Transparent Tribe

Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registrat

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code

Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achie

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding

Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope

An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to cl

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a sp

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specifi

Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows techn

Crimson is a remote access Trojan that has been used by [Transparent Tribe](https://attack.mitre.org/groups

DarkComet is a Windows remote administration tool and backdoor.(C

njRAT is a remote access tool (RAT) that was first observed in 2012. It has been used by threat actors in t

ObliqueRAT is a remote access trojan, similar to Crimson, that h

Peppy is a Python-based remote access Trojan, active since at least 2012, with similarities to [Crimson](ht

C0011 was a suspected cyber espionage campaign conducted by [Transparent Tribe](https://attack.mitre.org/g