ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Malware & tools

S0344malware

Azorult

Azorult is a commercial Trojan that is used to steal information from compromised hosts. Azorult has been observed in the wild as early as 2016. In July 2018, Azorult was seen used in a spearphishing campaign against targets in North America. Azorult has been seen used for cryptocurrency theft.

Platforms: Windows

MITRE ATT&CK ↗

Linked entities · 17

usesT1134.002Create Process with Token usesT1070.004File Deletion usesT1573.001Symmetric Cryptography usesT1033System Owner/User Discovery usesT1055.012Process Hollowing usesT1012Query Registry usesT1140Deobfuscate/Decode Files or Infor…usesT1552.001Credentials In Files usesT1555.003Credentials from Web Browsers usesT1105Ingress Tool Transfer usesT1124System Time Discovery usesT1016System Network Configuration Disc…usesT1083File and Directory Discovery usesT1082System Information Discovery usesT1113Screen Capture usesT1057Process Discovery uses byG0092TA505