H3XA — Operational Evidence

TypeCampaign

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[C0032](https://attack.mitre.org/campaigns/C0032) was an extended campaign suspected to involve the [Triton](https://attack.mitre.org/software/S1009) adversaries with related capabilities and techniques focused on gaining a foothold within IT environments. This campaign occurred in 2019 and was distinctly different from the [Triton Safety Instrumented System Attack](https://attack.mitre.org/campaigns/C0030).(Citation: FireEye TRITON 2019)

19 recorded

Relationships

attributed-to

Group

uses

to External Remote Services

Technique

uses

to File Deletion

Technique

uses

to Image File Execution Options Injection

Technique

uses

to Local Data Staging

Technique

uses

to LSASS Memory

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

Tool

uses

to Non-Standard Port

Technique

uses

Technique

uses

to Protocol Tunneling

Technique

uses

to Remote Desktop Protocol

Technique

uses

to Scheduled Task

Technique

uses

to SSH

Technique

uses

Technique

uses

Technique

uses

to Valid Accounts

Technique

uses

to Virtual Private Server

Technique

uses

Technique

2 external

References

mitre-attack

C0032

FireEye TRITON 2019

https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html