MITRE ATT&CKsoftware (tool)

S1071 Rubeus

Published 2023-03-29 Modified 2026-05-12 Official page ↗

Domain: enterprise
Platforms: Windows
Version: 1.2
Created: 2023-03-29

Description

Rubeus is a C# toolset designed for raw Kerberos interaction that has been used since at least 2020, including in ransomware operations.

Related

Uses · MITRE ATT&CK (5)

T1558.004 AS-REP Roasting sub-technique
T1558.001 Golden Ticket sub-technique
T1558.002 Silver Ticket sub-technique
T1558.003 Kerberoasting sub-technique
T1482 Domain Trust Discovery technique

Referenced by MITRE ATT&CK · uses (3)

C0063 2025 Poland Wiper Attacks campaign
C0060 Operation AkaiRyū campaign
G0102 Wizard Spider group

References

https://github.com/GhostPack/Rubeus GitHub Rubeus March 2023
https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html FireEye KEGTAP SINGLEMALT October 2020
https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/ DFIR Ryuk 2 Hour Speed Run November 2020
https://thedfirreport.com/2020/10/08/ryuks-return/ DFIR Ryuk's Return October 2020