Reports, blog posts and papers that MITRE cites as evidence.
3865 references
| Citation | Description |
|---|---|
| Browser Adrozek | Microsoft Threat Intelligence. (2020, December 10). Widespread malware campaign seeks to silently inject ads into search results, affects multiple browsers. Retrieved February 26, 2024. |
| Browser-updates | Dusty Miller. (2023, October 17). Are You Sure Your Browser is Up to Date? The Current Landscape of Fake Browser Updates . Retrieved February 13, 2024. |
| Bugcrowd Replay Attack | Bugcrowd. (n.d.). Replay Attack. Retrieved September 27, 2023. |
| Burke/CISA ClickOnce BlackHat | William Joseph Burke III. (2019, August 7). CLICKONCE AND YOU’RE IN: When .appref-ms abuse is operating as intended. Retrieved September 9, 2024. |
| Burke/CISA ClickOnce Paper | William J. Burke IV. (n.d.). Appref-ms Abuse for Code Execution & C2. Retrieved September 9, 2024. |
| BushidoToken Akira 2023 | Will Thomas. (2023, September 15). Tracking Adversaries: Akira, another descendent of Conti. Retrieved February 21, 2024. |
| BushidoToken Qilin RaaS JUN 2024 | Thomas, W. (2024, June 12). Tracking Adversaries: The Qilin RaaS. Retrieved September 26, 2025. |
| Bypassing CloudTrail in AWS Service Catalog | Nick Frichette. (2023, March 20). Bypassing CloudTrail in AWS Service Catalog, and Other Logging Research. Retrieved September 18, 2023. |
| CAL_MuddyWater_Mar2026 | Ctrl-Alt-Intel. (2026, March 4). MuddyWater Exposed: Inside an Iranian APT operation . Retrieved April 6, 2026. |
| CCCS ArcaneDoor 2024 | Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025. |
| CERN Windigo June 2019 | CERN. (2019, June 4). 2019/06/04 Advisory: Windigo attacks. Retrieved February 10, 2021. |
| CERT AT Fortinent Ransomware 2025 | CERT Austria. (2025, March 20). Ransomware-Gruppen nutzen weiterhin kritische Fortinet-Schwachstellen - Warnung vor gepatchten, aber bereits kompromittierten Geräten. Retrieved March 31, 2025. |
| CERT Polska | CERT Polska. (2026, January 30). Energy Sector Incident Report – 29 December. Retrieved April 22, 2026. |
| CERT-EE Gamaredon January 2021 | CERT-EE. (2021, January 27). Gamaredon Infection: From Dropper to Entry. Retrieved February 17, 2022. |
| CERT-EU Golden Ticket Protection | Abolins, D., Boldea, C., Socha, K., Soria-Machado, M. (2016, April 26). Kerberos Golden Ticket Protection. Retrieved July 13, 2017. |
| CERT-FR PYSA April 2020 | CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021. |
| CERT-UA TelecomAttack 2023 | CERT-UA. (2023, October 15). Peculiarities of destructive Sandworm cyber attacks against Ukrainian providers (CERT-UA#7627). Retrieved November 25, 2024. |
| CERT-UA WinterVivern 2023 | CERT-UA. (2023, February 1). UAC-0114 aka Winter Vivern to target Ukrainian and Polish GOV entities (CERT-UA#5909). Retrieved July 29, 2024. |
| CG 2014 | CG. (2014, May 20). Mimikatz Against Virtual Machine Memory Part 1. Retrieved November 12, 2014. |
| CIRCL PlugX March 2013 | Computer Incident Response Center Luxembourg. (2013, March 29). Analysis of a PlugX variant. Retrieved November 5, 2018. |
| CIS Emotet Apr 2017 | CIS. (2017, April 28). Emotet Changes TTPs and Arrives in United States. Retrieved January 17, 2019. |
| CIS Emotet Dec 2018 | CIS. (2018, December 12). MS-ISAC Security Primer- Emotet. Retrieved March 25, 2019. |
| CIS Multiple SMB Vulnerabilities | CIS. (2017, May 15). Multiple Vulnerabilities in Microsoft Windows SMB Server Could Allow for Remote Code Execution. Retrieved April 3, 2018. |
| CISA AA20-239A BeagleBoyz August 2020 | DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021. |
| CISA AA20-259A Iran-Based Actor September 2020 | CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020. |
| CISA AA20-296A Berserk Bear December 2020 | CISA. (2020, December 1). Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets. Retrieved December 9, 2021. |
| CISA AA20-301A Kimsuky | CISA, FBI, CNMF. (2020, October 27). https://us-cert.cisa.gov/ncas/alerts/aa20-301a. Retrieved November 4, 2020. |
| CISA AA20-352A 2021 | CISA. (2021, April 15). Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations. Retrieved August 30, 2024. |
| CISA AA21-200A APT40 July 2021 | CISA. (2021, July 19). (AA21-200A) Joint Cybersecurity Advisory – Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department. Retrieved August 12, 2021. |
| CISA AA24-038A PRC Critical Infrastructure February 2024 | CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024. |
| CISA AR18-352A Quasar RAT December 2018 | CISA. (2018, December 18). Analysis Report (AR18-352A) Quasar Open-Source Remote Administration Tool. Retrieved August 1, 2022. |
| CISA AR21-126A FIVEHANDS May 2021 | CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021. |
| CISA Akira Ransomware APR 2024 | CISA et al. (2024, April 18). #StopRansomware: Akira Ransomware. Retrieved December 10, 2024. |
| CISA AppleJeus Feb 2021 | Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021. |
| CISA BRICKSTORM UNC5221 AR25-338A February 2026 | DHS/CISA. (2026, February 11). AR25-338A: BRICKSTORM Backdoor. Retrieved April 16, 2026. |
| CISA ComRAT Oct 2020 | CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020. |
| CISA EB Aug 2020 | Cybersecurity and Infrastructure Security Agency. (2020, August 26). MAR-10301706-1.v1 - North Korean Remote Access Tool: ECCENTRICBANDWAGON. Retrieved March 18, 2021. |
| CISA GRU29155 2024 | US Cybersecurity & Infrastructure Security Agency et al. (2024, September 5). Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Retrieved September 6, 2024. |
| CISA ICS Advisory ICSA-10-272-01 | CISA. (2010, September 10). ICS Advisory (ICSA-10-272-01). Retrieved December 7, 2020. |
| CISA IDN ST05-016 | CISA. (2019, September 27). Security Tip (ST05-016): Understanding Internationalized Domain Names. Retrieved October 20, 2020. |
| CISA IT Service Providers | CISA. (n.d.). APTs Targeting IT Service Provider Customers. Retrieved November 16, 2020. |
| CISA Iran Albanian Attacks September 2022 | CISA. (2022, September 23). AA22-264A Iranian State Actors Conduct Cyber Operations Against the Government of Albania. Retrieved August 6, 2024. |
| CISA Karakurt 2022 | Cybersecurity Infrastructure and Defense Agency. (2022, June 2). Karakurt Data Extortion Group. Retrieved March 10, 2023. |
| CISA Leviathan 2024 | CISA et al. (2024, July 8). People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action. Retrieved February 3, 2025. |
| CISA LockBit 2023 | CISA. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved March 24, 2025. |
| CISA Lokibot September 2020 | DHS/CISA. (2020, September 22). Alert (AA20-266A) LokiBot Malware . Retrieved September 15, 2021. |
| CISA MAR SLOTHFULMEDIA October 2020 | DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020. |
| CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020 | USG. (2020, May 12). MAR-10288834-2.v1 – North Korean Trojan: TAINTEDSCRIBE. Retrieved March 5, 2021. |
| CISA MAR-10292089-1.v2 TAIDOOR August 2021 | CISA, FBI, DOD. (2021, August). MAR-10292089-1.v2 – Chinese Remote Access Trojan: TAIDOOR. Retrieved August 24, 2021. |
| CISA MFA PrintNightmare | Cybersecurity and Infrastructure Security Agency. (2022, March 15). Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting Default Multifactor Authentication Protocols and “PrintNightmare” Vulnerability. Retrieved March 16,… |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
