Source assertions are not new attribution claims. No sole inventor or transitive actor-CVE inference.
{
  "record": {
    "id": "ATTACK:enterprise:G0016",
    "title": "APT29",
    "type": "IntrusionSet",
    "source_url": "https://attack.mitre.org/groups/G0016",
    "snapshot": "enterprise-attack-20.0.json",
    "status": "active",
    "rights": "Source metadata only; source notices retained; no operational prose or payloads",
    "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
    "stix_id": "intrusion-set--899ce53f-13a0-479b-a0e4-67d46e241542",
    "external_id": "G0016",
    "domain": "enterprise",
    "created": "2017-05-31T21:31:52.748Z",
    "modified": "2026-07-31T18:48:06.517Z",
    "version": "6.2",
    "aliases": [
      "APT29",
      "IRON RITUAL",
      "IRON HEMLOCK",
      "NobleBaron",
      "Dark Halo",
      "NOBELIUM",
      "UNC2452",
      "YTTRIUM",
      "The Dukes",
      "Cozy Bear",
      "CozyDuke",
      "SolarStorm",
      "Blue Kitsune",
      "UNC3524",
      "Midnight Blizzard"
    ],
    "tactics": [

    ],
    "source_references": [
      {
        "source_name": "CozyDuke"
      },
      {
        "source_name": "Cozy Bear"
      },
      {
        "source_name": "The Dukes"
      },
      {
        "source_name": "APT29"
      },
      {
        "source_name": "UNC2452"
      },
      {
        "source_name": "UNC3524"
      },
      {
        "source_name": "Midnight Blizzard"
      },
      {
        "source_name": "YTTRIUM"
      },
      {
        "source_name": "NOBELIUM"
      },
      {
        "source_name": "Blue Kitsune"
      },
      {
        "source_name": "IRON HEMLOCK"
      },
      {
        "source_name": "IRON RITUAL"
      },
      {
        "source_name": "NobleBaron"
      },
      {
        "source_name": "SolarStorm"
      },
      {
        "source_name": "Dark Halo"
      },
      {
        "source_name": "Crowdstrike DNC June 2016",
        "url": "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
      },
      {
        "source_name": "Volexity SolarWinds",
        "url": "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/"
      },
      {
        "source_name": "CrowdStrike SUNSPOT Implant January 2021",
        "url": "https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/"
      },
      {
        "source_name": "CrowdStrike StellarParticle January 2022",
        "url": "https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/"
      },
      {
        "source_name": "GRIZZLY STEPPE JAR",
        "url": "https://www.us-cert.gov/sites/default/files/publications/JAR_16-20296A_GRIZZLY%20STEPPE-2016-1229.pdf"
      },
      {
        "source_name": "FireEye APT29 Nov 2018",
        "url": "https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html"
      },
      {
        "source_name": "F-Secure The Dukes",
        "url": "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"
      },
      {
        "source_name": "ESET Dukes October 2019",
        "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
      },
      {
        "source_name": "FireEye SUNBURST Backdoor December 2020",
        "url": "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
      },
      {
        "source_name": "SentinelOne NobleBaron June 2021",
        "url": "https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/"
      },
      {
        "source_name": "Mandiant APT29 Eye Spy Email Nov 22",
        "url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
      },
      {
        "source_name": "Microsoft Threat Actor Naming July 2023",
        "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
      },
      {
        "source_name": "Microsoft Unidentified Dec 2018",
        "url": "https://www.microsoft.com/security/blog/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/"
      },
      {
        "source_name": "MSTIC NOBELIUM May 2021",
        "url": "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
      },
      {
        "source_name": "MSRC Nobelium June 2021",
        "url": "https://msrc-blog.microsoft.com/2021/06/25/new-nobelium-activity/"
      },
      {
        "source_name": "MSTIC Nobelium Toolset May 2021",
        "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
      },
      {
        "source_name": "MSTIC NOBELIUM Mar 2021",
        "url": "https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"
      },
      {
        "source_name": "NCSC APT29 July 2020",
        "url": "https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf"
      },
      {
        "source_name": "Cybersecurity Advisory SVR TTP May 2021",
        "url": "https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf"
      },
      {
        "source_name": "NSA Joint Advisory SVR SolarWinds April 2021",
        "url": "https://media.defense.gov/2021/Apr/15/2002621240/-1/-1/0/CSA_SVR_TARGETS_US_ALLIES_UOO13234021.PDF/CSA_SVR_TARGETS_US_ALLIES_UOO13234021.PDF"
      },
      {
        "source_name": "PWC WellMess C2 August 2020",
        "url": "https://www.pwc.co.uk/issues/cyber-security-services/insights/wellmess-analysis-command-control.html"
      },
      {
        "source_name": "PWC WellMess July 2020",
        "url": "https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html"
      },
      {
        "source_name": "Secureworks IRON HEMLOCK Profile",
        "url": "http://www.secureworks.com/research/threat-profiles/iron-hemlock"
      },
      {
        "source_name": "Secureworks IRON RITUAL Profile",
        "url": "https://www.sophos.com/en-us/threat-profiles/iron-ritual"
      },
      {
        "source_name": "UK Gov Malign RIS Activity April 2021",
        "url": "https://www.gov.uk/government/news/russia-uk-and-us-expose-global-campaigns-of-malign-activity-by-russian-intelligence-services"
      },
      {
        "source_name": "UK Gov UK Exposes Russia SolarWinds April 2021",
        "url": "https://www.gov.uk/government/news/russia-uk-exposes-russian-involvement-in-solarwinds-cyber-compromise"
      },
      {
        "source_name": "UK NSCS Russia SolarWinds April 2021",
        "url": "https://www.ncsc.gov.uk/news/uk-and-us-call-out-russia-for-solarwinds-compromise"
      },
      {
        "source_name": "Unit 42 SolarStorm December 2020",
        "url": "https://unit42.paloaltonetworks.com/solarstorm-supply-chain-attack-timeline/"
      },
      {
        "source_name": "White House Imposing Costs RU Gov April 2021",
        "url": "https://www.whitehouse.gov/briefing-room/statements-releases/2021/04/15/fact-sheet-imposing-costs-for-harmful-foreign-activities-by-the-russian-government/"
      }
    ]
  },
  "assertions": [
    {
      "id": "enterprise:relationship--02462741-4148-48b3-881b-1b813ce62fcc",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0048",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--02462741-4148-48b3-881b-1b813ce62fcc",
      "modified": "2026-07-31T18:48:07.233Z",
      "references": [
        {
          "source_name": "F-Secure The Dukes",
          "url": "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--02fa6833-f06f-4808-ab69-ca565b691e40",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0684",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--02fa6833-f06f-4808-ab69-ca565b691e40",
      "modified": "2026-07-31T18:48:07.258Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Oct 2021",
          "url": "https://www.microsoft.com/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0465916e-9561-4518-b2fa-09be21bc04e1",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0515",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0465916e-9561-4518-b2fa-09be21bc04e1",
      "modified": "2026-07-31T18:48:07.277Z",
      "references": [
        {
          "source_name": "CISA WellMail July 2020",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198c"
        },
        {
          "source_name": "NCSC APT29 July 2020",
          "url": "https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf"
        },
        {
          "source_name": "Cybersecurity Advisory SVR TTP May 2021",
          "url": "https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0585e082-8f8e-4162-b4a8-3c1cef02f7e3",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0046",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0585e082-8f8e-4162-b4a8-3c1cef02f7e3",
      "modified": "2026-07-31T18:48:07.296Z",
      "references": [
        {
          "source_name": "F-Secure The Dukes",
          "url": "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"
        },
        {
          "source_name": "Secureworks IRON HEMLOCK Profile",
          "url": "http://www.secureworks.com/research/threat-profiles/iron-hemlock"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--067814b5-aa57-45e0-9bdf-5536b077c224",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--067814b5-aa57-45e0-9bdf-5536b077c224",
      "modified": "2026-07-31T18:48:07.319Z",
      "references": [
        {
          "source_name": "F-Secure The Dukes",
          "url": "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"
        },
        {
          "source_name": "Microsoft 365 Defender Solorigate",
          "url": "https://www.microsoft.com/security/blog/2020/12/28/using-microsoft-365-defender-to-coordinate-protection-against-solorigate/"
        },
        {
          "source_name": "CrowdStrike StellarParticle January 2022",
          "url": "https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0cb7daf3-9c55-4210-a2a8-c5e40cf4ffbd",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1621",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0cb7daf3-9c55-4210-a2a8-c5e40cf4ffbd",
      "modified": "2026-07-31T18:48:07.336Z",
      "references": [
        {
          "source_name": "Suspected Russian Activity Targeting Government and Business Entities Around the Globe",
          "url": "https://www.mandiant.com/resources/russian-targeting-gov-business"
        },
        {
          "source_name": "NCSC et al APT29 2024",
          "url": "https://www.ic3.gov/Media/News/2024/240226.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0e0197fe-eca5-4d70-bf72-2d9092bc777b",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0175",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0e0197fe-eca5-4d70-bf72-2d9092bc777b",
      "modified": "2026-07-31T18:48:07.351Z",
      "references": [
        {
          "source_name": "Mandiant No Easy Breach",
          "url": "https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--10f89ca3-e540-4f36-9a21-eca24a0224a7",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0682",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--10f89ca3-e540-4f36-9a21-eca24a0224a7",
      "modified": "2026-07-31T18:48:07.369Z",
      "references": [
        {
          "source_name": "CrowdStrike StellarParticle January 2022",
          "url": "https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--13cd473c-1953-45d2-8508-faf8c1b6a941",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0057",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--13cd473c-1953-45d2-8508-faf8c1b6a941",
      "modified": "2026-07-31T18:48:07.391Z",
      "references": [
        {
          "source_name": "CISA SoreFang July 2016",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1593ae11-0bb5-4e16-804a-1383eb0cced5",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0052",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1593ae11-0bb5-4e16-804a-1383eb0cced5",
      "modified": "2026-07-31T18:48:07.406Z",
      "references": [
        {
          "source_name": "F-Secure The Dukes",
          "url": "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"
        },
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        },
        {
          "source_name": "Secureworks IRON HEMLOCK Profile",
          "url": "http://www.secureworks.com/research/threat-profiles/iron-hemlock"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--20785dd8-7692-4dcd-81ee-06bc9faa001c",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1003.002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--20785dd8-7692-4dcd-81ee-06bc9faa001c",
      "modified": "2026-07-31T18:48:07.427Z",
      "references": [
        {
          "source_name": "Mandiant APT29 Eye Spy Email Nov 22",
          "url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2370fba0-1d66-4aad-ac01-fb63857b7732",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1588.002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2370fba0-1d66-4aad-ac01-fb63857b7732",
      "modified": "2026-07-31T18:48:07.455Z",
      "references": [
        {
          "source_name": "Mandiant No Easy Breach",
          "url": "https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"
        },
        {
          "source_name": "F-Secure The Dukes",
          "url": "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"
        },
        {
          "source_name": "Mandiant APT29 Eye Spy Email Nov 22",
          "url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--27785084-70d5-4b4d-b8d0-9ab250ade9f5",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0512",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--27785084-70d5-4b4d-b8d0-9ab250ade9f5",
      "modified": "2026-07-31T18:48:07.477Z",
      "references": [
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        },
        {
          "source_name": "Secureworks IRON HEMLOCK Profile",
          "url": "http://www.secureworks.com/research/threat-profiles/iron-hemlock"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--27e7f34e-9750-4cf0-8260-33f2996ee38c",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090.004",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--27e7f34e-9750-4cf0-8260-33f2996ee38c",
      "modified": "2026-07-31T18:48:07.492Z",
      "references": [
        {
          "source_name": "Mandiant No Easy Breach",
          "url": "https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2a26d848-2dc2-4339-92e4-2ac707878f2e",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1528",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2a26d848-2dc2-4339-92e4-2ac707878f2e",
      "modified": "2026-07-31T18:48:07.510Z",
      "references": [
        {
          "source_name": "NCSC et al APT29 2024",
          "url": "https://www.ic3.gov/Media/News/2024/240226.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2c57efb7-0a7a-4b75-bbe1-e6f243713bee",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1568",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2c57efb7-0a7a-4b75-bbe1-e6f243713bee",
      "modified": "2026-07-31T18:48:07.536Z",
      "references": [
        {
          "source_name": "Mandiant APT29 Eye Spy Email Nov 22",
          "url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2d4edddf-2870-49cb-a7ee-026b8c09fe2e",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1068",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2d4edddf-2870-49cb-a7ee-026b8c09fe2e",
      "modified": "2026-07-31T18:48:07.556Z",
      "references": [
        {
          "source_name": "ESET T3 Threat Report 2021",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2022/02/eset_threat_report_t32021.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2db640ab-413b-4c49-9842-3bf190c5e184",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0150",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2db640ab-413b-4c49-9842-3bf190c5e184",
      "modified": "2026-07-31T18:48:07.577Z",
      "references": [
        {
          "source_name": "FireEye POSHSPY April 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--316bb062-76c2-4894-9f4e-57fa0938e6a4",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0634",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--316bb062-76c2-4894-9f4e-57fa0938e6a4",
      "modified": "2026-07-31T18:48:07.596Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Toolset May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--337dc23f-d825-415d-886b-53c3457fbd56",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1546.003",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--337dc23f-d825-415d-886b-53c3457fbd56",
      "modified": "2026-07-31T18:48:07.609Z",
      "references": [
        {
          "source_name": "Mandiant No Easy Breach",
          "url": "https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--343d285a-e910-487b-8e85-dc87cdb63be3",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1547.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--343d285a-e910-487b-8e85-dc87cdb63be3",
      "modified": "2026-07-31T18:48:07.633Z",
      "references": [
        {
          "source_name": "Mandiant No Easy Breach",
          "url": "https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--364d9326-12af-4449-924c-8063f4b3aa41",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0516",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--364d9326-12af-4449-924c-8063f4b3aa41",
      "modified": "2026-07-31T18:48:07.660Z",
      "references": [
        {
          "source_name": "NCSC APT29 July 2020",
          "url": "https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf"
        },
        {
          "source_name": "CISA SoreFang July 2016",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3920af52-2820-42e8-a6a8-2182c3a3908a",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1136.003",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3920af52-2820-42e8-a6a8-2182c3a3908a",
      "modified": "2026-07-31T18:48:07.684Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Oct 2021",
          "url": "https://www.microsoft.com/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3ae8d262-d2f8-4fa5-adb4-e379d43b9c37",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0049",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3ae8d262-d2f8-4fa5-adb4-e379d43b9c37",
      "modified": "2026-07-31T18:48:07.707Z",
      "references": [
        {
          "source_name": "F-Secure The Dukes",
          "url": "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3b2680f0-aa69-4766-ab41-9123373ffa4e",
      "subject": "ATTACK:enterprise:C0024",
      "predicate": "attributed-to",
      "object": "ATTACK:enterprise:G0016",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3b2680f0-aa69-4766-ab41-9123373ffa4e",
      "modified": "2026-07-31T18:48:07.725Z",
      "references": [
        {
          "source_name": "Mandiant UNC2452 APT29 April 2022",
          "url": "https://www.mandiant.com/resources/blog/unc2452-merged-into-apt29"
        },
        {
          "source_name": "NSA Joint Advisory SVR SolarWinds April 2021",
          "url": "https://media.defense.gov/2021/Apr/15/2002621240/-1/-1/0/CSA_SVR_TARGETS_US_ALLIES_UOO13234021.PDF/CSA_SVR_TARGETS_US_ALLIES_UOO13234021.PDF"
        },
        {
          "source_name": "UK NSCS Russia SolarWinds April 2021",
          "url": "https://www.ncsc.gov.uk/news/uk-and-us-call-out-russia-for-solarwinds-compromise"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3bd11b5b-4dba-4612-98e0-0f3e18686123",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1098.005",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3bd11b5b-4dba-4612-98e0-0f3e18686123",
      "modified": "2026-07-31T18:48:07.739Z",
      "references": [
        {
          "source_name": "Mandiant APT29 Microsoft 365 2022",
          "url": "https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"
        },
        {
          "source_name": "NCSC et al APT29 2024",
          "url": "https://www.ic3.gov/Media/News/2024/240226.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3bd4bd69-b1f6-426a-a63f-b8107eb57f8e",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1587.003",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3bd4bd69-b1f6-426a-a63f-b8107eb57f8e",
      "modified": "2026-08-27T14:17:14.886Z",
      "references": [
        {
          "source_name": "PWC WellMess July 2020",
          "url": "https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html"
        },
        {
          "source_name": "PWC WellMess C2 August 2020",
          "url": "https://www.pwc.co.uk/issues/cyber-security-services/insights/wellmess-analysis-command-control.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3be08ed9-951a-4686-9f60-114f0468325d",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1005",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3be08ed9-951a-4686-9f60-114f0468325d",
      "modified": "2026-07-31T18:48:07.768Z",
      "references": [
        {
          "source_name": "Mandiant APT29 Eye Spy Email Nov 22",
          "url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3c89c7b8-facc-4225-94ba-4a5126a31adc",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1105",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3c89c7b8-facc-4225-94ba-4a5126a31adc",
      "modified": "2026-09-03T19:47:00.164Z",
      "references": [
        {
          "source_name": "Mandiant No Easy Breach",
          "url": "https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"
        },
        {
          "source_name": "F-Secure The Dukes",
          "url": "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"
        },
        {
          "source_name": "Mandiant APT29 Eye Spy Email Nov 22",
          "url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
        },
        {
          "source_name": "PWC WellMess July 2020",
          "url": "https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3d0fed27-cf0e-4ca4-aef3-04300422299a",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1651",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3d0fed27-cf0e-4ca4-aef3-04300422299a",
      "modified": "2026-07-31T18:48:07.802Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Oct 2021",
          "url": "https://www.microsoft.com/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--410f6714-cd02-4253-b324-a8ac15e70bca",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--410f6714-cd02-4253-b324-a8ac15e70bca",
      "modified": "2026-07-31T18:48:07.817Z",
      "references": [
        {
          "source_name": "ESET T3 Threat Report 2021",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2022/02/eset_threat_report_t32021.pdf"
        },
        {
          "source_name": "F-Secure The Dukes",
          "url": "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"
        },
        {
          "source_name": "MSTIC NOBELIUM May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
        },
        {
          "source_name": "Secureworks IRON HEMLOCK Profile",
          "url": "http://www.secureworks.com/research/threat-profiles/iron-hemlock"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--41597eaa-8d5e-4fcf-aeda-a5a06df19ef7",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S1187",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--41597eaa-8d5e-4fcf-aeda-a5a06df19ef7",
      "modified": "2026-07-31T18:48:07.836Z",
      "references": [
        {
          "source_name": "Mandiant APT29 Eye Spy Email Nov 22",
          "url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--41760330-2558-4781-bc4e-1e4c7a1f5f92",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0521",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--41760330-2558-4781-bc4e-1e4c7a1f5f92",
      "modified": "2026-07-31T18:48:07.849Z",
      "references": [
        {
          "source_name": "ESET T3 Threat Report 2021",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2022/02/eset_threat_report_t32021.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--44ba0ff1-3858-4b2e-933d-e5dc00b4ca27",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1078.004",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--44ba0ff1-3858-4b2e-933d-e5dc00b4ca27",
      "modified": "2026-07-31T18:48:07.861Z",
      "references": [
        {
          "source_name": "Mandiant APT29 Microsoft 365 2022",
          "url": "https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"
        },
        {
          "source_name": "Mandiant APT29 Eye Spy Email Nov 22",
          "url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--48c43e15-210c-491f-9198-928b583470d9",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0588",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--48c43e15-210c-491f-9198-928b583470d9",
      "modified": "2026-07-31T18:48:07.872Z",
      "references": [
        {
          "source_name": "MSTIC NOBELIUM May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
        },
        {
          "source_name": "MSTIC Nobelium Toolset May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
        },
        {
          "source_name": "MSTIC NOBELIUM Mar 2021",
          "url": "https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"
        },
        {
          "source_name": "Cybersecurity Advisory SVR TTP May 2021",
          "url": "https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf"
        },
        {
          "source_name": "Secureworks IRON RITUAL Profile",
          "url": "https://www.sophos.com/en-us/threat-profiles/iron-ritual"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4a0887ab-3ec3-436a-b378-6e28847dfb1e",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1053.005",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4a0887ab-3ec3-436a-b378-6e28847dfb1e",
      "modified": "2026-07-31T18:48:07.888Z",
      "references": [
        {
          "source_name": "Mandiant No Easy Breach",
          "url": "https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4c747463-f1e0-40fd-a3ed-dc01bc112651",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1016.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4c747463-f1e0-40fd-a3ed-dc01bc112651",
      "modified": "2026-07-31T18:48:07.914Z",
      "references": [
        {
          "source_name": "Mandiant APT29 Eye Spy Email Nov 22",
          "url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4e7404a5-2d19-48cc-b906-ab1aca4f4b08",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1587.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4e7404a5-2d19-48cc-b906-ab1aca4f4b08",
      "modified": "2026-07-31T18:48:07.931Z",
      "references": [
        {
          "source_name": "Mandiant No Easy Breach",
          "url": "https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"
        },
        {
          "source_name": "F-Secure The Dukes",
          "url": "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"
        },
        {
          "source_name": "Mandiant APT29 Eye Spy Email Nov 22",
          "url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
        },
        {
          "source_name": "MSTIC Nobelium Toolset May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--517735b6-69f4-4188-8fef-45981220e4bc",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0661",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--517735b6-69f4-4188-8fef-45981220e4bc",
      "modified": "2026-07-31T18:48:07.947Z",
      "references": [
        {
          "source_name": "MSTIC FoggyWeb September 2021",
          "url": "https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--53a6a12f-04f2-445b-b733-8392ade1a7e5",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1583.006",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--53a6a12f-04f2-445b-b733-8392ade1a7e5",
      "modified": "2026-07-31T18:48:07.960Z",
      "references": [
        {
          "source_name": "FireEye APT29",
          "url": "https://services.google.com/fh/files/misc/rpt-apt29-hammertoss-stealthy-tactics-define-en.pdf"
        },
        {
          "source_name": "MSTIC NOBELIUM May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--54188543-7746-4158-9a9f-5556bb99ec7a",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090.003",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--54188543-7746-4158-9a9f-5556bb99ec7a",
      "modified": "2026-07-31T18:48:07.972Z",
      "references": [
        {
          "source_name": "Mandiant No Easy Breach",
          "url": "https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"
        },
        {
          "source_name": "MSTIC Nobelium Oct 2021",
          "url": "https://www.microsoft.com/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--555ccfc5-909a-455d-a39a-446020b22f88",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1037",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--555ccfc5-909a-455d-a39a-446020b22f88",
      "modified": "2026-07-31T18:48:07.985Z",
      "references": [
        {
          "source_name": "Mandiant APT29 Eye Spy Email Nov 22",
          "url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5bc4476e-9693-424c-b4d1-fd3a9ca996f3",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.006",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5bc4476e-9693-424c-b4d1-fd3a9ca996f3",
      "modified": "2026-07-31T18:48:08.006Z",
      "references": [
        {
          "source_name": "ESET T3 Threat Report 2021",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2022/02/eset_threat_report_t32021.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5bda4ebe-cd21-469e-9495-952df7254f17",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1070.004",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5bda4ebe-cd21-469e-9495-952df7254f17",
      "modified": "2026-07-31T18:48:08.027Z",
      "references": [
        {
          "source_name": "Mandiant No Easy Breach",
          "url": "https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5ca1f5dc-9573-46bb-a9db-fb83cd15b272",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1203",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5ca1f5dc-9573-46bb-a9db-fb83cd15b272",
      "modified": "2026-07-31T18:48:08.043Z",
      "references": [
        {
          "source_name": "F-Secure The Dukes",
          "url": "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"
        },
        {
          "source_name": "Cybersecurity Advisory SVR TTP May 2021",
          "url": "https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf"
        },
        {
          "source_name": "MSTIC NOBELIUM May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5de21fc4-c460-4da4-9dc4-2acdd54640a8",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1550.003",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5de21fc4-c460-4da4-9dc4-2acdd54640a8",
      "modified": "2026-07-31T18:48:08.062Z",
      "references": [
        {
          "source_name": "Mandiant No Easy Breach",
          "url": "https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--616bf309-ed87-4573-8640-416e6f05285d",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1204.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--616bf309-ed87-4573-8640-416e6f05285d",
      "modified": "2026-07-31T18:48:08.084Z",
      "references": [
        {
          "source_name": "MSTIC NOBELIUM May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
        },
        {
          "source_name": "Secureworks IRON RITUAL USAID Phish May 2021",
          "url": "https://www.secureworks.com/blog/usaid-themed-phishing-campaign-leverages-us-elections-lure"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--63185895-4afb-4886-adcc-fbfac1a117d6",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0195",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--63185895-4afb-4886-adcc-fbfac1a117d6",
      "modified": "2026-07-31T18:48:08.098Z",
      "references": [
        {
          "source_name": "Mandiant No Easy Breach",
          "url": "https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6828b200-b067-4667-9a77-9e434a625eaf",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1036.005",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6828b200-b067-4667-9a77-9e434a625eaf",
      "modified": "2026-07-31T18:48:08.119Z",
      "references": [
        {
          "source_name": "Mandiant APT29 Microsoft 365 2022",
          "url": "https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"
        },
        {
          "source_name": "SentinelOne NobleBaron June 2021",
          "url": "https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6aaca244-805c-4aba-b923-40407b034662",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0518",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6aaca244-805c-4aba-b923-40407b034662",
      "modified": "2026-07-31T18:48:08.141Z",
      "references": [
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        },
        {
          "source_name": "Secureworks IRON HEMLOCK Profile",
          "url": "http://www.secureworks.com/research/threat-profiles/iron-hemlock"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6c4b2975-6cad-4a10-8006-1e2e973a8a8b",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1110.003",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6c4b2975-6cad-4a10-8006-1e2e973a8a8b",
      "modified": "2026-07-31T18:48:08.166Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Oct 2021",
          "url": "https://www.microsoft.com/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/"
        },
        {
          "source_name": "MSRC Nobelium June 2021",
          "url": "https://msrc-blog.microsoft.com/2021/06/25/new-nobelium-activity/"
        },
        {
          "source_name": "NCSC et al APT29 2024",
          "url": "https://www.ic3.gov/Media/News/2024/240226.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6ee0cf67-d033-4620-b0c6-29b7a7d6592d",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1114.002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6ee0cf67-d033-4620-b0c6-29b7a7d6592d",
      "modified": "2026-09-09T18:44:33.762Z",
      "references": [
        {
          "source_name": "Mandiant APT29 Microsoft 365 2022",
          "url": "https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"
        },
        {
          "source_name": "Mandiant APT29 Eye Spy Email Nov 22",
          "url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--70ceb05c-ed86-4b51-bde0-2455662c30b7",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0677",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--70ceb05c-ed86-4b51-bde0-2455662c30b7",
      "modified": "2026-07-31T18:48:08.194Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Oct 2021",
          "url": "https://www.microsoft.com/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7243a679-467e-4c31-b413-547016b9c3ad",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0051",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7243a679-467e-4c31-b413-547016b9c3ad",
      "modified": "2026-07-31T18:48:08.216Z",
      "references": [
        {
          "source_name": "F-Secure The Dukes",
          "url": "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"
        },
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        },
        {
          "source_name": "Secureworks IRON HEMLOCK Profile",
          "url": "http://www.secureworks.com/research/threat-profiles/iron-hemlock"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--73af9ac3-d637-4b1f-9995-e45cd8cc067d",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--73af9ac3-d637-4b1f-9995-e45cd8cc067d",
      "modified": "2026-07-31T18:48:08.237Z",
      "references": [
        {
          "source_name": "SentinelOne NobleBaron June 2021",
          "url": "https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--79b3c546-efbf-4642-b5f1-61d4b497d4b9",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0560",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--79b3c546-efbf-4642-b5f1-61d4b497d4b9",
      "modified": "2026-07-31T18:48:08.260Z",
      "references": [
        {
          "source_name": "FireEye SUNBURST Backdoor December 2020",
          "url": "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
        },
        {
          "source_name": "MSTIC NOBELIUM May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
        },
        {
          "source_name": "MSTIC Nobelium Toolset May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
        },
        {
          "source_name": "Secureworks IRON RITUAL Profile",
          "url": "https://www.sophos.com/en-us/threat-profiles/iron-ritual"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7a58b25f-1736-48c6-90e1-70c49896ed4b",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1556.007",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7a58b25f-1736-48c6-90e1-70c49896ed4b",
      "modified": "2026-07-31T18:48:08.278Z",
      "references": [
        {
          "source_name": "MagicWeb",
          "url": "https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7f78df2e-e6e9-43f1-815b-58e4a10fc594",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7f78df2e-e6e9-43f1-815b-58e4a10fc594",
      "modified": "2026-07-31T18:48:08.302Z",
      "references": [
        {
          "source_name": "Mandiant No Easy Breach",
          "url": "https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"
        },
        {
          "source_name": "ESET T3 Threat Report 2021",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2022/02/eset_threat_report_t32021.pdf"
        },
        {
          "source_name": "Secureworks IRON HEMLOCK Profile",
          "url": "http://www.secureworks.com/research/threat-profiles/iron-hemlock"
        },
        {
          "source_name": "Symantec Seaduke 2015",
          "url": "https://web.archive.org/web/20150717011546/http://www.symantec.com/connect/blogs/forkmeiamfamous-seaduke-latest-weapon-duke-armory"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8bc0dbc4-f84b-448a-95f9-f6b0ae56f256",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1133",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8bc0dbc4-f84b-448a-95f9-f6b0ae56f256",
      "modified": "2026-07-31T18:48:08.317Z",
      "references": [
        {
          "source_name": "Mandiant APT29 Microsoft 365 2022",
          "url": "https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"
        },
        {
          "source_name": "NCSC APT29 July 2020",
          "url": "https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8d6cf235-4a33-4866-9b73-a7119293e5db",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0053",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8d6cf235-4a33-4866-9b73-a7119293e5db",
      "modified": "2026-07-31T18:48:08.332Z",
      "references": [
        {
          "source_name": "F-Secure The Dukes",
          "url": "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"
        },
        {
          "source_name": "Secureworks IRON HEMLOCK Profile",
          "url": "http://www.secureworks.com/research/threat-profiles/iron-hemlock"
        },
        {
          "source_name": "Symantec Seaduke 2015",
          "url": "https://web.archive.org/web/20150717011546/http://www.symantec.com/connect/blogs/forkmeiamfamous-seaduke-latest-weapon-duke-armory"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--91e9d060-8d6f-4d3a-9c69-8935f8e72338",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1037.004",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--91e9d060-8d6f-4d3a-9c69-8935f8e72338",
      "modified": "2026-07-31T18:48:08.344Z",
      "references": [
        {
          "source_name": "Mandiant APT29 Eye Spy Email Nov 22",
          "url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--93e345d9-a7d2-4abd-be34-46211fa64a7d",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1021.007",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--93e345d9-a7d2-4abd-be34-46211fa64a7d",
      "modified": "2026-07-31T18:48:08.364Z",
      "references": [
        {
          "source_name": "Mandiant Remediation and Hardening Strategies for Microsoft 365",
          "url": "https://www.mandiant.com/sites/default/files/2022-08/remediation-hardening-strategies-for-m365-defend-against-apt29-white-paper.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9bc0b5e1-d9be-4303-b396-df990c664c4b",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1595.002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9bc0b5e1-d9be-4303-b396-df990c664c4b",
      "modified": "2026-07-31T18:48:08.413Z",
      "references": [
        {
          "source_name": "Cybersecurity Advisory SVR TTP May 2021",
          "url": "https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a1d7019e-ccb0-42cb-ba7c-351dd5cb152f",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a1d7019e-ccb0-42cb-ba7c-351dd5cb152f",
      "modified": "2026-07-31T18:48:08.428Z",
      "references": [
        {
          "source_name": "Mandiant No Easy Breach",
          "url": "https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"
        },
        {
          "source_name": "MSTIC NOBELIUM May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
        },
        {
          "source_name": "Secureworks IRON RITUAL USAID Phish May 2021",
          "url": "https://www.secureworks.com/blog/usaid-themed-phishing-campaign-leverages-us-elections-lure"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a1da2d38-1c36-46bb-9245-ec4f650ef101",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1070.006",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a1da2d38-1c36-46bb-9245-ec4f650ef101",
      "modified": "2026-07-31T18:48:08.451Z",
      "references": [
        {
          "source_name": "Mandiant APT29 Eye Spy Email Nov 22",
          "url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a34de077-b25d-479b-8001-897efde4b0c5",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0589",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a34de077-b25d-479b-8001-897efde4b0c5",
      "modified": "2026-07-31T18:48:08.467Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Toolset May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
        },
        {
          "source_name": "MSTIC NOBELIUM Mar 2021",
          "url": "https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"
        },
        {
          "source_name": "Cybersecurity Advisory SVR TTP May 2021",
          "url": "https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf"
        },
        {
          "source_name": "Secureworks IRON RITUAL Profile",
          "url": "https://www.sophos.com/en-us/threat-profiles/iron-ritual"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a3adcf1b-a48a-4fab-bc61-5e0b0aeaaca6",
      "subject": "ATTACK:enterprise:C0023",
      "predicate": "attributed-to",
      "object": "ATTACK:enterprise:G0016",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a3adcf1b-a48a-4fab-bc61-5e0b0aeaaca6",
      "modified": "2026-07-31T18:48:08.487Z",
      "references": [
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a45bd763-a162-4b02-86f2-6042ff0eaa4a",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0565",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a45bd763-a162-4b02-86f2-6042ff0eaa4a",
      "modified": "2026-07-31T18:48:08.515Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Toolset May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
        },
        {
          "source_name": "Secureworks IRON RITUAL Profile",
          "url": "https://www.sophos.com/en-us/threat-profiles/iron-ritual"
        },
        {
          "source_name": "Symantec RAINDROP January 2021",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a4c888fc-278d-43a1-98a5-5ae1b2694b82",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1586.003",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a4c888fc-278d-43a1-98a5-5ae1b2694b82",
      "modified": "2026-07-31T18:48:08.538Z",
      "references": [
        {
          "source_name": "Mandiant APT29 Microsoft 365 2022",
          "url": "https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a4eb7719-b7e3-438e-8cb6-ebd576e74bbb",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0511",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a4eb7719-b7e3-438e-8cb6-ebd576e74bbb",
      "modified": "2026-07-31T18:48:08.560Z",
      "references": [
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        },
        {
          "source_name": "Secureworks IRON HEMLOCK Profile",
          "url": "http://www.secureworks.com/research/threat-profiles/iron-hemlock"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a7180b8e-c580-49ab-bbfb-e56e8ab48823",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0054",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a7180b8e-c580-49ab-bbfb-e56e8ab48823",
      "modified": "2026-07-31T18:48:08.583Z",
      "references": [
        {
          "source_name": "F-Secure The Dukes",
          "url": "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a8085af7-fcbb-4c1d-8eef-0ae509dac516",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090.002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a8085af7-fcbb-4c1d-8eef-0ae509dac516",
      "modified": "2026-09-08T20:29:10.569Z",
      "references": [
        {
          "source_name": "NCSC et al APT29 2024",
          "url": "https://www.ic3.gov/Media/News/2024/240226.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a8981fca-0584-4e9e-8f92-83843e1e4462",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1573",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a8981fca-0584-4e9e-8f92-83843e1e4462",
      "modified": "2026-09-03T19:46:54.645Z",
      "references": [
        {
          "source_name": "Secureworks IRON HEMLOCK Profile",
          "url": "http://www.secureworks.com/research/threat-profiles/iron-hemlock"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ab51525b-93c6-4ea8-bd83-b9547f1317bb",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ab51525b-93c6-4ea8-bd83-b9547f1317bb",
      "modified": "2026-07-31T18:48:08.645Z",
      "references": [
        {
          "source_name": "Mandiant No Easy Breach",
          "url": "https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ac1597ea-c0da-4365-998e-25e8e1ee87c9",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1110.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ac1597ea-c0da-4365-998e-25e8e1ee87c9",
      "modified": "2026-07-31T18:48:08.663Z",
      "references": [
        {
          "source_name": "Mandiant APT29 Microsoft 365 2022",
          "url": "https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ae93611e-8520-4c12-8fbe-7437f33a4092",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1199",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ae93611e-8520-4c12-8fbe-7437f33a4092",
      "modified": "2026-07-31T18:48:08.681Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Oct 2021",
          "url": "https://www.microsoft.com/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b08841ec-c80e-409e-90d1-cfb1cb191da4",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0597",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b08841ec-c80e-409e-90d1-cfb1cb191da4",
      "modified": "2026-07-31T18:48:08.706Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Toolset May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
        },
        {
          "source_name": "MSTIC NOBELIUM Mar 2021",
          "url": "https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"
        },
        {
          "source_name": "Cybersecurity Advisory SVR TTP May 2021",
          "url": "https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf"
        },
        {
          "source_name": "Secureworks IRON RITUAL Profile",
          "url": "https://www.sophos.com/en-us/threat-profiles/iron-ritual"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b0f6cf11-a8ac-4aba-a540-6bfa2b722f9c",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.003",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b0f6cf11-a8ac-4aba-a540-6bfa2b722f9c",
      "modified": "2026-07-31T18:48:08.729Z",
      "references": [
        {
          "source_name": "MSTIC NOBELIUM May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b1bddecd-763f-42f2-bb49-360d2507b7a6",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1078",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b1bddecd-763f-42f2-bb49-360d2507b7a6",
      "modified": "2026-07-31T18:48:08.751Z",
      "references": [
        {
          "source_name": "Mandiant APT29 Microsoft 365 2022",
          "url": "https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b1de5210-fbd9-4439-8d1a-bc400054d0ad",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1505.003",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b1de5210-fbd9-4439-8d1a-bc400054d0ad",
      "modified": "2026-07-31T18:48:08.765Z",
      "references": [
        {
          "source_name": "Mandiant APT29 Eye Spy Email Nov 22",
          "url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
        },
        {
          "source_name": "Cybersecurity Advisory SVR TTP May 2021",
          "url": "https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b22b0a6c-5960-4232-9fb6-bae84fcc07ca",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0552",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b22b0a6c-5960-4232-9fb6-bae84fcc07ca",
      "modified": "2026-07-31T18:48:08.780Z",
      "references": [
        {
          "source_name": "Microsoft Analyzing Solorigate Dec 2020",
          "url": "https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/"
        },
        {
          "source_name": "CrowdStrike StellarParticle January 2022",
          "url": "https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/"
        },
        {
          "source_name": "ESET T3 Threat Report 2021",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2022/02/eset_threat_report_t32021.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b5373794-5133-41b2-9050-228ebac75c92",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.006",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b5373794-5133-41b2-9050-228ebac75c92",
      "modified": "2026-07-31T18:48:08.794Z",
      "references": [
        {
          "source_name": "Symantec Seaduke 2015",
          "url": "https://web.archive.org/web/20150717011546/http://www.symantec.com/connect/blogs/forkmeiamfamous-seaduke-latest-weapon-duke-armory"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b6a99c7b-0c5c-4d07-ad28-273648ae081e",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1665",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b6a99c7b-0c5c-4d07-ad28-273648ae081e",
      "modified": "2026-07-31T18:48:08.819Z",
      "references": [
        {
          "source_name": "NCSC et al APT29 2024",
          "url": "https://www.ic3.gov/Media/News/2024/240226.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b8fdee05-cbe2-43b1-a224-e4b019017c3e",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1218.005",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b8fdee05-cbe2-43b1-a224-e4b019017c3e",
      "modified": "2026-07-31T18:48:08.830Z",
      "references": [
        {
          "source_name": "ESET T3 Threat Report 2021",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2022/02/eset_threat_report_t32021.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ba1a4084-a74f-44d6-bafe-7a09ee959270",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0029",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ba1a4084-a74f-44d6-bafe-7a09ee959270",
      "modified": "2026-07-31T18:48:08.844Z",
      "references": [
        {
          "source_name": "F-Secure The Dukes",
          "url": "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"
        },
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bd5b6f31-2248-4af8-8e8e-e3273aaa57e4",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0183",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bd5b6f31-2248-4af8-8e8e-e3273aaa57e4",
      "modified": "2026-07-31T18:48:08.862Z",
      "references": [
        {
          "source_name": "Mandiant No Easy Breach",
          "url": "https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bd9a6be1-903f-4a7b-a143-8c8d1da6cabc",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1003.004",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bd9a6be1-903f-4a7b-a143-8c8d1da6cabc",
      "modified": "2026-07-31T18:48:08.887Z",
      "references": [
        {
          "source_name": "Mandiant APT29 Eye Spy Email Nov 22",
          "url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bda1324a-9c51-4d91-bf21-39209633b985",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0637",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bda1324a-9c51-4d91-bf21-39209633b985",
      "modified": "2026-07-31T18:48:08.900Z",
      "references": [
        {
          "source_name": "SentinelOne NobleBaron June 2021",
          "url": "https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bf0ff6f3-51a5-4718-af3f-8f75b1eb507c",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1190",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bf0ff6f3-51a5-4718-af3f-8f75b1eb507c",
      "modified": "2026-07-31T18:48:08.914Z",
      "references": [
        {
          "source_name": "NCSC APT29 July 2020",
          "url": "https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf"
        },
        {
          "source_name": "Cybersecurity Advisory SVR TTP May 2021",
          "url": "https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c7602a92-d2d5-488d-b0b7-986ec1ef594d",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1553.005",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c7602a92-d2d5-488d-b0b7-986ec1ef594d",
      "modified": "2026-07-31T18:48:08.931Z",
      "references": [
        {
          "source_name": "ESET T3 Threat Report 2021",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2022/02/eset_threat_report_t32021.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c8a02e92-6b53-4c1f-ae1f-bebedd6bedc7",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0096",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c8a02e92-6b53-4c1f-ae1f-bebedd6bedc7",
      "modified": "2026-07-31T18:48:08.952Z",
      "references": [
        {
          "source_name": "CISA SoreFang July 2016",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ca1a0b5b-f07e-4017-8d9e-da784a75dc37",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1649",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ca1a0b5b-f07e-4017-8d9e-da784a75dc37",
      "modified": "2026-08-04T20:30:55.358Z",
      "references": [
        {
          "source_name": "Mandiant APT29 Trello",
          "url": "https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cb1dab47-1a8e-431c-adc9-51d341ce435e",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0100",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cb1dab47-1a8e-431c-adc9-51d341ce435e",
      "modified": "2026-07-31T18:48:08.988Z",
      "references": [
        {
          "source_name": "CISA SoreFang July 2016",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ceed81ff-99e9-45d2-8118-8f2ada6d13d3",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1087.004",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ceed81ff-99e9-45d2-8118-8f2ada6d13d3",
      "modified": "2026-07-31T18:48:09.013Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Oct 2021",
          "url": "https://www.microsoft.com/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cf2da3ab-4210-4a4b-932c-15dcc8b9c73f",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0562",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cf2da3ab-4210-4a4b-932c-15dcc8b9c73f",
      "modified": "2026-07-31T18:48:09.030Z",
      "references": [
        {
          "source_name": "CrowdStrike SUNSPOT Implant January 2021",
          "url": "https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/"
        },
        {
          "source_name": "MSTIC Nobelium Toolset May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d430bf8d-cbe9-4f0d-8040-7f7d66fcc204",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0357",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d430bf8d-cbe9-4f0d-8040-7f7d66fcc204",
      "modified": "2026-07-31T18:48:09.049Z",
      "references": [
        {
          "source_name": "Mandiant APT29 Eye Spy Email Nov 22",
          "url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d9beae20-bd32-4141-95ff-053cf46e8210",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0154",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d9beae20-bd32-4141-95ff-053cf46e8210",
      "modified": "2026-07-31T18:48:09.072Z",
      "references": [
        {
          "source_name": "ESET T3 Threat Report 2021",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2022/02/eset_threat_report_t32021.pdf"
        },
        {
          "source_name": "FireEye SUNBURST Backdoor December 2020",
          "url": "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
        },
        {
          "source_name": "SentinelOne NobleBaron June 2021",
          "url": "https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/"
        },
        {
          "source_name": "MSTIC NOBELIUM May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
        },
        {
          "source_name": "MSTIC Nobelium Toolset May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
        },
        {
          "source_name": "Cybersecurity Advisory SVR TTP May 2021",
          "url": "https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf"
        },
        {
          "source_name": "Secureworks IRON RITUAL USAID Phish May 2021",
          "url": "https://www.secureworks.com/blog/usaid-themed-phishing-campaign-leverages-us-elections-lure"
        },
        {
          "source_name": "Secureworks IRON RITUAL Profile",
          "url": "https://www.sophos.com/en-us/threat-profiles/iron-ritual"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d9fca287-fe50-43f8-bf6d-da6751ef8009",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1098.002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d9fca287-fe50-43f8-bf6d-da6751ef8009",
      "modified": "2026-07-31T18:48:09.087Z",
      "references": [
        {
          "source_name": "Mandiant APT29 Microsoft 365 2022",
          "url": "https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"
        },
        {
          "source_name": "Mandiant APT29 Eye Spy Email Nov 22",
          "url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--da3a85c7-7590-48b1-8a22-2f8b00060f83",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0139",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--da3a85c7-7590-48b1-8a22-2f8b00060f83",
      "modified": "2026-07-31T18:48:09.107Z",
      "references": [
        {
          "source_name": "Volexity PowerDuke November 2016",
          "url": "https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--db80dd29-d335-48b9-853e-5f15e576acb3",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0039",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--db80dd29-d335-48b9-853e-5f15e576acb3",
      "modified": "2026-07-31T18:48:09.122Z",
      "references": [
        {
          "source_name": "CISA SoreFang July 2016",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--df6ec6c4-6ae9-4f54-a0fb-0937f5a3bf01",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S1084",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--df6ec6c4-6ae9-4f54-a0fb-0937f5a3bf01",
      "modified": "2026-07-31T18:48:09.149Z",
      "references": [
        {
          "source_name": "Mandiant APT29 Eye Spy Email Nov 22",
          "url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--df9a9828-dff0-41a1-a93d-d410fb2ee3b9",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1078.003",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--df9a9828-dff0-41a1-a93d-d410fb2ee3b9",
      "modified": "2026-07-31T18:48:09.173Z",
      "references": [
        {
          "source_name": "NCSC et al APT29 2024",
          "url": "https://www.ic3.gov/Media/News/2024/240226.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--df9beafa-be6b-4e61-9a27-dfb9ec7d6aa3",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0037",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--df9beafa-be6b-4e61-9a27-dfb9ec7d6aa3",
      "modified": "2026-07-31T18:48:09.199Z",
      "references": [
        {
          "source_name": "F-Secure The Dukes",
          "url": "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"
        },
        {
          "source_name": "Secureworks IRON HEMLOCK Profile",
          "url": "http://www.secureworks.com/research/threat-profiles/iron-hemlock"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e0ce9848-5b27-4fb5-ba67-0fef8cd0fe0f",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0635",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e0ce9848-5b27-4fb5-ba67-0fef8cd0fe0f",
      "modified": "2026-07-31T18:48:09.223Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Toolset May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e65112dc-8a58-486f-9f3b-5a84925a3e53",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1546.008",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e65112dc-8a58-486f-9f3b-5a84925a3e53",
      "modified": "2026-07-31T18:48:09.250Z",
      "references": [
        {
          "source_name": "FireEye APT29 Domain Fronting",
          "url": "https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_frontin.html"
        },
        {
          "source_name": "Mandiant No Easy Breach",
          "url": "https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e6e736c1-5522-48fd-8e2c-06fef46199a8",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.009",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e6e736c1-5522-48fd-8e2c-06fef46199a8",
      "modified": "2026-07-31T18:48:09.276Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Toolset May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e794539e-3c07-4954-ba3c-f6c8ea6432e0",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1586.002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e794539e-3c07-4954-ba3c-f6c8ea6432e0",
      "modified": "2026-07-31T18:48:09.299Z",
      "references": [
        {
          "source_name": "ANSSI Nobelium Phishing December 2021",
          "url": "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-011.pdf"
        },
        {
          "source_name": "Mandiant APT29 Microsoft 365 2022",
          "url": "https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ed096691-23a6-4104-879d-5e96d257b3f0",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0633",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ed096691-23a6-4104-879d-5e96d257b3f0",
      "modified": "2026-07-31T18:48:09.325Z",
      "references": [
        {
          "source_name": "Cybersecurity Advisory SVR TTP May 2021",
          "url": "https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf"
        },
        {
          "source_name": "Secureworks IRON HEMLOCK Profile",
          "url": "http://www.secureworks.com/research/threat-profiles/iron-hemlock"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--eeae630c-0c58-4397-90fb-05f5b60b720f",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0050",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--eeae630c-0c58-4397-90fb-05f5b60b720f",
      "modified": "2026-07-31T18:48:09.355Z",
      "references": [
        {
          "source_name": "F-Secure The Dukes",
          "url": "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"
        },
        {
          "source_name": "Secureworks IRON HEMLOCK Profile",
          "url": "http://www.secureworks.com/research/threat-profiles/iron-hemlock"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f3f122f1-998f-4079-afad-7a59e39f89b7",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1204.002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f3f122f1-998f-4079-afad-7a59e39f89b7",
      "modified": "2026-07-31T18:48:09.383Z",
      "references": [
        {
          "source_name": "ESET T3 Threat Report 2021",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2022/02/eset_threat_report_t32021.pdf"
        },
        {
          "source_name": "F-Secure The Dukes",
          "url": "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"
        },
        {
          "source_name": "Secureworks IRON HEMLOCK Profile",
          "url": "http://www.secureworks.com/research/threat-profiles/iron-hemlock"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f5e2c4ef-fe56-416e-8d74-733272c7310b",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0559",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f5e2c4ef-fe56-416e-8d74-733272c7310b",
      "modified": "2026-07-31T18:48:09.398Z",
      "references": [
        {
          "source_name": "FireEye SUNBURST Backdoor December 2020",
          "url": "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
        },
        {
          "source_name": "MSTIC NOBELIUM May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
        },
        {
          "source_name": "Secureworks IRON RITUAL Profile",
          "url": "https://www.sophos.com/en-us/threat-profiles/iron-ritual"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f72527b3-98cb-4df6-9c52-9faef40206a0",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0514",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f72527b3-98cb-4df6-9c52-9faef40206a0",
      "modified": "2026-07-31T18:48:09.409Z",
      "references": [
        {
          "source_name": "PWC WellMess July 2020",
          "url": "https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html"
        },
        {
          "source_name": "PWC WellMess C2 August 2020",
          "url": "https://www.pwc.co.uk/issues/cyber-security-services/insights/wellmess-analysis-command-control.html"
        },
        {
          "source_name": "CISA WellMess July 2020",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198b"
        },
        {
          "source_name": "NCSC APT29 July 2020",
          "url": "https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf"
        },
        {
          "source_name": "Cybersecurity Advisory SVR TTP May 2021",
          "url": "https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f81d68f7-e096-47ed-a662-e484474727cf",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1685.002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f81d68f7-e096-47ed-a662-e484474727cf",
      "modified": "2026-07-31T18:48:09.426Z",
      "references": [
        {
          "source_name": "Mandiant APT29 Microsoft 365 2022",
          "url": "https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fab45ac3-d359-4493-8ae0-02675158710e",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0636",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fab45ac3-d359-4493-8ae0-02675158710e",
      "modified": "2026-07-31T18:48:09.440Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Toolset May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fd419d0b-d019-47f2-83a5-a8459ee9ed4b",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0513",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fd419d0b-d019-47f2-83a5-a8459ee9ed4b",
      "modified": "2026-07-31T18:48:09.451Z",
      "references": [
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        },
        {
          "source_name": "Secureworks IRON HEMLOCK Profile",
          "url": "http://www.secureworks.com/research/threat-profiles/iron-hemlock"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fdcda836-4a21-45d2-8269-31b82aa3c08e",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1548.002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fdcda836-4a21-45d2-8269-31b82aa3c08e",
      "modified": "2026-07-31T18:48:09.466Z",
      "references": [
        {
          "source_name": "Mandiant No Easy Breach",
          "url": "https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ff4e1b0e-eea2-4329-aecc-e5353be8c1f4",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ff4e1b0e-eea2-4329-aecc-e5353be8c1f4",
      "modified": "2026-07-31T18:48:09.480Z",
      "references": [
        {
          "source_name": "Mandiant No Easy Breach",
          "url": "https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    }
  ],
  "source_snapshot": {
    "file": "enterprise-attack-20.0.json",
    "url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
    "sha256": "81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352",
    "bytes": 55271014,
    "checked_at": "2026-10-16T03:31:39Z"
  },
  "notices_url": "https://aol.pm/source-notices.txt",
  "notices": "License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"
}

License
-------
The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,
development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce
MITRE's copyright designation and this license in any such copy.

"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation."

Disclaimers
-----------
MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part
of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover
full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or
variations on existing techniques not documented by ATT&CK.

ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE
ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,
AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT
THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR
FITNESS FOR A PARTICULAR PURPOSE.