← Matrix
AML.T0037 realized

Data from Local System

Collection ATT&CK T1005 View on ATLAS ↗

Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.

This can include basic fingerprinting information and sensitive data such as ssh keys.

> curated attacks (1)

Incident high 2022-12-25

Compromised PyTorch Dependency Chain (torchtriton)

For six days, PyTorch's nightly builds pulled a malicious 'torchtriton' package from PyPI via dependency confusion. On install it ran a binary that exfiltrated system info, environment variables, and SSH keys.