group

Thrip G0076

Created: 17 October 2018
Last modified: 31 July 2026
Alias: Thrip

Thrip is an espionage group that has targeted satellite communications, telecoms, and defense contractor companies in the U.S. and Southeast Asia. The group uses custom malware as well as "living off the land" techniques. [1]

TechniquesBottom 13%

TacticsBottom 20%

Tools & malware47th pct

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

MITRE reference G0076

Exfiltration Over Unencrypted Non-C2 Protocol T1048.003↗

Thrip has used WinSCP to exfiltrate data from a targeted organization over FTP.2

Exfiltration26 detection rules

PowerShell T1059.001↗

Thrip leveraged PowerShell to run commands to download payloads, traverse the compromised networks, and carry out reconnaissance.3

Execution297 detection rules

Remote Desktop Software T1219.002↗

Thrip used a cloud-based remote access software called LogMeIn for their attacks.4

Command and Control46 detection rules

Tool T1588.002↗

Thrip has obtained and used tools such as Mimikatz and PsExec.5

Resource Development13 detection rules

Standing G0076

Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques4Bottom 13%

13th percentile · 87% of 176 ATT&CK groups have more Enterprise techniques.

Tactics4Bottom 20%

20th percentile · 80% of 176 ATT&CK groups have more tactics spanned.

Tools & malware347th pct

47th percentile · 53% of 176 ATT&CK groups have more tools and malware.

Campaigns089% tie · 4 values

89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique36medTop 12%

88th percentile · 88% of 176 ATT&CK groups have this many detection rules per technique or fewer.

Tests / technique4med

Detection coverage G0076

382 distinct rules cover the 4 techniques recorded for this group. The 383 technique-to-rule mappings resolve to 382 distinct rules, because one rule can cover several techniques. 301 Sigma · 81 Splunk.

4 covered by at least one rule382 distinct rules in total

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs

© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org

MITRE reference G0076

Reach

Coverage

How it got here