Thrip is an espionage group that has targeted satellite communications, telecoms, and defense contractor companies in the U.S. and Southeast Asia. The group uses custom malware as well as "living off the land" techniques. 1
- Symantec Thrip June 2018
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1059.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1048.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1219.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol | — |
| T1059.001 | PowerShell | — |
| T1219.002 | Remote Desktop Software | — |
| T1588.002 | Tool | — |
Aliases
Thrip
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.