ATT&CK Technique · Resource Development
T1587.001 MalwareMapped by 6 reports, 13 detection rules and 7 tracked actors on The Hunters Ledger. Technique page on attack.mitre.org.
← All techniques and the coverage heatmap
Reports
Each report maps this technique in its own ATT&CK table, at the confidence the report states. The link opens that table.
Detection rules
Rules whose ATT&CK coverage line names this technique, by detection page. The link opens the page's coverage table.
Detection rules
Rovodev AI-Co-Authored Mirai Variant + Matrix C2 (87.106.143.220)MAL_Bash_Pandora_Dropper_Family (YARA, Detection); MAL_Python_Matrix_C2_Framework_Family (YARA, Detection); MAL_JSON_Rovodev_SessionContext_FileWrite_Authoring (YARA, Detection); MAL_Python_AIGenerated_OffensiveCode_Universal_Subset (YARA, Hunting); MAL_Python_StealthAgent_AntiDebug_AntiVM_AI_Authored (YARA, Hunting); MAL_Markdown_Rovodev_WhatINeed_OperatorPrompt (YARA, Hunting); Rovodev AI Agent Sessions Directory Creation on Server Host: Potential AI-Augmented Offensive Operations (SIGMA, Hunting); Rovodev Log File_Write Tool-Call Pattern: AI-Augmented Offensive Operations Evidence (SIGMA, Hunting); Pandora-Mirai Naku Binary Distribution URI Path (SURICATA, Detection); Pandora-Mirai Pandoras-Box Binary Distribution URI Path (SURICATA, Detection); Pandora-Mirai bot.sh Reseed Download URI Pattern (SURICATA, Hunting); Naku Binary Reference in HTTP URI (Bare Substring) (SURICATA, Hunting)
Detection rules
CVE-2026-41940 cPanel Harvester Toolkit (216.126.227.49)CVE-2026-41940 cPanel Harvester Toolkit: Bespoke Component Filenames (YARA, Detection)
Tracked actors
Designations whose reports map this technique.
- UTA-2026-004: Developer of the OpenStrike multi-implant C2 toolkit, with a cracked Cobalt Strike arsenal
- UTA-2026-008: Developer and operator of the BellaMain Turkish phishing-as-a-service panel
- UTA-2026-009: Multi-product fraud operator pairing a real VPN service with a brand-impersonation phishing library
- UTA-2026-010: Rhadamanthys MaaS customer with a self-built loader (customer side only, never the vendor)
- UTA-2026-011: Financially motivated operator weaponising a cPanel authentication bypass with a custom harvesting toolkit
- UTA-2026-014: DDoS-for-hire operator running an AI co-authored C2 framework over a Pandora-Mirai botnet
- UTA-2026-023: Telecom-focused operator reaching a carrier's credential plane through a customer's managed router
ATT&CK v19.2. MITRE ATT&CK® is a registered trademark of The MITRE Corporation; technique names are MITRE's and link to MITRE's own pages. The mapping on each linked page is this publication's reading of its own evidence.