi-Fi. Retrieved February 16, 2022. |
| Trend Micro Emotet Jan 2019 | Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019. |
| Trend Micro Exposed Docker APIs | Oliveira, A. (2019, May 30). Infected Containers Target Docker via Exposed APIs. Retrieved April 6, 2021. |
| Trend Micro Exposed Docker Server | Remillano II, A., et al. (2020, June 20). XORDDoS, Kaiji Variants Target Exposed Docker Servers. Retrieved April 5, 2021. |
| Trend Micro FIN6 October 2019 | Chen, J. (2019, October 10). Magecart Card Skimmers Injected Into Online Shops. Retrieved September 9, 2020. |
| Trend Micro HeartBeat Campaign January 2013 | Roland Dela Paz. (2003, January 3). The HeartBeat APT Campaign. Retrieved October 17, 2021. |
| Trend Micro IXESHE 2012 | Sancho, D., et al. (2012, May 22). IXESHE An APT Campaign. Retrieved June 7, 2019. |
| Trend Micro Iron Tiger April 2021 | Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021. |
| Trend Micro KillDisk 1 | Fernando Merces, Byron Gelera, Martin Co. (2018, June 7). KillDisk Variant Hits Latin American Finance Industry. Retrieved January 12, 2021. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
