Reports, blog posts and papers that MITRE cites as evidence.
3865 references
| Citation | Description |
|---|---|
| CISA MSS Sep 2020 | CISA. (2020, September 14). Alert (AA20-258A): Chinese Ministry of State Security-Affiliated Cyber Threat Actor Activity. Retrieved October 1, 2020. |
| CISA Medusa Group Medusa Ransomware March 2025 | Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025. |
| CISA Play Ransomware Advisory December 2023 | CISA. (2023, December 18). #StopRansomware: Play Ransomware AA23-352A. Retrieved September 24, 2024. |
| CISA RansomHub AUG 2024 | CISA et al. (2024, August 29). #StopRansomware: RansomHub Ransomware. Retrieved March 17, 2025. |
| CISA Remote Monitoring and Management Software | CISA. (n.d.). Protecting Against Malicious Use of Remote Monitoring and Management Software. Retrieved February 2, 2023. |
| CISA Royal AA23-061A March 2023 | CISA. (2023, March 2). #StopRansomware: Royal Ransomware. Retrieved March 31, 2023. |
| CISA Russian Gov Critical Infra 2018 | CISA. (2018, March 16). Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved March 24, 2025. |
| CISA SPAWNCHIMERA RESURGE February 2026 | DHS/CISA. (2026, February 26). MAR-25993211-r1.v2 Ivanti Connect Secure (RESURGE): AR25-087A. Retrieved April 17, 2026. |
| CISA Scattered Spider Advisory November 2023 | CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024. |
| CISA SoreFang July 2016 | CISA. (2020, July 16). MAR-10296782-1.v1 – SOREFANG. Retrieved September 29, 2020. |
| CISA Star Blizzard Advisory December 2023 | CISA, et al. (2023, December 7). Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spear-phishing Campaigns. Retrieved June 13, 2024. |
| CISA Supernova Jan 2021 | CISA. (2021, January 27). Malware Analysis Report (AR21-027A). Retrieved February 22, 2021. |
| CISA WellMail July 2020 | CISA. (2020, July 16). MAR-10296782-3.v1 – WELLMAIL. Retrieved September 29, 2020. |
| CISA WellMess July 2020 | CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020. |
| CISA Zebrocy Oct 2020 | CISA. (2020, October 29). Malware Analysis Report (AR20-303B). Retrieved December 9, 2020. |
| CISA_AA21_200B | CISA. (2021, August 20). Alert (AA21-200B) Chinese State-Sponsored Cyber Operations: Observed TTPs. Retrieved June 21, 2022. |
| CISCO Nexus 900 Config | CISCO. (2021, September 14). Cisco Nexus 9000 Series NX-OS Fundamentals Configuration Guide, Release 7.x. Retrieved June 5, 2025. |
| CME Github September 2018 | byt3bl33d3r. (2018, September 8). SMB: Command Reference. Retrieved July 17, 2020. |
| CNET Leaks | Ng, A. (2019, January 17). Massive breach leaks 773 million email addresses, 21 million passwords. Retrieved October 20, 2020. |
| CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024 | CSIRT CTI. (2024, January 23). Stately Taurus Targets Myanmar Amidst Concerns over Military Junta’s Handling of Rebel Attacks. Retrieved August 4, 2025. |
| CSM Elderwood Sept 2012 | Clayton, M.. (2012, September 14). Stealing US business secrets: Experts ID two huge cyber 'gangs' in China. Retrieved February 15, 2018. |
| CSV Excel Macro Injection | Ishaq Mohammed . (2021, January 10). Everything about CSV Injection and CSV Excel Macro Injection. Retrieved February 7, 2022. |
| CTD PPID Spoofing Macro Mar 2019 | Tafani-Dereeper, C. (2019, March 12). Building an Office macro to spoof parent processes and command line arguments. Retrieved June 3, 2019. |
| CTU BITS Malware June 2016 | Counter Threat Unit Research Team. (2016, June 6). Malware Lingers with BITS. Retrieved January 12, 2018. |
| CVE-2024-55591 Detail | NIST NVD. (2025, January 22). Retrieved September 22, 2025. |
| CVMServer Vuln | Mickey Jin. (2021, June 3). CVE-2021-30724: CVMServer Vulnerability in macOS and iOS. Retrieved October 12, 2021. |
| CWE top 25 | Christey, S., Brown, M., Kirby, D., Martin, B., Paller, A.. (2011, September 13). 2011 CWE/SANS Top 25 Most Dangerous Software Errors. Retrieved April 10, 2019. |
| CYBERCOM Iranian Intel Cyber January 2022 | Cyber National Mission Force. (2022, January 12). Iranian intel cyber suite of malware uses open source tools. Retrieved September 30, 2022. |
| Cadet Blizzard emerges as novel threat actor | Microsoft Threat Intelligence. (2023, June 14). Cadet Blizzard emerges as a novel and distinct Russian threat actor. Retrieved July 10, 2023. |
| Cado Security Commando Cat 2024 | Nate Bill & Matt Muir. (2024, February 1). The Nine Lives of Commando Cat: Analysing a Novel Malware Campaign Targeting Docker. Retrieved April 4, 2025. |
| Cado Security Denonia | Matt Muir. (2022, April 6). Cado Discovers Denonia: The First Malware Specifically Targeting Lambda. Retrieved May 27, 2022. |
| Cado Security P2PInfect 2023 | jbowen. (2023, December 4). P2Pinfect - New Variant Targets MIPS Devices. Retrieved March 18, 2025. |
| Cado Security TeamTNT Worm August 2020 | Cado Security. (2020, August 16). Team TNT – The First Crypto-Mining Worm to Steal AWS Credentials. Retrieved September 22, 2021. |
| Camba RARSTONE | Camba, A. (2013, February 27). BKDR_RARSTONE: New RAT to Watch Out For. Retrieved January 8, 2016. |
| CameraShy | ThreatConnect Inc. and Defense Group Inc. (DGI). (2015, September 23). Project CameraShy: Closing the Aperture on China's Unit 78020. Retrieved December 17, 2015. |
| Campbell 2014 | Campbell, C. (2014). The Secret Life of Krbtgt. Retrieved November 17, 2024. |
| Cantoris Computing | Cantoris. (2016, July 22). PowerShell Malware. Retrieved December 12, 2024. |
| Carbon Black Emotet Apr 2019 | Lee, S.. (2019, April 24). Emotet Using WMI to Launch PowerShell Encoded Code. Retrieved May 24, 2019. |
| Carbon Black HotCroissant April 2020 | Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020. |
| Carbon Black JCry May 2019 | Lee, S.. (2019, May 14). JCry Ransomware. Retrieved June 18, 2019. |
| Carbon Black Obfuscation Sept 2016 | Tedesco, B. (2016, September 23). Security Alert Summary. Retrieved February 12, 2018. |
| Carbon Black Shlayer Feb 2019 | Carbon Black Threat Analysis Unit. (2019, February 12). New macOS Malware Variant of Shlayer (OSX) Discovered. Retrieved August 8, 2019. |
| Carbon Black Squiblydoo Apr 2016 | Nolen, R. et al.. (2016, April 28). Threat Advisory: “Squiblydoo” Continues Trend of Attackers Using Native OS Tools to “Live off the Land”. Retrieved April 9, 2018. |
| CarbonBlack Conti July 2020 | Baskin, B. (2020, July 8). TAU Threat Discovery: Conti Ransomware. Retrieved February 17, 2021. |
| CarbonBlack LockerGoga 2019 | CarbonBlack Threat Analysis Unit. (2019, March 22). TAU Threat Intelligence Notification – LockerGoga Ransomware. Retrieved April 16, 2019. |
| CarbonBlack RobbinHood May 2019 | Lee, S. (2019, May 17). CB TAU Threat Intelligence Notification: RobbinHood Ransomware Stops 181 Windows Services Before Encryption. Retrieved July 29, 2019. |
| Carl Hurd March 2019 | Carl Hurd 2019, March 26 VPNFilter Deep Dive Retrieved. 2019/03/28 |
| Carnal Ownage Password Filters Sept 2013 | Fuller, R. (2013, September 11). Stealing passwords every time they change. Retrieved November 21, 2017. |
| Carnegie Mellon University Supernova Dec 2020 | Carnegie Mellon University. (2020, December 26). SolarWinds Orion API authentication bypass allows remote command execution. Retrieved February 22, 2021. |
| Cary Esentutl | Cary, M. (2018, December 6). Locked File Access Using ESENTUTL.exe. Retrieved September 5, 2019. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
