Reports, blog posts and papers that MITRE cites as evidence.
3865 references
| Citation | Description |
|---|---|
| Unit 42 Valak July 2020 | Duncan, B. (2020, July 24). Evolution of Valak, from Its Beginnings to Mass Distribution. Retrieved August 31, 2020. |
| Unit 42 WhisperGate January 2022 | Falcone, R. et al.. (2022, January 20). Threat Brief: Ongoing Russia and Ukraine Cyber Conflict. Retrieved March 10, 2022. |
| Unit42 3cx supply chain 2023 | Robert Falcone, Josh Grunzweig. (2023, March 30). Threat Brief: 3CXDesktopApp Supply Chain Attack. Retrieved September 15, 2025. |
| Unit42 AcidBox June 2020 | Reichel, D. and Idrizovic, E. (2020, June 17). AcidBox: Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations. Retrieved March 16, 2021. |
| Unit42 Agrius 2023 | Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024. |
| Unit42 Azorult Nov 2018 | Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018. |
| Unit42 BabyShark Apr 2019 | Lim, M.. (2019, April 26). BabyShark Malware Part Two – Attacks Continue Using KimJongRAT and PCRat . Retrieved October 7, 2019. |
| Unit42 BabyShark Feb 2019 | Unit 42. (2019, February 22). New BabyShark Malware Targets U.S. National Security Think Tanks. Retrieved October 7, 2019. |
| Unit42 Banking Trojans Hooking 2022 | Or Chechik. (2022, October 31). Banking Trojan Techniques: How Financially Motivated Malware Became Infrastructure. Retrieved September 27, 2023. |
| Unit42 BendyBear Feb 2021 | Harbison, M. (2021, February 9). BendyBear: Novel Chinese Shellcode Linked With Cyber Espionage Group BlackTech. Retrieved February 16, 2021. |
| Unit42 Bookworm Nov2015 | Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025. |
| Unit42 Cannon Nov 2018 | Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018. |
| Unit42 Chinese VSCode 06 September 2024 | Tom Fakterman. (2024, September 6). Chinese APT Abuses VSCode to Target Government in Asia. Retrieved March 24, 2025. |
| Unit42 Clop April 2021 | Santos, D. (2021, April 13). Threat Assessment: Clop Ransomware. Retrieved July 30, 2021. |
| Unit42 ComboJack 2018 | Levene, B., Grunzweig, J. (2018, March 5). Sure, I’ll take that! New ComboJack Malware Alters Clipboards to Steal Cryptocurrency. Retrieved November 25, 2024. |
| Unit42 CookieMiner Jan 2019 | Chen, y., et al. (2019, January 31). Mac Malware Steals Cryptocurrency Exchanges’ Cookies. Retrieved July 22, 2020. |
| Unit42 DNS Mar 2019 | Hinchliffe, A. (2019, March 15). DNS Tunneling: how DNS can be (ab)used by malicious actors. Retrieved October 3, 2020. |
| Unit42 DarkHydrus Jan 2019 | Lee, B., Falcone, R. (2019, January 18). DarkHydrus delivers new Trojan that can use Google Drive for C2 communications. Retrieved April 17, 2019. |
| Unit42 Emissary Panda May 2019 | Falcone, R. and Lancaster, T. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019. |
| Unit42 LockerGoga 2019 | Harbison, M. (2019, March 26). Born This Way? Origins of LockerGoga. Retrieved April 16, 2019. |
| Unit42 Luna Moth | Kristopher Russo. (n.d.). Luna Moth Callback Phishing Campaign. Retrieved February 2, 2023. |
| Unit42 Molerat Mar 2020 | Falcone, R., et al. (2020, March 3). Molerats Delivers Spark Backdoor to Government and Telecommunications Organizations. Retrieved December 14, 2020. |
| Unit42 OceanLotus 2017 | Erye Hernandez and Danny Tsechansky. (2017, June 22). The New and Improved macOS Backdoor from OceanLotus. Retrieved September 8, 2023. |
| Unit42 OilRig Nov 2018 | Falcone, R., Wilhoit, K.. (2018, November 16). Analyzing OilRig’s Ops Tempo from Testing to Weaponization to Delivery. Retrieved April 23, 2019. |
| Unit42 OilRig Playbook 2023 | Unit42. (2016, May 1). Evasive Serpens Unit 42 Playbook Viewer. Retrieved February 6, 2023. |
| Unit42 PlugX June 2017 | Lancaster, T., Idrizovic, E. (2017, June 27). Paranoid PlugX. Retrieved April 19, 2019. |
| Unit42 RDAT July 2020 | Falcone, R. (2020, July 22). OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory. Retrieved July 28, 2020. |
| Unit42 Redaman January 2019 | Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020. |
| Unit42 SUPERNOVA Dec 2020 | Tennis, M. (2020, December 17). SUPERNOVA: A Novel .NET Webshell. Retrieved February 22, 2021. |
| Unit42 SilverTerrier 2016 | Renals, P., Conant, S. (2016). SILVERTERRIER: The Next Evolution in Nigerian Cybercrime. Retrieved November 13, 2018. |
| Unit42 SilverTerrier 2018 | Unit42. (2016). SILVERTERRIER: THE RISE OF NIGERIAN BUSINESS EMAIL COMPROMISE. Retrieved November 13, 2018. |
| Unit42 Sofacy Dec 2018 | Lee, B., Falcone, R. (2018, December 12). Dear Joohn: The Sofacy Group’s Global Campaign. Retrieved April 19, 2019. |
| Unit42 Xbash Sept 2018 | Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018. |
| Unit42KelleyVaya_BlingLibra_Aug2024 | Kelley, M., Vaya, C. (2024, August 23). Bling Libra’s Tactical Evolution: The Threat Actor Group Behind ShinyHunters Ransomware. Retrieved May 18, 2026. |
| Unprotect Shortcut | Unprotect Project. (2019, March 18). Shortcut Hiding. Retrieved October 3, 2023. |
| Uptycs Black Basta ESXi June 2022 | Sharma, S. and Hegde, N. (2022, June 7). Black basta Ransomware Goes Cross-Platform, Now Targets ESXi Systems. Retrieved March 8, 2023. |
| Uptycs Confucius APT Jan 2021 | Uptycs Threat Research Team. (2021, January 12). Confucius APT deploys Warzone RAT. Retrieved December 17, 2021. |
| Uptycs Warzone UAC Bypass November 2020 | Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022. |
| VB .NET Mar 2020 | .NET Team. (2020, March 11). Visual Basic support planned for .NET 5.0. Retrieved June 23, 2020. |
| VB Microsoft | Microsoft. (n.d.). Visual Basic documentation. Retrieved June 23, 2020. |
| VDSO Aug 2005 | Petersson, J. (2005, August 14). What is linux-gate.so.1?. Retrieved June 16, 2020. |
| VEC | CloudFlare. (n.d.). What is vendor email compromise (VEC)?. Retrieved September 12, 2023. |
| VMRay OSAMiner dynamic analysis 2021 | VMRAY. (2021, January 14). Malware Analysis Spotlight: OSAMiner Uses Run-Only AppleScripts to Evade Detection. Retrieved October 4, 2022. |
| VMware VIBs | Kyle Gleed. (2011, September 13). What's in a VIB?. Retrieved March 27, 2025. |
| VNC Authentication | Tegan. (2019, August 15). Setting up System Authentication. Retrieved September 20, 2021. |
| VNC Vulnerabilities | Sergiu Gatlan. (2019, November 22). Dozens of VNC Vulnerabilities Found in Linux, Windows Solutions. Retrieved September 20, 2021. |
| VPNFilter Router | Tung, Liam. (2018, May 29). FBI to all router users: Reboot now to neuter Russia's VPNFilter malware. Retrieved March 7, 2024. |
| Validin Contagious Interview North Korea ClickFix January 2025 | Efstratios Lontzetidis. (2025, January 16). Lazarus APT: Techniques for Hunting Contagious Interview. Retrieved October 20, 2025. |
| Varonis | Jason Hill. (2023, February 8). VMware ESXi in the Line of Ransomware Fire. Retrieved March 26, 2025. |
| Varonis Power Automate Data Exfiltration | Eric Saraga. (2022, February 2). Using Power Automate for Covert Data Exfiltration in Microsoft 365. Retrieved May 27, 2022. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
