APT group TTPs, machine-readable

Built on MITRE ATT&CK, not limited to MITRE ATT&CK — tracking the latest APT groups, TTPs and IOCs.

Group directory Recent TTP activity Subscribe API · MCP

193 groups · 855 techniques · 4,815 TTP records · 30 synthetic IOCs labelled · ATT&CK 20.1 · seq 10305

Recent intelligence

Read by write order; cards open the group profile

ToddyCat uses Archive via Utility

2024– verified ATT&CK

tech_t1560.001 · year · MITRE ATT&CK

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more sec…

Earth Lusca uses Malicious Link

2022– verified ATT&CK

tech_t1204.001 · year · MITRE ATT&CK

An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will…

menuPass uses DLL

2017– verified ATT&CK

tech_t1574.001 · year · MITRE ATT&CK

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by mult…

Rocke uses Security Software Discovery

2020– verified ATT&CK

tech_t1518.001 · year · MITRE ATT&CK

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agen…

APT41 uses DLL

2019– verified ATT&CK

tech_t1574.001 · year · MITRE ATT&CK

LazyScripter uses Web Services

2021– verified ATT&CK

tech_t1583.006 · year · MITRE ATT&CK

Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversar…

BlackTech uses Digital Certificates

2020– verified ATT&CK

tech_t1588.004 · year · MITRE ATT&CK

Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity…

Ember Bear uses Network Service Discovery

2022– verified ATT&CK

tech_t1046 · year · MITRE ATT&CK

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire th…

BRONZE BUTLER uses Right-to-Left Override

2018– verified ATT&CK

tech_t1036.002 · year · MITRE ATT&CK

Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. RTLO is a non-printing Unicode character that causes the text that follow…