Threat intelligence / Campaign

Frankenstein

[Frankenstein](https://attack.mitre.org/campaigns/C0001) was described by security researchers as a highly-targeted campaign conducted by moderately sophisticated and highly resourceful threat actors in early 2019. The unidentified actors primarily relied on open source tools, including [Empire](https://attack.mitre.org/software/S0363). The campaign name refers to the actors' ability to piece together several unrelated open-source tool components.(Citation: Talos Frankenstein June 2019)

Campaign

TypeCampaign

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Frankenstein](https://attack.mitre.org/campaigns/C0001) was described by security researchers as a highly-targeted campaign conducted by moderately sophisticated and highly resourceful threat actors in early 2019. The unidentified actors primarily relied on open source tools, including [Empire](https://attack.mitre.org/software/S0363). The campaign name refers to the actors' ability to piece together several unrelated open-source tool components.(Citation: Talos Frankenstein June 2019)

28 recorded

Relationships

uses

to Automated Collection

Technique

uses

to Automated Exfiltration

Technique

uses

to Command Obfuscation

Technique

uses

to Data from Local System

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

Tool

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exploitation for Client Execution

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Malicious File

Technique

uses

to Masquerade Task or Service

Technique

uses

Technique

uses

Technique

uses

to Process Discovery

Technique

uses

to Scheduled Task

Technique

uses

to Security Software Discovery

Technique

uses

to Spearphishing Attachment

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Checks

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Template Injection

Technique

uses

Technique

uses

to Visual Basic

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

2 external

References

mitre-attack

C0001

Talos Frankenstein June 2019

https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html