T1571 · ATT&CK technique
Non-Standard Port
19 actors on record using it
Every mark is an actor ATT&CK records using this technique. Red ones also exploit a CVE in CISA KEV.
Open T1571 on attack.mitre.orgAdversaries may communicate using a protocol and port pairing that are typically not associated (for example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443). Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Source: MITRE ATT&CK, T1571. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Every one of the 19 is a mark on the map. Named now: 1 to 19, most on record first.
- Lazarus Group
- Sandworm
- APT38
- OceanLotus
- MuddyWater
- APT35
- FIN7
- Gamaredon
- Salt Typhoon
- Ember Bear
- Contagious Interview
- APT33
- Blind Eagle
- Rocke
- Ashen Lepus
- Silence
- Velvet Ant
- DarkVishnya
- RedEcho
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage.