{"record":{"id":"ATTACK:enterprise:T1005","title":"Data from Local System","type":"Technique","source_url":"https://attack.mitre.org/techniques/T1005","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--3c4a2599-71ee-4405-ba1e-0e28414b4bc5","external_id":"T1005","domain":"enterprise","created":"2017-05-31T21:30:20.537Z","modified":"2026-09-11T19:59:22.966Z","version":"1.8","aliases":[],"tactics":["collection"],"source_references":[{"source_name":"show_run_config_cmd_cisco","url":"https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/show_protocols_through_showmon.html#wp2760878733"},{"source_name":"Mandiant APT41 Global Intrusion ","url":"https://www.mandiant.com/resources/apt41-initiates-global-intrusion-campaign-using-multiple-exploits"},{"source_name":"US-CERT-TA18-106A","url":"https://www.us-cert.gov/ncas/alerts/TA18-106A"}]},"assertions":[{"id":"enterprise:relationship--02d10890-fd0d-4196-bb45-16f353085f79","subject":"ATTACK:enterprise:S1196","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--02d10890-fd0d-4196-bb45-16f353085f79","modified":"2026-04-29T14:23:05.907Z","references":[{"source_name":"S2W Troll Stealer 2024","url":"https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"},{"source_name":"Symantec Troll Stealer 2024","url":"https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--035525fc-4549-4282-b85b-c7c07359124c","subject":"ATTACK:enterprise:G0094","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--035525fc-4549-4282-b85b-c7c07359124c","modified":"2026-07-31T20:48:24.381Z","references":[{"source_name":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source_name":"Securelist Kimsuky Sept 2013","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"},{"source_name":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--05e9e12f-be5e-46f4-9f42-6f7fb7e9fb4a","subject":"ATTACK:enterprise:G0060","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--05e9e12f-be5e-46f4-9f42-6f7fb7e9fb4a","modified":"2026-07-31T18:48:10.033Z","references":[{"source_name":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--066d9d0e-0298-420b-ba84-a4af07211a35","subject":"ATTACK:enterprise:S0238","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--066d9d0e-0298-420b-ba84-a4af07211a35","modified":"2026-04-29T14:23:05.912Z","references":[{"source_name":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--08a74c86-5a98-4634-a93c-9c192d3e4fc9","subject":"ATTACK:enterprise:S0502","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--08a74c86-5a98-4634-a93c-9c192d3e4fc9","modified":"2026-04-29T14:23:05.915Z","references":[{"source_name":"NSA/FBI Drovorub August 2020","url":"https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0994d9a9-b94e-4235-b762-18c2f7b2ed57","subject":"ATTACK:enterprise:S0498","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0994d9a9-b94e-4235-b762-18c2f7b2ed57","modified":"2026-04-29T14:23:05.916Z","references":[{"source_name":"SentinelOne Lazarus macOS July 2020","url":"https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0a558f22-0139-43d9-869b-ee0e71ac237d","subject":"ATTACK:enterprise:S0653","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0a558f22-0139-43d9-869b-ee0e71ac237d","modified":"2026-04-29T14:23:05.917Z","references":[{"source_name":"Checkpoint IndigoZebra July 2021","url":"https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0b33093f-14c3-485e-8d82-f04ebcbe6d01","subject":"ATTACK:enterprise:G1004","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0b33093f-14c3-485e-8d82-f04ebcbe6d01","modified":"2026-07-31T20:48:49.250Z","references":[{"source_name":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0d2542de-be40-4c65-9fe8-04652388b080","subject":"ATTACK:enterprise:C0048","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0d2542de-be40-4c65-9fe8-04652388b080","modified":"2026-07-31T18:47:20.634Z","references":[{"source_name":"Volexity UPSTYLE 2024","url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0e4c55fc-a923-4c05-89ce-3102620a41d7","subject":"ATTACK:enterprise:G0087","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0e4c55fc-a923-4c05-89ce-3102620a41d7","modified":"2026-07-31T18:47:53.090Z","references":[{"source_name":"Symantec Chafer February 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"},{"source_name":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0e90a4cd-b6b3-49c1-ae6d-b338ef7f9c3b","subject":"ATTACK:enterprise:S0650","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0e90a4cd-b6b3-49c1-ae6d-b338ef7f9c3b","modified":"2026-04-29T14:23:05.923Z","references":[{"source_name":"Red Canary Qbot","url":"https://redcanary.com/threat-detection-report/threats/qbot/"},{"source_name":"Kaspersky QakBot September 2021","url":"https://securelist.com/qakbot-technical-analysis/103931/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0f19052c-5734-4521-91f4-1389e53d11ee","subject":"ATTACK:enterprise:S1043","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0f19052c-5734-4521-91f4-1389e53d11ee","modified":"2026-04-29T14:23:05.924Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1029fab5-5714-42d0-ac04-78f4c76c3c02","subject":"ATTACK:enterprise:S0567","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1029fab5-5714-42d0-ac04-78f4c76c3c02","modified":"2026-04-29T14:23:05.926Z","references":[{"source_name":"CyberBit Dtrack","url":"https://www.cyberbit.com/blog/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--119cfc44-4018-4ce0-b223-b0f353d1c113","subject":"ATTACK:enterprise:S0239","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--119cfc44-4018-4ce0-b223-b0f353d1c113","modified":"2026-04-29T14:23:05.928Z","references":[{"source_name":"McAfee Bankshot","url":"https://securingtomorrow.mcafee.com/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--11a7431f-416f-48de-a3c0-8782abdede63","subject":"ATTACK:enterprise:S0128","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--11a7431f-416f-48de-a3c0-8782abdede63","modified":"2026-04-29T14:23:05.928Z","references":[{"source_name":"Forcepoint Monsoon","url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"},{"source_name":"PaloAlto Patchwork Mar 2018","url":"https://researchcenter.paloaltonetworks.com/2018/03/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--12cfc154-5240-47ce-ba54-ec40f8a6d13d","subject":"ATTACK:enterprise:G0125","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--12cfc154-5240-47ce-ba54-ec40f8a6d13d","modified":"2026-07-31T18:47:44.130Z","references":[{"source_name":"Rapid7 HAFNIUM Mar 2021","url":"https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"},{"source_name":"Microsoft Silk Typhoon MAR 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--134a44d5-19f9-4052-9dc2-b1f5af870e28","subject":"ATTACK:enterprise:S1064","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--134a44d5-19f9-4052-9dc2-b1f5af870e28","modified":"2026-04-29T14:23:05.930Z","references":[{"source_name":"HP SVCReady Jun 2022","url":"https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--138f4287-ff95-45cd-bd65-d08708a2cbf5","subject":"ATTACK:enterprise:S0448","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--138f4287-ff95-45cd-bd65-d08708a2cbf5","modified":"2026-04-29T14:23:05.931Z","references":[{"source_name":"McAfee Sharpshooter December 2018","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--145ffef4-5a63-41d7-ac74-e034e9b9622d","subject":"ATTACK:enterprise:S0197","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--145ffef4-5a63-41d7-ac74-e034e9b9622d","modified":"2026-04-29T14:23:05.932Z","references":[{"source_name":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"},{"source_name":"FireEye Fin8 May 2016","url":"https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--14cc9d67-85e2-4aae-8f3b-4201a66b918f","subject":"ATTACK:enterprise:S0020","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--14cc9d67-85e2-4aae-8f3b-4201a66b918f","modified":"2026-04-29T14:23:05.932Z","references":[{"source_name":"Rapid7 HAFNIUM Mar 2021","url":"https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"},{"source_name":"FireEye Periscope March 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"},{"source_name":"Lee 2013","url":"https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html"},{"source_name":"NCSC Joint Report Public Tools","url":"https://www.ncsc.gov.uk/report/joint-report-on-publicly-available-hacking-tools"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--161c58eb-29d7-4de3-aca8-3bda085f19a3","subject":"ATTACK:enterprise:G0001","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--161c58eb-29d7-4de3-aca8-3bda085f19a3","modified":"2026-07-31T18:48:12.205Z","references":[{"source_name":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--16d0869c-1ed4-48b9-92f9-cae22e7a001f","subject":"ATTACK:enterprise:G0049","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--16d0869c-1ed4-48b9-92f9-cae22e7a001f","modified":"2026-07-31T20:48:35.228Z","references":[{"source_name":"Trend Micro Earth Simnavaz October 2024","url":"https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--17c3e2e7-f208-408c-b767-6c5be92646c4","subject":"ATTACK:enterprise:S0022","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--17c3e2e7-f208-408c-b767-6c5be92646c4","modified":"2026-04-29T14:23:05.937Z","references":[{"source_name":"Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023","url":"https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--17e5edb8-fcdf-4581-a428-5a3a75fc675a","subject":"ATTACK:enterprise:S0340","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--17e5edb8-fcdf-4581-a428-5a3a75fc675a","modified":"2026-04-29T14:23:05.937Z","references":[{"source_name":"ESET Nomadic Octopus 2018","url":"https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--18324fed-7770-4768-b652-59860ac4782f","subject":"ATTACK:enterprise:S0036","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--18324fed-7770-4768-b652-59860ac4782f","modified":"2026-04-29T14:23:05.937Z","references":[{"source_name":"FireEye APT30","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1a0117d8-422f-48ed-be65-9d2fcaf12ed9","subject":"ATTACK:enterprise:S0598","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1a0117d8-422f-48ed-be65-9d2fcaf12ed9","modified":"2026-04-29T14:23:05.940Z","references":[{"source_name":"ANSSI Sandworm January 2021","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1df35a7c-a7e9-45cb-b569-422e88f6c029","subject":"ATTACK:enterprise:S9058","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1df35a7c-a7e9-45cb-b569-422e88f6c029","modified":"2026-10-01T22:06:05.914Z","references":[{"source_name":"Mandiant_UNC1549_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2095d4fa-73b6-4a67-ac25-394f64d122d5","subject":"ATTACK:enterprise:G1022","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2095d4fa-73b6-4a67-ac25-394f64d122d5","modified":"2026-07-31T18:48:14.030Z","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--22e84b06-fbac-4811-b9b7-3c6587aab7d7","subject":"ATTACK:enterprise:S0154","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--22e84b06-fbac-4811-b9b7-3c6587aab7d7","modified":"2026-04-29T14:23:05.952Z","references":[{"source_name":"Cobalt Strike TTPs Dec 2017","url":"https://web.archive.org/web/20210924171429/https://www.cobaltstrike.com/downloads/reports/tacticstechniquesandprocedures.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--24b8eeb2-ee0d-402b-b2e0-afaa3c867072","subject":"ATTACK:enterprise:G0124","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--24b8eeb2-ee0d-402b-b2e0-afaa3c867072","modified":"2026-07-31T18:47:56.356Z","references":[{"source_name":"ESET ForSSHe December 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--267fb6e6-0776-4de0-baac-985beb079ad2","subject":"ATTACK:enterprise:S0632","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--267fb6e6-0776-4de0-baac-985beb079ad2","modified":"2026-04-29T14:23:05.957Z","references":[{"source_name":"Group IB GrimAgent July 2021","url":"https://www.group-ib.com/blog/grimagent/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--27279531-587c-46cf-af46-aa3fd64985da","subject":"ATTACK:enterprise:S9052","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--27279531-587c-46cf-af46-aa3fd64985da","modified":"2026-09-24T18:52:00.303Z","references":[{"source_name":"CheckPoint_NimbusManticore_May2026","url":"https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--29c989db-83f5-4c1a-944b-a0d78d652de2","subject":"ATTACK:enterprise:S1090","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--29c989db-83f5-4c1a-944b-a0d78d652de2","modified":"2026-04-29T14:23:05.962Z","references":[{"source_name":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2ae5b107-c648-45d4-9930-dcc42adac2c3","subject":"ATTACK:enterprise:S0630","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2ae5b107-c648-45d4-9930-dcc42adac2c3","modified":"2026-04-29T14:23:05.963Z","references":[{"source_name":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2b2e0b6e-10ac-42c0-8d77-3ffc9cc654a7","subject":"ATTACK:enterprise:S0356","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2b2e0b6e-10ac-42c0-8d77-3ffc9cc654a7","modified":"2026-04-29T14:23:05.963Z","references":[{"source_name":"Malwarebytes Konni Aug 2021","url":"https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2e87ee5b-2cf9-427f-b8c7-363e37daed88","subject":"ATTACK:enterprise:S0670","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2e87ee5b-2cf9-427f-b8c7-363e37daed88","modified":"2026-04-29T14:23:05.967Z","references":[{"source_name":"Check Point Warzone Feb 2020","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2ea75990-7349-4d67-8ec1-f4168792af23","subject":"ATTACK:enterprise:S1031","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2ea75990-7349-4d67-8ec1-f4168792af23","modified":"2026-04-29T14:23:05.967Z","references":[{"source_name":"Unit 42 PingPull Jun 2022","url":"https://unit42.paloaltonetworks.com/pingpull-gallium/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--31334bcb-0207-41c8-b04a-96c7d6d1a466","subject":"ATTACK:enterprise:S0194","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--31334bcb-0207-41c8-b04a-96c7d6d1a466","modified":"2026-04-29T14:23:05.980Z","references":[{"source_name":"GitHub PowerSploit May 2012","url":"https://github.com/PowerShellMafia/PowerSploit"},{"source_name":"PowerSploit Documentation","url":"http://powersploit.readthedocs.io"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3173f84e-783b-43cd-95f7-b74277936b4d","subject":"ATTACK:enterprise:C0002","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3173f84e-783b-43cd-95f7-b74277936b4d","modified":"2026-07-31T18:47:30.654Z","references":[{"source_name":"McAfee Night Dragon","url":"https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--32447230-f703-4baf-bd01-1477f7142f00","subject":"ATTACK:enterprise:S1113","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--32447230-f703-4baf-bd01-1477f7142f00","modified":"2026-04-29T14:23:05.984Z","references":[{"source_name":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--32bc85f6-f022-4868-8934-bd00cc36f6d4","subject":"ATTACK:enterprise:G0117","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--32bc85f6-f022-4868-8934-bd00cc36f6d4","modified":"2026-07-31T18:48:17.006Z","references":[{"source_name":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--33deb846-1334-4eb7-98fc-faff39b3ad16","subject":"ATTACK:enterprise:S0572","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--33deb846-1334-4eb7-98fc-faff39b3ad16","modified":"2026-04-29T14:23:05.988Z","references":[{"source_name":"ClearSky Lebanese Cedar Jan 2021","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--343e78cb-dbe9-4421-aca3-a8a973553c7a","subject":"ATTACK:enterprise:G0138","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--343e78cb-dbe9-4421-aca3-a8a973553c7a","modified":"2026-07-31T18:47:50.716Z","references":[{"source_name":"FSI Andariel Campaign Rifle July 2017","url":"https://fsiceat.tistory.com/2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--353717ce-2c78-4752-941e-439421ec2448","subject":"ATTACK:enterprise:G1039","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--353717ce-2c78-4752-941e-439421ec2448","modified":"2026-07-31T18:48:06.025Z","references":[{"source_name":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source_name":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3685caad-4ab6-42e8-888d-e7619006dd04","subject":"ATTACK:enterprise:S1025","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3685caad-4ab6-42e8-888d-e7619006dd04","modified":"2026-04-29T14:23:05.994Z","references":[{"source_name":"BlackBerry Amadey 2020","url":"https://blogs.blackberry.com/en/2020/01/threat-spotlight-amadey-bot"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--36d45d93-4a7f-4af1-b89a-2c2744f6b535","subject":"ATTACK:enterprise:S0520","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--36d45d93-4a7f-4af1-b89a-2c2744f6b535","modified":"2026-04-29T14:23:05.995Z","references":[{"source_name":"US-CERT BLINDINGCAN Aug 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--38a72b32-dc04-493d-8b92-31174c32f3ed","subject":"ATTACK:enterprise:G0006","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--38a72b32-dc04-493d-8b92-31174c32f3ed","modified":"2026-07-31T18:48:01.000Z","references":[{"source_name":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--38be247c-74b0-42f3-964e-5f23ef42a353","subject":"ATTACK:enterprise:G0093","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--38be247c-74b0-42f3-964e-5f23ef42a353","modified":"2026-07-31T18:47:37.104Z","references":[{"source_name":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3a3ba187-fa84-4285-97e6-8a9383c5e66f","subject":"ATTACK:enterprise:S0615","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3a3ba187-fa84-4285-97e6-8a9383c5e66f","modified":"2026-04-29T14:23:06.000Z","references":[{"source_name":"BlackBerry CostaRicto November 2020","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"},{"source_name":"CISA AR21-126A FIVEHANDS May 2021","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3be08ed9-951a-4686-9f60-114f0468325d","subject":"ATTACK:enterprise:G0016","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3be08ed9-951a-4686-9f60-114f0468325d","modified":"2026-07-31T18:48:07.768Z","references":[{"source_name":"Mandiant APT29 Eye Spy Email Nov 22","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3fe9b64a-6435-4592-9181-2ad50ee93044","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3fe9b64a-6435-4592-9181-2ad50ee93044","modified":"2026-07-31T20:48:46.634Z","references":[{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3feb6e83-0491-4e3d-a581-3f68ab839e92","subject":"ATTACK:enterprise:S0458","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3feb6e83-0491-4e3d-a581-3f68ab839e92","modified":"2026-04-29T14:23:06.012Z","references":[{"source_name":"Eset Ramsay May 2020","url":"https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"},{"source_name":"Antiy CERT Ramsay April 2020","url":"https://www.programmersought.com/article/62493896999/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4071eb53-bd07-499d-88cc-f03425ea2e46","subject":"ATTACK:enterprise:S1148","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4071eb53-bd07-499d-88cc-f03425ea2e46","modified":"2026-04-29T14:23:06.013Z","references":[{"source_name":"Sekoia Raccoon2 2022","url":"https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis/"},{"source_name":"S2W Racoon 2022","url":"https://medium.com/s2wblog/raccoon-stealer-is-back-with-a-new-version-5f436e04b20d"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--41160796-9596-4a58-92a1-14dd3c9f4271","subject":"ATTACK:enterprise:S0652","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--41160796-9596-4a58-92a1-14dd3c9f4271","modified":"2026-04-29T14:23:06.014Z","references":[{"source_name":"Kaspersky Ferocious Kitten Jun 2021","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--430afd29-f2c0-43d3-b7bf-e7a549960254","subject":"ATTACK:enterprise:G0047","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--430afd29-f2c0-43d3-b7bf-e7a549960254","modified":"2026-07-31T18:47:47.572Z","references":[{"source_name":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source_name":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--436bc39f-a6a0-4f8c-87e8-887cef2c67cd","subject":"ATTACK:enterprise:G1030","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--436bc39f-a6a0-4f8c-87e8-887cef2c67cd","modified":"2026-07-31T18:48:14.653Z","references":[{"source_name":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--43828aaa-5c0c-41e1-ae38-6e2abd43120d","subject":"ATTACK:enterprise:S9024","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--43828aaa-5c0c-41e1-ae38-6e2abd43120d","modified":"2026-04-29T14:23:06.017Z","references":[{"source_name":"CISA SPAWNCHIMERA RESURGE February 2026","url":"https://www.cisa.gov/news-events/analysis-reports/ar25-087a"},{"source_name":"Google UNC5221 Ivanti April 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-exploiting-critical-ivanti-vulnerability"},{"source_name":"Picus Security UNC5221 Ivanti May 2025","url":"https://www.picussecurity.com/resource/blog/unc5221-cve-2025-22457-ivanti-connect-secure"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--441cd636-cb84-4541-b444-09881d015c43","subject":"ATTACK:enterprise:S1017","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--441cd636-cb84-4541-b444-09881d015c43","modified":"2026-04-29T14:23:06.018Z","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--45eda154-7d5b-406d-b4eb-8d1ba2b79f40","subject":"ATTACK:enterprise:S0514","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--45eda154-7d5b-406d-b4eb-8d1ba2b79f40","modified":"2026-04-29T14:23:06.021Z","references":[{"source_name":"PWC WellMess July 2020","url":"https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html"},{"source_name":"CISA WellMess July 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198b"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--46389d22-1f4d-4597-b03d-30b9ec4146df","subject":"ATTACK:enterprise:G0037","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--46389d22-1f4d-4597-b03d-30b9ec4146df","modified":"2026-07-31T20:48:30.832Z","references":[{"source_name":"Trend Micro FIN6 October 2019","url":"https://www.trendmicro.com/en_us/research/19/j/fin6-compromised-e-commerce-platform-via-magecart-to-inject-credit-card-skimmers-into-thousands-of-online-shops.html"},{"source_name":"RiskIQ British Airways September 2018","url":"https://web.archive.org/web/20181231220607/https://riskiq.com/blog/labs/magecart-british-airways-breach/"},{"source_name":"RiskIQ Newegg September 2018","url":"https://web.archive.org/web/20181209083100/https://www.riskiq.com/blog/labs/magecart-newegg/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--46536757-5c5b-4927-9f68-b12ebef13568","subject":"ATTACK:enterprise:S1160","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--46536757-5c5b-4927-9f68-b12ebef13568","modified":"2026-04-29T14:23:06.021Z","references":[{"source_name":"Bitsight Latrodectus June 2024","url":"https://www.bitsight.com/blog/latrodectus-are-you-coming-back"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--479a4e37-811b-44e7-9d4f-e226eece6c36","subject":"ATTACK:enterprise:G0143","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--479a4e37-811b-44e7-9d4f-e226eece6c36","modified":"2026-07-31T18:47:59.260Z","references":[{"source_name":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--48316ab6-0019-47ad-b751-3b7efce756f2","subject":"ATTACK:enterprise:S1060","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--48316ab6-0019-47ad-b751-3b7efce756f2","modified":"2026-04-29T14:23:06.024Z","references":[{"source_name":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--48d34942-8001-41d2-ba53-0457c3852541","subject":"ATTACK:enterprise:S0663","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--48d34942-8001-41d2-ba53-0457c3852541","modified":"2026-04-29T14:23:06.024Z","references":[{"source_name":"Lunghi Iron Tiger Linux","url":"https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--48eff76f-1f39-49e8-87c2-11607a8aeea3","subject":"ATTACK:enterprise:S0248","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--48eff76f-1f39-49e8-87c2-11607a8aeea3","modified":"2026-04-29T14:23:06.025Z","references":[{"source_name":"ASERT Donot March 2018","url":"https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4c530431-2ad0-4ee9-97d1-4e489aa2436f","subject":"ATTACK:enterprise:S1039","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4c530431-2ad0-4ee9-97d1-4e489aa2436f","modified":"2026-04-29T14:23:06.029Z","references":[{"source_name":"Cybereason Bumblebee August 2022","url":"https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4d3467b2-34cd-484d-9526-571311b0160e","subject":"ATTACK:enterprise:S0634","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4d3467b2-34cd-484d-9526-571311b0160e","modified":"2026-04-29T14:23:06.030Z","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4f6975b8-e16e-47ba-b241-b2267c5da4ef","subject":"ATTACK:enterprise:C0014","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4f6975b8-e16e-47ba-b241-b2267c5da4ef","modified":"2026-07-31T18:47:31.561Z","references":[{"source_name":"FoxIT Wocao December 2019","url":"https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--500c4228-b676-4f47-a391-9e52abd5ea51","subject":"ATTACK:enterprise:G0010","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--500c4228-b676-4f47-a391-9e52abd5ea51","modified":"2026-07-31T18:48:03.825Z","references":[{"source_name":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5073b1b4-4018-4208-a46e-86a8358a6cee","subject":"ATTACK:enterprise:S0203","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5073b1b4-4018-4208-a46e-86a8358a6cee","modified":"2026-04-29T14:23:06.035Z","references":[{"source_name":"Symantec Trojan.Hydraq Jan 2010","url":"https://www.symantec.com/connect/blogs/trojanhydraq-incident"},{"source_name":"Symantec Hydraq Jan 2010","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2010-011114-1830-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--51c94403-d475-4bf0-8512-877993e17888","subject":"ATTACK:enterprise:S9010","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--51c94403-d475-4bf0-8512-877993e17888","modified":"2026-04-29T14:23:06.037Z","references":[{"source_name":"Socket GlassWorm January 2026","url":"https://socket.dev/blog/glassworm-loader-hits-open-vsx-via-suspected-developer-account-compromise"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5260f605-09d0-4d96-9239-9b93a76d0cbe","subject":"ATTACK:enterprise:S0559","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5260f605-09d0-4d96-9239-9b93a76d0cbe","modified":"2026-04-29T14:23:06.038Z","references":[{"source_name":"Microsoft Analyzing Solorigate Dec 2020","url":"https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/"},{"source_name":"FireEye SUNBURST Backdoor December 2020","url":"https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--52e9ca8d-a778-46d1-9521-743a8e47c503","subject":"ATTACK:enterprise:S0661","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--52e9ca8d-a778-46d1-9521-743a8e47c503","modified":"2026-04-29T14:23:06.038Z","references":[{"source_name":"MSTIC FoggyWeb September 2021","url":"https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--53e53569-4ae7-453c-953e-fc683e7794b0","subject":"ATTACK:enterprise:M1057","predicate":"mitigates","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--53e53569-4ae7-453c-953e-fc683e7794b0","modified":"2026-04-29T14:23:06.040Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5403aad2-3840-4b49-8124-961e1a24d044","subject":"ATTACK:enterprise:S0687","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5403aad2-3840-4b49-8124-961e1a24d044","modified":"2026-04-29T14:23:06.040Z","references":[{"source_name":"NCSC Cyclops Blink February 2022","url":"https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--543dd290-70eb-402f-8d40-93b4a240d4a1","subject":"ATTACK:enterprise:S1012","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--543dd290-70eb-402f-8d40-93b4a240d4a1","modified":"2026-04-29T14:23:06.040Z","references":[{"source_name":"Cybereason PowerLess February 2022","url":"https://www.cybereason.com/blog/research/powerless-trojan-iranian-apt-phosphorus-adds-new-powershell-backdoor-for-espionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--54f6c1c8-f3c7-44a6-9a00-2195e03cf0ae","subject":"ATTACK:enterprise:G0096","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--54f6c1c8-f3c7-44a6-9a00-2195e03cf0ae","modified":"2026-07-31T20:48:27.075Z","references":[{"source_name":"Group IB APT 41 June 2021","url":"https://www.group-ib.com/blog/colunmtk-apt41/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--565d5e3a-8a10-44cd-b45d-75fe2abe2677","subject":"ATTACK:enterprise:S1149","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--565d5e3a-8a10-44cd-b45d-75fe2abe2677","modified":"2026-04-29T14:23:06.043Z","references":[{"source_name":"Mandiant ROADSWEEP August 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--572a0bc0-58e6-4a8e-a28c-7d8be0bfd781","subject":"ATTACK:enterprise:S0694","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--572a0bc0-58e6-4a8e-a28c-7d8be0bfd781","modified":"2026-04-29T14:23:06.044Z","references":[{"source_name":"ClearSky Lazarus Aug 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--576f0fb4-4cd7-467b-9208-3977321705e4","subject":"ATTACK:enterprise:C0015","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--576f0fb4-4cd7-467b-9208-3977321705e4","modified":"2026-07-31T18:47:25.335Z","references":[{"source_name":"DFIR Conti Bazar Nov 2021","url":"https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--59433b3a-625d-4a06-a6fa-1bebeda60975","subject":"ATTACK:enterprise:S1085","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--59433b3a-625d-4a06-a6fa-1bebeda60975","modified":"2026-04-29T14:23:06.047Z","references":[{"source_name":"Symantec FIN8 Jul 2023","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5baa0187-f860-4ed2-8f29-bc6690009b8c","subject":"ATTACK:enterprise:S1111","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5baa0187-f860-4ed2-8f29-bc6690009b8c","modified":"2026-04-29T14:23:06.050Z","references":[{"source_name":"Rapid7 BlackBasta 2024","url":"https://www.rapid7.com/blog/post/2024/12/04/black-basta-ransomware-campaign-drops-zbot-darkgate-and-custom-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5bc845de-8364-46ae-b8c2-ca78e9601fdf","subject":"ATTACK:enterprise:S1146","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5bc845de-8364-46ae-b8c2-ca78e9601fdf","modified":"2026-04-29T14:23:06.050Z","references":[{"source_name":"ESET EvasivePanda 2023","url":"https://www.welivesecurity.com/2023/04/26/evasive-panda-apt-group-malware-updates-popular-chinese-software/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5cab4b98-b263-476d-a632-4deae44b45ba","subject":"ATTACK:enterprise:S9065","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5cab4b98-b263-476d-a632-4deae44b45ba","modified":"2026-10-01T21:23:22.924Z","references":[{"source_name":"Mandiant_UNC1549_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5d52eebf-0bd6-4088-8627-5dfb88f9b551","subject":"ATTACK:enterprise:S0564","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5d52eebf-0bd6-4088-8627-5dfb88f9b551","modified":"2026-04-29T14:23:06.052Z","references":[{"source_name":"Microsoft GALLIUM December 2019","url":"https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5d55979e-d4e8-44eb-97d6-e3e78baa60c7","subject":"ATTACK:enterprise:S0079","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5d55979e-d4e8-44eb-97d6-e3e78baa60c7","modified":"2026-04-29T14:23:06.052Z","references":[{"source_name":"Scarlet Mimic Jan 2016","url":"http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5db19a58-c7ff-4de0-b9bd-9e3b247b2ff3","subject":"ATTACK:enterprise:S0412","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5db19a58-c7ff-4de0-b9bd-9e3b247b2ff3","modified":"2026-04-29T14:23:06.053Z","references":[{"source_name":"Talos ZxShell Oct 2014","url":"https://blogs.cisco.com/security/talos/opening-zxshell"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--602a4664-e89c-4c11-982d-699589853ab3","subject":"ATTACK:enterprise:S0534","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--602a4664-e89c-4c11-982d-699589853ab3","modified":"2026-04-29T14:23:06.056Z","references":[{"source_name":"Cybereason Bazar July 2020","url":"https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--60855df0-b2f5-46ed-ba9d-09bdfd7d1ac6","subject":"ATTACK:enterprise:S0646","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--60855df0-b2f5-46ed-ba9d-09bdfd7d1ac6","modified":"2026-04-29T14:23:06.056Z","references":[{"source_name":"Secureworks GOLD KINGSWOOD September 2018","url":"https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--614da3bc-3be9-408c-8154-8a121d4b8895","subject":"ATTACK:enterprise:S1089","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--614da3bc-3be9-408c-8154-8a121d4b8895","modified":"2026-04-29T14:23:06.057Z","references":[{"source_name":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6163d384-dd39-4f32-a6f9-df79b4858e4b","subject":"ATTACK:enterprise:S9023","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6163d384-dd39-4f32-a6f9-df79b4858e4b","modified":"2026-04-29T14:23:06.057Z","references":[{"source_name":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"},{"source_name":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--61cfb178-a097-4788-a084-48d0d7c602b5","subject":"ATTACK:enterprise:C0022","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--61cfb178-a097-4788-a084-48d0d7c602b5","modified":"2026-07-31T21:14:22.624Z","references":[{"source_name":"McAfee Lazarus Jul 2020","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-a-job-offer-thats-too-good-to-be-true/?hilite=%27Operation%27%2C%27North%27%2C%27Star%27"},{"source_name":"ClearSky Lazarus Aug 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--626fcdd2-aaef-4670-ac9e-112c59151f95","subject":"ATTACK:enterprise:S1014","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--626fcdd2-aaef-4670-ac9e-112c59151f95","modified":"2026-04-29T14:23:06.059Z","references":[{"source_name":"SecureWorks August 2019","url":"https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--63738109-c04a-4af9-a671-636c493d7a21","subject":"ATTACK:enterprise:S0260","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--63738109-c04a-4af9-a671-636c493d7a21","modified":"2026-04-29T14:23:06.060Z","references":[{"source_name":"ESET InvisiMole June 2018","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--64488756-c88f-4004-910b-47e8965d003e","subject":"ATTACK:enterprise:S0115","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--64488756-c88f-4004-910b-47e8965d003e","modified":"2026-04-29T14:23:06.061Z","references":[{"source_name":"Cisco Talos Transparent Tribe Education Campaign July 2022","url":"https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--644d8961-2e4e-4aa1-b7d8-6759a64b25e8","subject":"ATTACK:enterprise:S0533","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--644d8961-2e4e-4aa1-b7d8-6759a64b25e8","modified":"2026-04-29T14:23:06.061Z","references":[{"source_name":"CISA MAR SLOTHFULMEDIA October 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6460c09b-2bde-4c4a-9765-591405d4ea8f","subject":"ATTACK:enterprise:S9035","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6460c09b-2bde-4c4a-9765-591405d4ea8f","modified":"2026-04-29T14:23:06.061Z","references":[{"source_name":"Splunk LAMEHUG SEP 2025","url":"https://www.splunk.com/en_us/blog/security/lamehug-ai-driven-malware-llm-cyber-intrusion-analysis.html"},{"source_name":"Nov AI Threat Tracker","url":"https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--64a40a9a-ddea-430d-ab08-77c350d83497","subject":"ATTACK:enterprise:S0622","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--64a40a9a-ddea-430d-ab08-77c350d83497","modified":"2026-04-29T14:23:06.062Z","references":[{"source_name":"Malwarebytes Kimsuky June 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"},{"source_name":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--64af40e2-5138-429c-9b24-2f5ba846d668","subject":"ATTACK:enterprise:S1016","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--64af40e2-5138-429c-9b24-2f5ba846d668","modified":"2026-04-29T14:23:06.062Z","references":[{"source_name":"ESET DazzleSpy Jan 2022","url":"https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--64e887e0-70b8-474d-8763-3c3a666055d3","subject":"ATTACK:enterprise:S1110","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--64e887e0-70b8-474d-8763-3c3a666055d3","modified":"2026-04-29T14:23:06.062Z","references":[{"source_name":"Mandiant Pulse Secure Zero-Day April 2021","url":"https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--65f63217-5473-4093-afcc-070c5e757a29","subject":"ATTACK:enterprise:G1014","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--65f63217-5473-4093-afcc-070c5e757a29","modified":"2026-07-31T18:48:14.815Z","references":[{"source_name":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"},{"source_name":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--665d8625-e2d1-45d5-b5e3-d9bc0e242e7d","subject":"ATTACK:enterprise:G0067","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--665d8625-e2d1-45d5-b5e3-d9bc0e242e7d","modified":"2026-07-31T18:47:55.376Z","references":[{"source_name":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--69bdad3f-929c-4597-a9d7-4ec2c738170d","subject":"ATTACK:enterprise:S1131","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--69bdad3f-929c-4597-a9d7-4ec2c738170d","modified":"2026-04-29T14:23:06.069Z","references":[{"source_name":"Huntress NPPSPY 2022","url":"https://www.huntress.com/blog/cleartext-shenanigans-gifting-user-passwords-to-adversaries-with-nppspy"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6b07ae79-4f29-499a-a25e-882b8c624086","subject":"ATTACK:enterprise:S0696","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6b07ae79-4f29-499a-a25e-882b8c624086","modified":"2026-04-29T14:23:06.071Z","references":[{"source_name":"NTT Security Flagpro new December 2021","url":"https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6b9cb729-6a81-4ec2-91c1-7141f8691ee4","subject":"ATTACK:enterprise:S0011","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6b9cb729-6a81-4ec2-91c1-7141f8691ee4","modified":"2026-04-29T14:23:06.071Z","references":[{"source_name":"TrendMicro Taidoor","url":"http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the_taidoor_campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6d3e0454-ffd1-46a7-9fcc-d4c8902707b7","subject":"ATTACK:enterprise:S1022","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6d3e0454-ffd1-46a7-9fcc-d4c8902707b7","modified":"2026-04-29T14:23:06.074Z","references":[{"source_name":"CrowdStrike IceApple May 2022","url":"https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6d5c4bf4-0dfb-48f7-842d-3392b16eb80e","subject":"ATTACK:enterprise:S0083","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6d5c4bf4-0dfb-48f7-842d-3392b16eb80e","modified":"2026-04-29T14:23:06.074Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6eb962fa-ca3e-4af2-9243-132c666a5c25","subject":"ATTACK:enterprise:S0671","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6eb962fa-ca3e-4af2-9243-132c666a5c25","modified":"2026-04-29T14:23:06.076Z","references":[{"source_name":"Kaspersky Tomiris Sep 2021","url":"https://securelist.com/darkhalo-after-solarwinds-the-tomiris-connection/104311/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6f54be53-193e-49c0-aa8e-2b24caf436fd","subject":"ATTACK:enterprise:G0035","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6f54be53-193e-49c0-aa8e-2b24caf436fd","modified":"2026-07-31T20:48:28.496Z","references":[{"source_name":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6fad7038-4d0f-48c3-937a-7128d4bf0592","subject":"ATTACK:enterprise:G1012","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6fad7038-4d0f-48c3-937a-7128d4bf0592","modified":"2026-07-31T18:47:51.340Z","references":[{"source_name":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--71449072-84c5-461c-9bba-2caa81051499","subject":"ATTACK:enterprise:S1019","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--71449072-84c5-461c-9bba-2caa81051499","modified":"2026-04-29T14:23:06.080Z","references":[{"source_name":"Accenture Lyceum Targets November 2021","url":"https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns"},{"source_name":"ClearSky Siamesekitten August 2021","url":"https://www.clearskysec.com/siamesekitten/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--71bc9a2e-4536-4b84-9997-126cc4c065bf","subject":"ATTACK:enterprise:S1065","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--71bc9a2e-4536-4b84-9997-126cc4c065bf","modified":"2026-04-29T14:23:06.080Z","references":[{"source_name":"MalwareBytes WoodyRAT Aug 2022","url":"https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--71c512cd-2372-400e-92ea-2c84760b81f5","subject":"ATTACK:enterprise:S0658","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--71c512cd-2372-400e-92ea-2c84760b81f5","modified":"2026-04-29T14:23:06.081Z","references":[{"source_name":"trendmicro xcsset xcode project 2020","url":"https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--72bd8010-4bdb-48f1-8d53-a3566f66129c","subject":"ATTACK:enterprise:S1246","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--72bd8010-4bdb-48f1-8d53-a3566f66129c","modified":"2026-04-29T14:23:06.082Z","references":[{"source_name":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"},{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"},{"source_name":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--73b90f6c-b64d-4b7b-8142-b02f52e8cea1","subject":"ATTACK:enterprise:C0024","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--73b90f6c-b64d-4b7b-8142-b02f52e8cea1","modified":"2026-07-31T18:47:26.705Z","references":[{"source_name":"Volexity SolarWinds","url":"https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--73e0604a-2509-43a6-9318-a9494e570363","subject":"ATTACK:enterprise:G0007","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--73e0604a-2509-43a6-9318-a9494e570363","modified":"2026-07-31T20:48:44.839Z","references":[{"source_name":"Überwachung APT28 Forfiles June 2015","url":"https://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/"},{"source_name":"TrendMicro Pawn Storm 2019","url":"https://documents.trendmicro.com/assets/white_papers/wp-pawn-storm-in-2019.pdf"},{"source_name":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"},{"source_name":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--75db2ffc-f33f-4735-a3eb-139d959b0b50","subject":"ATTACK:enterprise:S0651","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--75db2ffc-f33f-4735-a3eb-139d959b0b50","modified":"2026-04-29T14:23:06.086Z","references":[{"source_name":"Checkpoint IndigoZebra July 2021","url":"https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--767e6737-fcf8-48ae-a6a3-045c9a03b0e2","subject":"ATTACK:enterprise:S1063","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--767e6737-fcf8-48ae-a6a3-045c9a03b0e2","modified":"2026-04-29T14:23:06.087Z","references":[{"source_name":"Palo Alto Brute Ratel July 2022","url":"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7696d163-7556-47e2-9ade-25924311fba6","subject":"ATTACK:enterprise:S1029","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7696d163-7556-47e2-9ade-25924311fba6","modified":"2026-04-29T14:23:06.087Z","references":[{"source_name":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--76d47356-a255-48ba-9cd8-1ff2e52bb165","subject":"ATTACK:enterprise:S0461","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--76d47356-a255-48ba-9cd8-1ff2e52bb165","modified":"2026-04-29T14:23:06.088Z","references":[{"source_name":"Proofpoint TA505 October 2019","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--77def9ad-52ea-44c0-b800-42b17323a985","subject":"ATTACK:enterprise:S0262","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--77def9ad-52ea-44c0-b800-42b17323a985","modified":"2026-04-29T14:23:06.089Z","references":[{"source_name":"CISA AR18-352A Quasar RAT December 2018","url":"https://www.cisa.gov/uscert/ncas/analysis-reports/AR18-352A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7942bbcc-cff9-4cc6-b568-5fcd3b6a5ddf","subject":"ATTACK:enterprise:S0386","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7942bbcc-cff9-4cc6-b568-5fcd3b6a5ddf","modified":"2026-04-29T14:23:06.091Z","references":[{"source_name":"TrendMicro BKDR_URSNIF.SM","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/BKDR_URSNIF.SM?_ga=2.129468940.1462021705.1559742358-1202584019.1549394279"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7c792d18-25a3-4d85-be44-93523228748c","subject":"ATTACK:enterprise:S0090","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7c792d18-25a3-4d85-be44-93523228748c","modified":"2026-04-29T14:23:06.096Z","references":[{"source_name":"Palo Alto Rover","url":"http://researchcenter.paloaltonetworks.com/2016/02/new-malware-rover-targets-indian-ambassador-to-afghanistan/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7ccb94c2-fc46-464a-bd44-7c61b46cea5b","subject":"ATTACK:enterprise:S0503","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7ccb94c2-fc46-464a-bd44-7c61b46cea5b","modified":"2026-04-29T14:23:06.096Z","references":[{"source_name":"SentinelOne FrameworkPOS September 2019","url":"https://labs.sentinelone.com/fin6-frameworkpos-point-of-sale-malware-analysis-internals-2/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7cea5a77-cfb2-4e14-88da-ca936433ada0","subject":"ATTACK:enterprise:C0017","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7cea5a77-cfb2-4e14-88da-ca936433ada0","modified":"2026-07-31T21:12:31.585Z","references":[{"source_name":"Mandiant APT41","url":"https://www.mandiant.com/resources/apt41-us-state-governments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7e8293be-b9d6-4a27-8d49-216f17df3bd0","subject":"ATTACK:enterprise:S0274","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7e8293be-b9d6-4a27-8d49-216f17df3bd0","modified":"2026-04-29T14:23:06.098Z","references":[{"source_name":"Securelist Calisto July 2018","url":"https://securelist.com/calisto-trojan-for-macos/86543/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7ecd1b78-a3f1-4997-be47-68377eb59689","subject":"ATTACK:enterprise:S0266","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7ecd1b78-a3f1-4997-be47-68377eb59689","modified":"2026-04-29T14:23:06.099Z","references":[{"source_name":"S2 Grupo TrickBot June 2017","url":"https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--84ad3033-c9b4-4679-94b2-0c2a2d9d15df","subject":"ATTACK:enterprise:S0268","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--84ad3033-c9b4-4679-94b2-0c2a2d9d15df","modified":"2026-04-29T14:23:06.107Z","references":[{"source_name":"Talos Bisonal Mar 2020","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--86079dc0-0c46-4068-a2f1-9422d81a03be","subject":"ATTACK:enterprise:G0100","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--86079dc0-0c46-4068-a2f1-9422d81a03be","modified":"2026-07-31T18:48:25.205Z","references":[{"source_name":"Kaspersky Cloud Atlas August 2019","url":"https://securelist.com/recent-cloud-atlas-activity/92016/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--86ba3af5-2fdf-4fe3-8a89-da24cc0e0165","subject":"ATTACK:enterprise:S1050","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--86ba3af5-2fdf-4fe3-8a89-da24cc0e0165","modified":"2026-04-29T14:23:06.109Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--86f238c5-20c2-4c94-9be9-886105c95252","subject":"ATTACK:enterprise:S1026","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--86f238c5-20c2-4c94-9be9-886105c95252","modified":"2026-04-29T14:23:06.109Z","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8b3f6072-ccf5-4ede-b0ec-948d5953346b","subject":"ATTACK:enterprise:S1132","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8b3f6072-ccf5-4ede-b0ec-948d5953346b","modified":"2026-04-29T14:23:06.115Z","references":[{"source_name":"SentinelOne Agrius 2021","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8c763d80-4c50-4ebd-b2c6-3cad22c55bfa","subject":"ATTACK:enterprise:G0004","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8c763d80-4c50-4ebd-b2c6-3cad22c55bfa","modified":"2026-07-31T18:48:01.384Z","references":[{"source_name":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"},{"source_name":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8e28cc53-3fd4-42ed-8516-71fd9ee57641","subject":"ATTACK:enterprise:G0040","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8e28cc53-3fd4-42ed-8516-71fd9ee57641","modified":"2026-07-31T20:48:26.362Z","references":[{"source_name":"Cymmetria Patchwork","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8f40c44c-80c5-4f9d-a467-6b71f646cdf7","subject":"ATTACK:enterprise:S0665","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8f40c44c-80c5-4f9d-a467-6b71f646cdf7","modified":"2026-04-29T14:23:06.120Z","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8f666cbe-d814-4702-9287-87648469141a","subject":"ATTACK:enterprise:S1159","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8f666cbe-d814-4702-9287-87648469141a","modified":"2026-04-29T14:23:06.120Z","references":[{"source_name":"Google Cloud APT41 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8f6701a2-91cc-449e-98e1-e83bd2f7317c","subject":"ATTACK:enterprise:G0022","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8f6701a2-91cc-449e-98e1-e83bd2f7317c","modified":"2026-07-31T18:47:38.017Z","references":[{"source_name":"aptsim","url":"http://carnal0wnage.attackresearch.com/2012/09/more-on-aptsim.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--91872d37-d1f6-4a12-a011-85f929a3f8aa","subject":"ATTACK:enterprise:S1240","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--91872d37-d1f6-4a12-a011-85f929a3f8aa","modified":"2026-04-29T14:23:06.123Z","references":[{"source_name":"ESET RedLine Stealer November 2024","url":"https://www.welivesecurity.com/en/eset-research/life-crooked-redline-analyzing-infamous-infostealers-backend/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9284cd45-dca9-4831-b118-36eae1fffd70","subject":"ATTACK:enterprise:G1054","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9284cd45-dca9-4831-b118-36eae1fffd70","modified":"2026-07-31T18:48:08.819Z","references":[{"source_name":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--92a5d02f-8f2e-4744-b030-54f2222bde88","subject":"ATTACK:enterprise:S0395","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--92a5d02f-8f2e-4744-b030-54f2222bde88","modified":"2026-04-29T14:23:06.125Z","references":[{"source_name":"ESET LightNeuron May 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--92fb7408-1638-43b7-95a3-0cfeebd7624d","subject":"ATTACK:enterprise:S0169","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--92fb7408-1638-43b7-95a3-0cfeebd7624d","modified":"2026-04-29T14:23:06.125Z","references":[{"source_name":"Kroll RawPOS Jan 2017","url":"https://www.kroll.com/en/insights/publications/malware-analysis-report-rawpos-malware"},{"source_name":"TrendMicro RawPOS April 2015","url":"http://sjc1-te-ftp.trendmicro.com/images/tex/pdf/RawPOS%20Technical%20Brief.pdf"},{"source_name":"Mandiant FIN5 GrrCON Oct 2016","url":"https://www.youtube.com/watch?v=fevGZs0EQu8"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--931e3af1-d38d-46eb-8c5d-d394510e2df1","subject":"ATTACK:enterprise:S1021","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--931e3af1-d38d-46eb-8c5d-d394510e2df1","modified":"2026-04-29T14:23:06.126Z","references":[{"source_name":"Zscaler Lyceum DnsSystem June 2022","url":"https://www.zscaler.com/blogs/security-research/lyceum-net-dns-backdoor"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9420e9de-cc4c-4d5c-b40f-02c57dcc4fd9","subject":"ATTACK:enterprise:S0193","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9420e9de-cc4c-4d5c-b40f-02c57dcc4fd9","modified":"2026-04-29T14:23:06.127Z","references":[{"source_name":"Überwachung APT28 Forfiles June 2015","url":"https://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--96a31073-f6b7-463d-9816-d59014ba4adc","subject":"ATTACK:enterprise:S0512","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--96a31073-f6b7-463d-9816-d59014ba4adc","modified":"2026-04-29T14:23:06.130Z","references":[{"source_name":"ESET Dukes October 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--986db6f9-d2ad-4ab9-98b6-5633e101e804","subject":"ATTACK:enterprise:S1020","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--986db6f9-d2ad-4ab9-98b6-5633e101e804","modified":"2026-04-29T14:23:06.133Z","references":[{"source_name":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9c559e9a-0ad1-42cb-9848-5b54112a543b","subject":"ATTACK:enterprise:S0645","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9c559e9a-0ad1-42cb-9848-5b54112a543b","modified":"2026-04-29T14:23:06.138Z","references":[{"source_name":"F-Secure Lazarus Cryptocurrency Aug 2020","url":"https://web.archive.org/web/20200901113617/https://labs.f-secure.com/assets/BlogFiles/f-secureLABS-tlp-white-lazarus-threat-intel-report2.pdf"},{"source_name":"Wevtutil Microsoft Documentation","url":"https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9dcc9cb1-d489-42ab-b647-3a492c04c114","subject":"ATTACK:enterprise:S0223","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9dcc9cb1-d489-42ab-b647-3a492c04c114","modified":"2026-04-29T14:23:06.140Z","references":[{"source_name":"FireEye MuddyWater Mar 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9fb48ae2-125f-48f8-a813-8e64cf70bde3","subject":"ATTACK:enterprise:S0610","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9fb48ae2-125f-48f8-a813-8e64cf70bde3","modified":"2026-04-29T14:23:06.143Z","references":[{"source_name":"Check Point APT34 April 2021","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9fd8bbd8-1d8d-426d-b079-c7cc2ebd4b35","subject":"ATTACK:enterprise:S0690","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9fd8bbd8-1d8d-426d-b079-c7cc2ebd4b35","modified":"2026-04-29T14:23:06.143Z","references":[{"source_name":"Objective See Green Lambert for OSX Oct 2021","url":"https://objective-see.com/blog/blog_0x68.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a08900f6-65be-4022-8ad8-fe6c6c91c1d0","subject":"ATTACK:enterprise:S1059","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a08900f6-65be-4022-8ad8-fe6c6c91c1d0","modified":"2026-04-29T14:23:06.144Z","references":[{"source_name":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"},{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a0c3b1cc-5ea6-46c0-8719-f67ae953333e","subject":"ATTACK:enterprise:S0691","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a0c3b1cc-5ea6-46c0-8719-f67ae953333e","modified":"2026-04-29T14:23:06.144Z","references":[{"source_name":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a1b1aaab-021e-4d2e-9c3b-eaac41833a4e","subject":"ATTACK:enterprise:S0672","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a1b1aaab-021e-4d2e-9c3b-eaac41833a4e","modified":"2026-04-29T14:23:06.145Z","references":[{"source_name":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a1d982c7-bb95-4533-9feb-05c5350b8359","subject":"ATTACK:enterprise:S0673","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a1d982c7-bb95-4533-9feb-05c5350b8359","modified":"2026-04-29T14:23:06.145Z","references":[{"source_name":"Prevailion DarkWatchman 2021","url":"https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a2c1921d-3d5d-4ec7-ab4d-4fe2e7d19e64","subject":"ATTACK:enterprise:S0666","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a2c1921d-3d5d-4ec7-ab4d-4fe2e7d19e64","modified":"2026-04-29T14:23:06.146Z","references":[{"source_name":"ESET Gelsemium June 2021","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a613f562-50d2-4677-b3ad-70e097127f6d","subject":"ATTACK:enterprise:S1015","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a613f562-50d2-4677-b3ad-70e097127f6d","modified":"2026-04-29T14:23:06.151Z","references":[{"source_name":"ClearSky Siamesekitten August 2021","url":"https://www.clearskysec.com/siamesekitten/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a9062634-d5c3-4154-bea0-e4e76821d944","subject":"ATTACK:enterprise:C0006","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a9062634-d5c3-4154-bea0-e4e76821d944","modified":"2026-07-31T18:47:20.955Z","references":[{"source_name":"McAfee Honeybee","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aa0819dc-ed46-4908-af81-cdcd5c4d1845","subject":"ATTACK:enterprise:S1101","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aa0819dc-ed46-4908-af81-cdcd5c4d1845","modified":"2026-04-29T14:23:06.156Z","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aacc2945-4ff1-4bf8-8428-1198eb6e127e","subject":"ATTACK:enterprise:S0642","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aacc2945-4ff1-4bf8-8428-1198eb6e127e","modified":"2026-06-13T12:04:40.997Z","references":[{"source_name":"Accenture MUDCARP March 2019","url":"https://web.archive.org/web/20210722005437/https://www.accenture.com/_acnmedia/PDF-96/Accenture-Security-MUDCARP.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ab1b59f1-8629-48f4-ae9f-a18042122cb8","subject":"ATTACK:enterprise:S0674","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ab1b59f1-8629-48f4-ae9f-a18042122cb8","modified":"2026-04-29T14:23:06.158Z","references":[{"source_name":"Check Point APT35 CharmPower January 2022","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--abdcd223-b8e0-4caa-99b8-52c9d60120d6","subject":"ATTACK:enterprise:G1056","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--abdcd223-b8e0-4caa-99b8-52c9d60120d6","modified":"2026-09-02T17:31:49.045Z","references":[{"source_name":"Flashpoint Mini Shai-Hulud MAY 2026","url":"https://flashpoint.io/blog/mini-shai-hulud-worm-new-era-ci-cd-exploitation/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--abf314e7-e379-4e8b-aab3-4a74d737a70d","subject":"ATTACK:enterprise:S0084","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--abf314e7-e379-4e8b-aab3-4a74d737a70d","modified":"2026-04-29T14:23:06.159Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ad701054-044b-4e9a-a96b-4a477ae874b2","subject":"ATTACK:enterprise:S0594","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ad701054-044b-4e9a-a96b-4a477ae874b2","modified":"2026-04-29T14:23:06.161Z","references":[{"source_name":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aec0a948-428f-4327-b466-a0472da12928","subject":"ATTACK:enterprise:G0027","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aec0a948-428f-4327-b466-a0472da12928","modified":"2026-07-31T18:48:29.486Z","references":[{"source_name":"SecureWorks BRONZE UNION June 2017","url":"https://www.secureworks.com/research/bronze-union"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aef756f0-f34d-4cae-a16d-65e456f75c35","subject":"ATTACK:enterprise:S1023","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aef756f0-f34d-4cae-a16d-65e456f75c35","modified":"2026-04-29T14:23:06.163Z","references":[{"source_name":"Microsoft POLONIUM June 2022","url":"https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--afcc4ac4-b088-4795-b159-c6245223178b","subject":"ATTACK:enterprise:S0237","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--afcc4ac4-b088-4795-b159-c6245223178b","modified":"2026-04-29T14:23:06.165Z","references":[{"source_name":"Talos GravityRAT","url":"https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aff9bcd9-34b9-4c94-9ce0-dd4852118f91","subject":"ATTACK:enterprise:S0492","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aff9bcd9-34b9-4c94-9ce0-dd4852118f91","modified":"2026-04-29T14:23:06.165Z","references":[{"source_name":"Unit42 CookieMiner Jan 2019","url":"https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b2425d69-e91c-493a-aa66-598aa3d5c7f4","subject":"ATTACK:enterprise:S0686","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b2425d69-e91c-493a-aa66-598aa3d5c7f4","modified":"2026-04-29T14:23:06.168Z","references":[{"source_name":"Microsoft Actinium February 2022","url":"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b3e2d8aa-99f1-4e02-8547-769837edfbe1","subject":"ATTACK:enterprise:S9050","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b3e2d8aa-99f1-4e02-8547-769837edfbe1","modified":"2026-09-11T19:59:22.314Z","references":[{"source_name":"QuorumCyber_Vidar_March2023","url":"https://www.quorumcyber.com/wp-content/uploads/2023/01/Malware-Analysis-Vidar.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b4261771-7a46-4203-b861-81566d36ad4e","subject":"ATTACK:enterprise:S9020","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b4261771-7a46-4203-b861-81566d36ad4e","modified":"2026-04-29T14:23:06.171Z","references":[{"source_name":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"},{"source_name":"Kaspersky LODEINFO Part II OCT 2022","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-ii/107745/"},{"source_name":"ITOCHU LODEINFO JAN 2024","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b45e744d-f9c3-4469-a410-137f1802536f","subject":"ATTACK:enterprise:S0452","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b45e744d-f9c3-4469-a410-137f1802536f","modified":"2026-04-29T14:23:06.172Z","references":[{"source_name":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b49fbcf8-ccc9-442b-a0d5-0bb595691775","subject":"ATTACK:enterprise:C0029","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b49fbcf8-ccc9-442b-a0d5-0bb595691775","modified":"2026-07-31T18:47:23.335Z","references":[{"source_name":"Mandiant Cutting Edge Part 2 January 2024","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"},{"source_name":"Volexity Ivanti Zero-Day Exploitation January 2024","url":"https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b7c40c13-6b20-4470-a715-04b5fa01ef24","subject":"ATTACK:enterprise:S0668","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b7c40c13-6b20-4470-a715-04b5fa01ef24","modified":"2026-04-29T14:23:06.176Z","references":[{"source_name":"Talos TinyTurla September 2021","url":"https://blog.talosintelligence.com/2021/09/tinyturla.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b8d078f6-77ad-4c6c-8d20-0c4a5a3fd05a","subject":"ATTACK:enterprise:S0409","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b8d078f6-77ad-4c6c-8d20-0c4a5a3fd05a","modified":"2026-04-29T14:23:06.177Z","references":[{"source_name":"ESET Machete July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bb7c9ed8-1733-4c81-8952-2196935571ef","subject":"ATTACK:enterprise:C0001","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bb7c9ed8-1733-4c81-8952-2196935571ef","modified":"2026-07-31T18:47:19.421Z","references":[{"source_name":"Talos Frankenstein June 2019","url":"https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bc0ed7ce-f99f-4d88-a3cc-81af825f311a","subject":"ATTACK:enterprise:G0046","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bc0ed7ce-f99f-4d88-a3cc-81af825f311a","modified":"2026-07-31T20:48:32.170Z","references":[{"source_name":"CrowdStrike Carbon Spider August 2021","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bc734b57-ea31-4c84-a467-851c093fb09f","subject":"ATTACK:enterprise:S1200","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bc734b57-ea31-4c84-a467-851c093fb09f","modified":"2026-04-29T14:23:06.182Z","references":[{"source_name":"Cybereason StealBit Exfiltration Tool","url":"https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool"},{"source_name":"FBI Lockbit 2.0 FEB 2022","url":"https://www.ic3.gov/CSA/2022/220204.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bcbc763e-b51f-4c43-9226-c8c5d545fb74","subject":"ATTACK:enterprise:G1055","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bcbc763e-b51f-4c43-9226-c8c5d545fb74","modified":"2026-07-31T18:48:25.929Z","references":[{"source_name":"SPECOPS Outpost24 Handala Hack Stryker March 2026","url":"https://specopssoft.com/blog/stryker-cyber-attack-what-we-know-remote-wipe/"},{"source_name":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"},{"source_name":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bcd496b7-7e6a-483b-b1d4-f7dc935a563d","subject":"ATTACK:enterprise:S0517","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bcd496b7-7e6a-483b-b1d4-f7dc935a563d","modified":"2026-04-29T14:23:06.183Z","references":[{"source_name":"Trustwave Pillowmint June 2020","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bd2312fb-51ff-4766-a24f-1f5911457bc6","subject":"ATTACK:enterprise:S0477","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bd2312fb-51ff-4766-a24f-1f5911457bc6","modified":"2026-04-29T14:23:06.184Z","references":[{"source_name":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c011e80b-7b86-405a-8d41-745bd37a0d10","subject":"ATTACK:enterprise:S0012","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c011e80b-7b86-405a-8d41-745bd37a0d10","modified":"2026-04-29T14:23:06.188Z","references":[{"source_name":"Symantec Darkmoon Aug 2005","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2005-081910-3934-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c13cb2e5-09cb-4fcd-9fdb-58b147a25781","subject":"ATTACK:enterprise:S1229","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c13cb2e5-09cb-4fcd-9fdb-58b147a25781","modified":"2026-04-29T14:23:06.189Z","references":[{"source_name":"Immersive Labs Havoc C2 APR 2024","url":"https://www.immersivelabs.com/resources/blog/havoc-c2-framework-a-defensive-operators-guide"},{"source_name":"Havoc Framework Documentation","url":"https://havocframework.com/docs/welcome"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c2e6b2a9-86b7-439a-88ac-dd2c34456d71","subject":"ATTACK:enterprise:S0500","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c2e6b2a9-86b7-439a-88ac-dd2c34456d71","modified":"2026-04-29T14:23:06.192Z","references":[{"source_name":"Secureworks MCMD July 2019","url":"https://www.secureworks.com/research/mcmd-malware-analysis"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c37afb06-a8bb-48ac-ba38-a09bdc8833a9","subject":"ATTACK:enterprise:G1003","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c37afb06-a8bb-48ac-ba38-a09bdc8833a9","modified":"2026-07-31T18:48:13.527Z","references":[{"source_name":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"},{"source_name":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c3c9a7e7-4dbb-487e-b546-7bec3f929b3b","subject":"ATTACK:enterprise:C0004","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c3c9a7e7-4dbb-487e-b546-7bec3f929b3b","modified":"2026-07-31T18:47:34.471Z","references":[{"source_name":"BlackBerry CostaRicto November 2020","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c43836c9-2b45-41a4-8f4f-838508043cfa","subject":"ATTACK:enterprise:G1045","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c43836c9-2b45-41a4-8f4f-838508043cfa","modified":"2026-09-22T22:05:18.912Z","references":[{"source_name":"CISA_AA25-239ASaltTyphoon_Sept2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c5a8316e-f45c-432d-beb3-d8de4785dba3","subject":"ATTACK:enterprise:S0662","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c5a8316e-f45c-432d-beb3-d8de4785dba3","modified":"2026-04-29T14:23:06.196Z","references":[{"source_name":"Profero APT27 December 2020","url":"https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf"},{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c773b719-edd5-46fc-a2b8-1bc36b2031d6","subject":"ATTACK:enterprise:C0062","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c773b719-edd5-46fc-a2b8-1bc36b2031d6","modified":"2026-07-31T18:47:24.715Z","references":[{"source_name":"Anthropic AI Orchestrated Campaign NOV 2025","url":"https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c8389b37-06ee-4cca-9f03-7ade85b1c681","subject":"ATTACK:enterprise:S1044","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c8389b37-06ee-4cca-9f03-7ade85b1c681","modified":"2026-04-29T14:23:06.199Z","references":[{"source_name":"Kaspersky APT Trends Q1 2020","url":"https://securelist.com/apt-trends-report-q1-2020/96826/"},{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c9b37055-af2b-4ec1-857c-79adfb290d66","subject":"ATTACK:enterprise:S0015","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c9b37055-af2b-4ec1-857c-79adfb290d66","modified":"2026-04-29T14:23:06.201Z","references":[{"source_name":"Trend Micro IXESHE 2012","url":"https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cabdb159-174a-4fbd-b026-1d67f8f59dcf","subject":"ATTACK:enterprise:S0352","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cabdb159-174a-4fbd-b026-1d67f8f59dcf","modified":"2026-04-29T14:23:06.202Z","references":[{"source_name":"Trend Micro MacOS Backdoor November 2020","url":"https://www.trendmicro.com/en_us/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cb41e11f-1a03-43f3-af0e-a7318632350f","subject":"ATTACK:enterprise:S0538","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cb41e11f-1a03-43f3-af0e-a7318632350f","modified":"2026-04-29T14:23:06.203Z","references":[{"source_name":"ESET Crutch December 2020","url":"https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cc9ffcec-db79-4913-91ae-ffd5cec643f7","subject":"ATTACK:enterprise:S0250","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cc9ffcec-db79-4913-91ae-ffd5cec643f7","modified":"2026-04-29T14:23:06.205Z","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"},{"source_name":"Github Koadic","url":"https://github.com/offsecginger/koadic"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cdf73653-b2d7-422f-b433-b6a428ff12d4","subject":"ATTACK:enterprise:G0038","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cdf73653-b2d7-422f-b433-b6a428ff12d4","modified":"2026-07-31T18:48:07.377Z","references":[{"source_name":"Citizen Lab Stealth Falcon May 2016","url":"https://citizenlab.org/2016/05/stealth-falcon/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cec55762-ea2f-424e-b87e-9bc574f331c2","subject":"ATTACK:enterprise:S9009","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cec55762-ea2f-424e-b87e-9bc574f331c2","modified":"2026-04-29T14:23:06.208Z","references":[{"source_name":"Netskope Shai-Hulud November 2025","url":"https://www.netskope.com/blog/shai-hulud-2-0-aggressive-automated-one-of-fastest-spreading-npm-supply-chain-attacks-ever-observed"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d1a17f31-c62f-4ec3-9a77-41e6a339a657","subject":"ATTACK:enterprise:S0240","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d1a17f31-c62f-4ec3-9a77-41e6a339a657","modified":"2026-04-29T14:23:06.212Z","references":[{"source_name":"NCCGroup RokRat Nov 2018","url":"https://research.nccgroup.com/2018/11/08/rokrat-analysis/"},{"source_name":"Volexity InkySquid RokRAT August 2021","url":"https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"},{"source_name":"Malwarebytes RokRAT VBA January 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d20f3c5a-5987-4223-a97d-64ca0f1231ac","subject":"ATTACK:enterprise:G0082","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d20f3c5a-5987-4223-a97d-64ca0f1231ac","modified":"2026-07-31T20:48:23.419Z","references":[{"source_name":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d5e027a9-7c0e-42f1-bf51-5432980dbf77","subject":"ATTACK:enterprise:S0381","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d5e027a9-7c0e-42f1-bf51-5432980dbf77","modified":"2026-04-29T14:23:06.217Z","references":[{"source_name":"Korean FSI TA505 2020","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d5f428f5-4c16-495e-bc79-882a92ce75e0","subject":"ATTACK:enterprise:G1017","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d5f428f5-4c16-495e-bc79-882a92ce75e0","modified":"2026-07-31T18:47:41.305Z","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source_name":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source_name":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d6049a18-43d5-4761-ad56-a60e2a7998cf","subject":"ATTACK:enterprise:S0211","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d6049a18-43d5-4761-ad56-a60e2a7998cf","modified":"2026-04-29T14:23:06.218Z","references":[{"source_name":"Symantec Linfo May 2012","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-051605-2535-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d6d72bc4-c8d7-48b3-96c3-84a9810333d2","subject":"ATTACK:enterprise:S0444","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d6d72bc4-c8d7-48b3-96c3-84a9810333d2","modified":"2026-04-29T14:23:06.219Z","references":[{"source_name":"FOX-IT May 2016 Mofang","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d77a4123-3d46-4317-8921-f6eb8c34c585","subject":"ATTACK:enterprise:S0048","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d77a4123-3d46-4317-8921-f6eb8c34c585","modified":"2026-04-29T14:23:06.219Z","references":[{"source_name":"F-Secure The Dukes","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--da542c01-9b62-4e42-9036-809ceb31eb8d","subject":"ATTACK:enterprise:S0667","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--da542c01-9b62-4e42-9036-809ceb31eb8d","modified":"2026-04-29T14:23:06.223Z","references":[{"source_name":"ESET Gelsemium June 2021","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dad229e7-fcc6-4c1d-99c3-47d54fbc6892","subject":"ATTACK:enterprise:S0050","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dad229e7-fcc6-4c1d-99c3-47d54fbc6892","modified":"2026-04-29T14:23:06.224Z","references":[{"source_name":"F-Secure Cosmicduke","url":"https://blog.f-secure.com/wp-content/uploads/2019/10/CosmicDuke.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dc2b58dd-1052-4860-8e14-5650ab8eecfd","subject":"ATTACK:enterprise:S0337","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dc2b58dd-1052-4860-8e14-5650ab8eecfd","modified":"2026-04-29T14:23:06.226Z","references":[{"source_name":"Unit 42 BadPatch Oct 2017","url":"https://researchcenter.paloaltonetworks.com/2017/10/unit42-badpatch/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dcca4e73-fa98-4d67-8ed3-590da7a32d43","subject":"ATTACK:enterprise:S0404","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dcca4e73-fa98-4d67-8ed3-590da7a32d43","modified":"2026-04-29T14:23:06.227Z","references":[{"source_name":"Red Canary 2021 Threat Detection Report March 2021","url":"https://resource.redcanary.com/rs/003-YRU-314/images/2021-Threat-Detection-Report.pdf?mkt_tok=MDAzLVlSVS0zMTQAAAF_PIlmhNTaG2McG4X_foM-cIr20UfyB12MIQ10W0HbtMRwxGOJaD0Xj6CRTNg_S-8KniRxtf9xzhz_ACvm_TpbJAIgWCV8yIsFgbhb8cuaZA"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dd82187a-7a40-45c3-a1d2-66d37bc6146e","subject":"ATTACK:enterprise:S0009","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dd82187a-7a40-45c3-a1d2-66d37bc6146e","modified":"2026-04-29T14:23:06.227Z","references":[{"source_name":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--df10eb7e-da72-41d2-9808-520f95194346","subject":"ATTACK:enterprise:S1245","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--df10eb7e-da72-41d2-9808-520f95194346","modified":"2026-04-29T14:23:06.229Z","references":[{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dfb3ddf9-7683-4d88-ba40-eab0f87a3a8c","subject":"ATTACK:enterprise:S1013","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dfb3ddf9-7683-4d88-ba40-eab0f87a3a8c","modified":"2026-04-29T14:23:06.230Z","references":[{"source_name":"Cisco Talos Bitter Bangladesh May 2022","url":"https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dfedbce3-afe2-46f4-80fb-7f3e802c5f03","subject":"ATTACK:enterprise:G0045","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dfedbce3-afe2-46f4-80fb-7f3e802c5f03","modified":"2026-07-31T18:47:44.727Z","references":[{"source_name":"DOJ APT10 Dec 2018","url":"https://www.justice.gov/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion"},{"source_name":"Symantec Cicada November 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e0486083-dc85-4cd4-bcce-b0ab90930c44","subject":"ATTACK:enterprise:S0275","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e0486083-dc85-4cd4-bcce-b0ab90930c44","modified":"2026-04-29T14:23:06.231Z","references":[{"source_name":"Trend Micro Earth Kasha Anel NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"},{"source_name":"Trend Micro Earth Kasha Updates APR 2025","url":"https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e199c02e-a45c-4eca-ab24-7b037167c775","subject":"ATTACK:enterprise:G0102","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e199c02e-a45c-4eca-ab24-7b037167c775","modified":"2026-07-31T20:48:50.569Z","references":[{"source_name":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e2966853-e5ce-4c28-a36f-61947a45c694","subject":"ATTACK:enterprise:S1224","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e2966853-e5ce-4c28-a36f-61947a45c694","modified":"2026-04-29T14:23:06.234Z","references":[{"source_name":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e29a5b07-48b5-429e-ab32-84c98094372f","subject":"ATTACK:enterprise:S9059","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e29a5b07-48b5-429e-ab32-84c98094372f","modified":"2026-09-28T18:44:02.857Z","references":[{"source_name":"Mandiant_UNC1549_Feb2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e4f09baa-2eae-445f-b000-5de3db07ad34","subject":"ATTACK:enterprise:S0265","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e4f09baa-2eae-445f-b000-5de3db07ad34","modified":"2026-04-29T14:23:06.237Z","references":[{"source_name":"Unit 42 Kazuar May 2017","url":"https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e7126875-bb0f-48d0-845f-6b8951ce8507","subject":"ATTACK:enterprise:S0208","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e7126875-bb0f-48d0-845f-6b8951ce8507","modified":"2026-04-29T14:23:06.239Z","references":[{"source_name":"Symantec Pasam May 2012","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-050412-4128-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e75cec16-55e4-471d-ab89-52edf5a7799e","subject":"ATTACK:enterprise:S0526","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e75cec16-55e4-471d-ab89-52edf5a7799e","modified":"2026-04-29T14:23:06.240Z","references":[{"source_name":"Cybereason Kimsuky November 2020","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e9ca5d3c-cd22-41d6-a81a-97ae51cf32ff","subject":"ATTACK:enterprise:G0059","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e9ca5d3c-cd22-41d6-a81a-97ae51cf32ff","modified":"2026-07-31T18:48:29.653Z","references":[{"source_name":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source_name":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ea05b76d-c443-4b41-8d02-d90b965bd184","subject":"ATTACK:enterprise:S0467","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ea05b76d-c443-4b41-8d02-d90b965bd184","modified":"2026-04-29T14:23:06.244Z","references":[{"source_name":"Kaspersky TajMahal April 2019","url":"https://securelist.com/project-tajmahal/90240/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ea944454-a4e9-44fb-9cf1-3f018a455740","subject":"ATTACK:enterprise:C0012","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ea944454-a4e9-44fb-9cf1-3f018a455740","modified":"2026-07-31T18:47:28.729Z","references":[{"source_name":"Cybereason OperationCuckooBees May 2022","url":"https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-winnti-techniques"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ea9d456c-f2b7-4d95-ab30-2a7e06586615","subject":"ATTACK:enterprise:G0070","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ea9d456c-f2b7-4d95-ab30-2a7e06586615","modified":"2026-09-02T18:51:44.403Z","references":[{"source_name":"Lookout Dark Caracal Jan 2018","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eb956f4e-0fa5-4b2e-822a-5e313226edb5","subject":"ATTACK:enterprise:S1037","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eb956f4e-0fa5-4b2e-822a-5e313226edb5","modified":"2026-04-29T14:23:06.246Z","references":[{"source_name":"DHS CISA AA22-055A MuddyWater February 2022","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ec4231fc-c081-4060-80fb-05f390e5f24c","subject":"ATTACK:enterprise:S1075","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ec4231fc-c081-4060-80fb-05f390e5f24c","modified":"2026-04-29T14:23:06.246Z","references":[{"source_name":"Mandiant Suspected Turla Campaign February 2023","url":"https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ec8c7897-1e29-4a55-b212-3dce350a8ad8","subject":"ATTACK:enterprise:S0660","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ec8c7897-1e29-4a55-b212-3dce350a8ad8","modified":"2026-04-29T14:23:06.247Z","references":[{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ecb7a35e-cc83-4b7d-9eb6-42d0bd7d5d9e","subject":"ATTACK:enterprise:S0515","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ecb7a35e-cc83-4b7d-9eb6-42d0bd7d5d9e","modified":"2026-04-29T14:23:06.247Z","references":[{"source_name":"CISA WellMail July 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198c"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ecbe6cc7-16cc-474f-91fe-bd3e9014abbf","subject":"ATTACK:enterprise:S0629","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ecbe6cc7-16cc-474f-91fe-bd3e9014abbf","modified":"2026-04-29T14:23:06.247Z","references":[{"source_name":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ef7d26b5-7d5f-463d-8279-82b45b6d01a4","subject":"ATTACK:enterprise:S1034","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ef7d26b5-7d5f-463d-8279-82b45b6d01a4","modified":"2026-04-29T14:23:06.251Z","references":[{"source_name":"Cybereason StrifeWater Feb 2022","url":"https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f5af6272-5956-4509-a6e8-0c5daa2e4c7d","subject":"ATTACK:enterprise:S9015","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f5af6272-5956-4509-a6e8-0c5daa2e4c7d","modified":"2026-04-29T14:23:06.259Z","references":[{"source_name":"CISA BRICKSTORM UNC5221 AR25-338A February 2026","url":"https://www.cisa.gov/news-events/analysis-reports/ar25-338a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f5f24a8f-6d98-4f00-9db2-e92189f7d67a","subject":"ATTACK:enterprise:S0234","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f5f24a8f-6d98-4f00-9db2-e92189f7d67a","modified":"2026-04-29T14:23:06.259Z","references":[{"source_name":"CheckPoint Bandook Nov 2020","url":"https://research.checkpoint.com/2020/bandook-signed-delivered/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f892dddf-79a7-4d11-94b3-5df0c37d134a","subject":"ATTACK:enterprise:G0034","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f892dddf-79a7-4d11-94b3-5df0c37d134a","modified":"2026-07-31T20:48:33.430Z","references":[{"source_name":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fa0bc7fd-2e00-435b-8cb3-0ade491d1259","subject":"ATTACK:enterprise:S1028","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fa0bc7fd-2e00-435b-8cb3-0ade491d1259","modified":"2026-04-29T14:23:06.264Z","references":[{"source_name":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fa97bdf1-d973-4a3c-a88e-b5c666c7dd10","subject":"ATTACK:enterprise:S1102","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fa97bdf1-d973-4a3c-a88e-b5c666c7dd10","modified":"2026-04-29T14:23:06.265Z","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fc5cf1ea-f46f-4527-a8b5-7317c4e61dee","subject":"ATTACK:enterprise:G1016","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fc5cf1ea-f46f-4527-a8b5-7317c4e61dee","modified":"2026-07-31T18:48:31.617Z","references":[{"source_name":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source_name":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fcef9b21-8ad5-4c9d-bb04-a5db2053a223","subject":"ATTACK:enterprise:C0058","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fcef9b21-8ad5-4c9d-bb04-a5db2053a223","modified":"2026-07-31T18:47:19.412Z","references":[{"source_name":"ESET ToolShell JUL 2025","url":"https://www.welivesecurity.com/en/eset-research/toolshell-an-all-you-can-eat-buffet-for-threat-actors/"},{"source_name":"SentinelOne ToolShell JUL 2025","url":"https://www.sentinelone.com/blog/sharepoint-toolshell-zero-day-exploited-in-the-wild-targets-enterprise-servers/"},{"source_name":"Microsoft SharePoint Exploit JUL 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/#storm-2603"},{"source_name":"Palo Alto SharePoint Vulnerabilities JUL 2025","url":"https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fdaeae13-b9f2-4ae5-b4ae-c74fde73adcd","subject":"ATTACK:enterprise:S0385","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fdaeae13-b9f2-4ae5-b4ae-c74fde73adcd","modified":"2026-04-29T14:23:06.270Z","references":[{"source_name":"Fidelis njRAT June 2013","url":"https://www.threatminer.org/_reports/2013/fta-1009---njrat-uncovered-1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ff5d439a-c480-45cc-be0c-2fac7f786eda","subject":"ATTACK:enterprise:S1099","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ff5d439a-c480-45cc-be0c-2fac7f786eda","modified":"2026-04-29T14:23:06.272Z","references":[{"source_name":"Kaspersky ToddyCat June 2022","url":"https://securelist.com/toddycat/106799/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ff709d3a-de60-4e1d-abd1-ad30e6837a62","subject":"ATTACK:enterprise:S1018","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ff709d3a-de60-4e1d-abd1-ad30e6837a62","modified":"2026-04-29T14:23:06.272Z","references":[{"source_name":"Malwarebytes Saint Bot April 2021","url":"https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ff746d3d-2ebe-46e9-87f6-5ddd8abbfda3","subject":"ATTACK:enterprise:C0026","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ff746d3d-2ebe-46e9-87f6-5ddd8abbfda3","modified":"2026-07-31T18:47:32.936Z","references":[{"source_name":"Mandiant Suspected Turla Campaign February 2023","url":"https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}