MITRE ATT&CK / Software / S1071

Rubeus

ID
S1071
Type
Tool
Platforms
Windows
Source
attack.mitre.org
MITRE last modified
12 May 2026

Rubeus is a C# toolset designed for raw Kerberos interaction that has been used since at least 2020, including in ransomware operations.[1][2][3][4]

Techniques used (5)

Groups using it (1)

References

  1. GitHub Rubeus March 2023
  2. FireEye KEGTAP SINGLEMALT October 2020
  3. DFIR Ryuk's Return October 2020
  4. DFIR Ryuk 2 Hour Speed Run November 2020