H3XA — Operational Evidence

TypeTool

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Arp](https://attack.mitre.org/software/S0099) displays and modifies information about a system's Address Resolution Protocol (ARP) cache. (Citation: TechNet Arp)

Labels

tool

9 recorded

Relationships

uses

from 2025 Poland Wiper Attacks

Campaign

uses

from APT32

Group

uses

to Remote System Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

from BlackByte

Group

uses

from C0026

Campaign

uses

from Operation AkaiRyū

Campaign

uses

from Orangeworm

Group

uses

from Turla

Group

2 external

References

mitre-attack

S0099

open

TechNet Arp

https://technet.microsoft.com/en-us/library/bb490864.aspx

open