ATT&CK technique · T1486
Data Encrypted for Impact
Impact· seen in 15 CISA KEV exploits
Full description, procedures and detections on attack.mitre.org
Who uses it
ATT&CK groups and malware with this technique. Highlighted: in SecurityTabs news this month.
Weaknesses that lead here
Classes of exploited vulnerability that CTID maps to this technique.
- CWE-13361 KEV CVEImproper Neutralization of Special Elements Used in a Template EngineInput is rendered as a template, so template syntax in it runs on the server.
- CWE-1901 KEV CVEInteger Overflow or WraparoundA number grows past its maximum and wraps around, so a size check passes when it shouldn't.
- CWE-1911 KEV CVEInteger Underflow (Wrap or Wraparound)A subtraction goes below zero and wraps to a huge value, typically leading to an oversized copy.
- CWE-2841 KEV CVEImproper Access ControlRestrictions on who can access a resource are missing or wrong.
- CWE-2851 KEV CVEImproper AuthorizationThe system checks who you are but not whether you're allowed to do what you're asking.
- CWE-3061 KEV CVEMissing Authentication for Critical FunctionA sensitive function requires no login at all; one of the most exploited flaws in edge devices.
- CWE-5021 KEV CVEDeserialization of Untrusted DataUntrusted bytes are turned back into live objects, which can trigger code during reconstruction.
- CWE-6391 KEV CVEAuthorization Bypass Through User-Controlled KeyChanging an id in a request (an IDOR) returns another user's data.
Controls that mitigate it (11)
NIST SP 800-53 rev5, grouped by family (CTID mapping).
AC · Access Control
CM · Configuration Management
CP · Contingency Planning
SI · System and Information Integrity
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.