H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Tool

Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Adversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors. Tools may also be leveraged for testing – for example, evaluating malware against commercial antivirus or endpoint detection and response (EDR) applications.(Citation: Forescout Conti Leaks 2022)(Citation: Sentinel Labs Top Tier Target 2025) Tool acquisition may involve the procurement of commercial software licenses, including for red teaming tools such as Cobalt Strike. In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities (including other adversaries). Threat actors may also crack trial versions of software.(Citation: Recorded Future Beacon 2019)

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Adversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors. Tools may also be leveraged for testing – for example, evaluating malware against commercial antivirus or endpoint detection and response (EDR) applications.(Citation: Forescout Conti Leaks 2022)(Citation: Sentinel Labs Top Tier Target 2025) Tool acquisition may involve the procurement of commercial software licenses, including for red teaming tools such as Cobalt Strike. In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities (including other adversaries). Threat actors may also crack trial versions of software.(Citation: Recorded Future Beacon 2019)

111 recorded

Relationships

mitigates
from Pre-compromise
Mitigation
subtechnique-of
to Obtain Capabilities
Technique
uses
from Anthropic AI-orchestrated Campaign
Campaign
uses
from Aoqin Dragon
Group
uses
from APT1
Group
uses
from APT19
Group
uses
from APT28
Group
uses
from APT29
Group
uses
from APT32
Group
uses
from APT33
Group
uses
from APT38
Group
uses
from APT39
Group
uses
from APT41
Group
uses
from APT42
Group
uses
from APT-C-36
Group
uses
from Aquatic Panda
Group
uses
from BackdoorDiplomacy
Group
uses
from BITTER
Group
uses
from BlackTech
Group
uses
from Blue Mockingbird
Group
uses
from BRONZE BUTLER
Group
uses
from C0010
Campaign
uses
from C0015
Campaign
uses
from C0017
Campaign
uses
from C0018
Campaign
uses
from C0021
Campaign
uses
from C0027
Campaign
uses
from C0032
Campaign
uses
from Carbanak
Group
uses
from Chimera
Group
uses
from Cinnamon Tempest
Group
uses
from Cleaver
Group
uses
from Cobalt Group
Group
uses
from Contagious Interview
Group
uses
from CopyKittens
Group
uses
from CostaRicto
Campaign
uses
from Cutting Edge
Campaign
uses
from DarkHydrus
Group
uses
from DarkVishnya
Group
uses
from Dragonfly
Group
uses
from Earth Lusca
Group
uses
from Ferocious Kitten
Group
uses
from FIN10
Group
uses
from FIN13
Group
uses
from FIN5
Group
uses
from FIN6
Group
uses
from FIN7
Group
uses
from FIN8
Group
uses
from Frankenstein
Campaign
uses
from FunnyDream
Campaign
uses
from GALLIUM
Group
uses
from Gamaredon Group
Group
uses
from Gorgon Group
Group
uses
from HEXANE
Group
uses
from HomeLand Justice
Campaign
uses
from Inception
Group
uses
from INC Ransom
Group
uses
from IndigoZebra
Group
uses
from Ke3chang
Group
uses
from Kimsuky
Group
uses
from LAPSUS$
Group
uses
from Lazarus Group
Group
uses
from Leafminer
Group
uses
from Lizar
Malware
uses
from Lotus Blossom
Group
uses
from LuminousMoth
Group
uses
from Magic Hound
Group
uses
from Medusa Group
Group
uses
from menuPass
Group
uses
from Metador
Group
uses
from MirrorFace
Group
uses
from Moses Staff
Group
uses
from MuddyWater
Group
uses
from Mustang Panda
Group
uses
from Night Dragon
Campaign
uses
from OilRig
Group
uses
from Operation AkaiRyū
Campaign
uses
from Operation CuckooBees
Campaign
uses
from Operation Digital Eye
Campaign
uses
from Operation Dream Job
Campaign
uses
from Operation MidnightEclipse
Campaign
uses
from Operation Spalax
Campaign
uses
from Operation Wocao
Campaign
uses
from Patchwork
Group
uses
from PittyTiger
Group
uses
from Play
Group
uses
from POLONIUM
Group
uses
from Salesforce Data Exfiltration
Campaign
uses
from Salt Typhoon
Group
uses
from Sandworm Team
Group
uses
from Scattered Spider
Group
uses
from Sea Turtle
Group
uses
from ShadowRay
Campaign
uses
from SharePoint ToolShell Exploitation
Campaign
uses
from ShinyHunters
Group
uses
from Silence
Group
uses
from Silent Librarian
Group
uses
from SPACEHOP Activity
Campaign
uses
from Star Blizzard
Group
uses
from Storm-1811
Group
uses
from TA2541
Group
uses
from TA505
Group
uses
from Threat Group-3390
Group
uses
from Thrip
Group
uses
from Triton Safety Instrumented System Attack
Campaign
uses
from Turla
Group
uses
from VOID MANTICORE
Group
uses
from Volt Typhoon
Group
uses
from Whitefly
Group
uses
from WIRTE
Group
uses
from Wizard Spider
Group
5 external

References

mitre-attack
T1588.002
open
Sentinel Labs Top Tier Target 2025
https://www.sentinelone.com/labs/top-tier-target-what-it-takes-to-defend-a-cybersecurity-company-from-todays-adversaries/
open
Analyzing CS Dec 2020
https://www.randhome.io/blog/2020/12/20/analyzing-cobalt-strike-for-fun-and-profit/
open
Recorded Future Beacon 2019
https://www.recordedfuture.com/blog/identifying-cobalt-strike-servers
open
Forescout Conti Leaks 2022
https://www.forescout.com/resources/analysis-of-conti-leaks/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance