{"record":{"id":"ATTACK:enterprise:T1018","title":"Remote System Discovery","type":"Technique","source_url":"https://attack.mitre.org/techniques/T1018","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--e358d692-23c0-4a31-9eb6-ecc13a8d7735","external_id":"T1018","domain":"enterprise","created":"2017-05-31T21:30:28.187Z","modified":"2026-05-12T15:12:00.722Z","version":"3.6","aliases":[],"tactics":["discovery"],"source_references":[{"source_name":"CISA AR21-126A FIVEHANDS May 2021","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"},{"source_name":"Elastic - Koadiac Detection with EQL","url":"https://www.elastic.co/security-labs/embracing-offensive-tooling-building-detections-against-koadic-using-eql"},{"source_name":"US-CERT-TA18-106A","url":"https://www.us-cert.gov/ncas/alerts/TA18-106A"}]},"assertions":[{"id":"enterprise:relationship--01b94982-fedb-4469-adf1-7f2a2a9069ea","subject":"ATTACK:enterprise:G1003","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--01b94982-fedb-4469-adf1-7f2a2a9069ea","modified":"2026-07-31T18:48:12.846Z","references":[{"source_name":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--03f32a8b-4cd9-488c-9759-37f3dff9faea","subject":"ATTACK:enterprise:G0045","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--03f32a8b-4cd9-488c-9759-37f3dff9faea","modified":"2026-07-31T18:47:43.455Z","references":[{"source_name":"FireEye APT10 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"},{"source_name":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--05ee7ead-dfe8-4cd2-9e7c-8f1aada9bcde","subject":"ATTACK:enterprise:S0233","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--05ee7ead-dfe8-4cd2-9e7c-8f1aada9bcde","modified":"2026-04-29T14:23:05.911Z","references":[{"source_name":"FireEye Periscope March 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--07324f90-f7c1-41f7-8d08-3ecec98bbe5c","subject":"ATTACK:enterprise:S0586","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--07324f90-f7c1-41f7-8d08-3ecec98bbe5c","modified":"2026-04-29T14:23:05.913Z","references":[{"source_name":"CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0b2d53db-2f5c-4dc7-97de-f0c12e22472c","subject":"ATTACK:enterprise:S0684","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0b2d53db-2f5c-4dc7-97de-f0c12e22472c","modified":"2026-04-29T14:23:05.918Z","references":[{"source_name":"Roadtools","url":"https://dirkjanm.io/introducing-roadtools-and-roadrecon-azure-ad-exploration-framework/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0c8370b1-efd1-4e5d-86c9-d3ffba1bb22d","subject":"ATTACK:enterprise:S0570","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0c8370b1-efd1-4e5d-86c9-d3ffba1bb22d","modified":"2026-04-29T14:23:05.920Z","references":[{"source_name":"Crowdstrike Indrik November 2018","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0cbe929a-96e2-4ff8-bf8d-501a9a8d2ad2","subject":"ATTACK:enterprise:S0650","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0cbe929a-96e2-4ff8-bf8d-501a9a8d2ad2","modified":"2026-04-29T14:23:05.920Z","references":[{"source_name":"Crowdstrike Qakbot October 2020","url":"https://www.crowdstrike.com/blog/duck-hunting-with-falcon-complete-qakbot-zip-based-campaign/"},{"source_name":"Trend Micro Black Basta October 2022","url":"https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html"},{"source_name":"Kaspersky QakBot September 2021","url":"https://securelist.com/qakbot-technical-analysis/103931/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0d6b67b8-016a-4335-89f1-2cdb7ed778c1","subject":"ATTACK:enterprise:C0012","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0d6b67b8-016a-4335-89f1-2cdb7ed778c1","modified":"2026-07-31T18:47:28.084Z","references":[{"source_name":"Cybereason OperationCuckooBees May 2022","url":"https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-winnti-techniques"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0d7506cd-4869-48f9-a0e0-cb70d6b482ff","subject":"ATTACK:enterprise:C0014","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0d7506cd-4869-48f9-a0e0-cb70d6b482ff","modified":"2026-07-31T18:47:31.352Z","references":[{"source_name":"FoxIT Wocao December 2019","url":"https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1374e38c-db37-46f8-8560-63901a3e7e56","subject":"ATTACK:enterprise:G0117","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1374e38c-db37-46f8-8560-63901a3e7e56","modified":"2026-07-31T18:48:16.842Z","references":[{"source_name":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--15a571d1-652c-4148-9dee-12d3b1cbff62","subject":"ATTACK:enterprise:S0452","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--15a571d1-652c-4148-9dee-12d3b1cbff62","modified":"2026-04-29T14:23:05.933Z","references":[{"source_name":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--16d19ac1-de53-44e2-9139-32b0e0525b0c","subject":"ATTACK:enterprise:S0534","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--16d19ac1-de53-44e2-9139-32b0e0525b0c","modified":"2026-04-29T14:23:05.935Z","references":[{"source_name":"Cybereason Bazar July 2020","url":"https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--18c44352-1eca-4d6e-9eac-9793b75223df","subject":"ATTACK:enterprise:S1081","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--18c44352-1eca-4d6e-9eac-9793b75223df","modified":"2026-04-29T14:23:05.938Z","references":[{"source_name":"BitDefender BADHATCH Mar 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--22ece51b-ebfa-474d-8a6e-6835ff891890","subject":"ATTACK:enterprise:G1030","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--22ece51b-ebfa-474d-8a6e-6835ff891890","modified":"2026-07-31T18:48:14.499Z","references":[{"source_name":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--25b8605b-9ab2-418f-b92b-abb2be815b90","subject":"ATTACK:enterprise:S1068","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--25b8605b-9ab2-418f-b92b-abb2be815b90","modified":"2026-04-29T14:23:05.956Z","references":[{"source_name":"Microsoft BlackCat Jun 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2794f341-b46f-482c-b5b7-2cc7c2dcadb5","subject":"ATTACK:enterprise:G0019","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2794f341-b46f-482c-b5b7-2cc7c2dcadb5","modified":"2026-07-31T18:47:46.006Z","references":[{"source_name":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--280bb6ec-0d7f-4a42-a3f2-7a3b43886126","subject":"ATTACK:enterprise:G0009","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--280bb6ec-0d7f-4a42-a3f2-7a3b43886126","modified":"2026-07-31T18:48:12.613Z","references":[{"source_name":"Alperovitch 2014","url":"https://web.archive.org/web/20200424075623/https:/www.crowdstrike.com/blog/deep-thought-chinese-targeting-national-security-think-tanks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2bb7ed69-8f59-47f3-8d86-f1c1202c7629","subject":"ATTACK:enterprise:G1006","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2bb7ed69-8f59-47f3-8d86-f1c1202c7629","modified":"2026-07-31T20:48:48.151Z","references":[{"source_name":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2ea4f604-c23b-4d67-8648-f2c170378e78","subject":"ATTACK:enterprise:G0096","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2ea4f604-c23b-4d67-8648-f2c170378e78","modified":"2026-07-31T20:48:26.899Z","references":[{"source_name":"apt41_dcsocytec_dec2022","url":"https://medium.com/@DCSO_CyTec/apt41-the-spy-who-failed-to-encrypt-me-24fc0f49cad1"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--31ec568c-53c7-4dfb-8bfb-bfb7addca7ee","subject":"ATTACK:enterprise:S0039","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--31ec568c-53c7-4dfb-8bfb-bfb7addca7ee","modified":"2026-04-29T14:23:05.982Z","references":[{"source_name":"Savill 1999","url":"https://web.archive.org/web/20150511162820/http://windowsitpro.com/windows/netexe-reference"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3341a11e-acd1-4cba-a7a9-5bb48aec8bec","subject":"ATTACK:enterprise:S1070","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3341a11e-acd1-4cba-a7a9-5bb48aec8bec","modified":"2026-04-29T14:23:05.986Z","references":[{"source_name":"Check Point Black Basta October 2022","url":"https://research.checkpoint.com/2022/black-basta-and-the-unnoticed-delivery/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--390d98f6-dd1c-4fce-a02a-4ac2c1d30934","subject":"ATTACK:enterprise:S9020","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--390d98f6-dd1c-4fce-a02a-4ac2c1d30934","modified":"2026-04-29T14:23:05.998Z","references":[{"source_name":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3c021bb7-e96b-4a87-931b-d74f19ec8bcb","subject":"ATTACK:enterprise:S0248","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3c021bb7-e96b-4a87-931b-d74f19ec8bcb","modified":"2026-04-29T14:23:06.004Z","references":[{"source_name":"ASERT Donot March 2018","url":"https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3d4cb0b5-148f-4e3f-a09f-7a17823b2b56","subject":"ATTACK:enterprise:C0007","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3d4cb0b5-148f-4e3f-a09f-7a17823b2b56","modified":"2026-07-31T18:47:27.223Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3ef6a3fb-0d59-4ba5-b2d0-dc32d547b74f","subject":"ATTACK:enterprise:G0053","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3ef6a3fb-0d59-4ba5-b2d0-dc32d547b74f","modified":"2026-07-31T20:48:40.255Z","references":[{"source_name":"Mandiant FIN5 GrrCON Oct 2016","url":"https://www.youtube.com/watch?v=fevGZs0EQu8"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--40356b61-2279-47ef-b7bd-4b355e2fb98a","subject":"ATTACK:enterprise:G1017","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--40356b61-2279-47ef-b7bd-4b355e2fb98a","modified":"2026-07-31T18:47:40.123Z","references":[{"source_name":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source_name":"Microsoft Volt Typhoon May 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--42d2f7f0-9548-4bdd-9e88-7200a9e91b57","subject":"ATTACK:enterprise:G0034","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--42d2f7f0-9548-4bdd-9e88-7200a9e91b57","modified":"2026-07-31T20:48:32.830Z","references":[{"source_name":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"},{"source_name":"Dragos Crashoverride 2018","url":"https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4a50bbbf-990f-4556-86e2-2990bccc90e9","subject":"ATTACK:enterprise:G1040","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4a50bbbf-990f-4556-86e2-2990bccc90e9","modified":"2026-07-31T18:48:25.666Z","references":[{"source_name":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4b314d34-1e53-46a4-a3b8-131a19b256d6","subject":"ATTACK:enterprise:S0385","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4b314d34-1e53-46a4-a3b8-131a19b256d6","modified":"2026-04-29T14:23:06.028Z","references":[{"source_name":"Fidelis njRAT June 2013","url":"https://www.threatminer.org/_reports/2013/fta-1009---njrat-uncovered-1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4f31fe80-6994-443d-ad54-7584601618dd","subject":"ATTACK:enterprise:G0129","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4f31fe80-6994-443d-ad54-7584601618dd","modified":"2026-07-31T18:47:52.275Z","references":[{"source_name":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"},{"source_name":"Unit42 Chinese VSCode 06 September 2024","url":"https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--50cf1a8b-5ed4-4155-a09d-ed65cf9c4a08","subject":"ATTACK:enterprise:S0604","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--50cf1a8b-5ed4-4155-a09d-ed65cf9c4a08","modified":"2026-04-29T14:23:06.036Z","references":[{"source_name":"ESET Industroyer","url":"https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--51742efe-5f0c-4fbf-9eb7-5e765a0a408f","subject":"ATTACK:enterprise:S0125","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--51742efe-5f0c-4fbf-9eb7-5e765a0a408f","modified":"2026-04-29T14:23:06.037Z","references":[{"source_name":"Kaspersky ProjectSauron Technical Analysis","url":"https://securelist.com/files/2016/07/The-ProjectSauron-APT_Technical_Analysis_KL.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--52ec8e9e-4276-4793-bc9b-76c312cba5cd","subject":"ATTACK:enterprise:C0049","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--52ec8e9e-4276-4793-bc9b-76c312cba5cd","modified":"2026-07-31T18:47:32.800Z","references":[{"source_name":"CISA Leviathan 2024","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5b5635da-130a-4075-8936-23078f63d419","subject":"ATTACK:enterprise:C0064","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5b5635da-130a-4075-8936-23078f63d419","modified":"2026-10-09T00:56:40.966Z","references":[{"source_name":"AI-Mexico-Govt-Breach","url":"https://cdn.prod.website-files.com/69944dd945f20ca4a27a7c47/69d8bb5aea59e31efb3b8a7f_Tech_Report_ai_breach_mex_gov.pdf"},{"source_name":"AI-Mexico-Govt-Compromise","url":"https://5943619.hs-sites.com/hubfs/116-Whitepapers/dragos-2026-ai-mexico-water-attack-intel-brief.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5d23f25a-d98a-47a6-8da7-86e8a73c3407","subject":"ATTACK:enterprise:G1024","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5d23f25a-d98a-47a6-8da7-86e8a73c3407","modified":"2026-07-31T18:47:55.150Z","references":[{"source_name":"Arctic Wolf Akira 2023","url":"https://arcticwolf.com/resources/blog/conti-and-akira-chained-together/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5fe7e204-803e-47fc-83a5-f4766d2cedfa","subject":"ATTACK:enterprise:S1198","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5fe7e204-803e-47fc-83a5-f4766d2cedfa","modified":"2026-04-29T14:23:06.055Z","references":[{"source_name":"Symantec Troll Stealer 2024","url":"https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--61ce754c-da32-4f0d-9c5f-bdf4debf7377","subject":"ATTACK:enterprise:C0028","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--61ce754c-da32-4f0d-9c5f-bdf4debf7377","modified":"2026-08-04T20:48:44.861Z","references":[{"source_name":"Charles McLellan March 2016","url":"https://www.zdnet.com/article/how-hackers-attacked-ukraines-power-grid-implications-for-industrial-iot-security/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--625ebfc0-7aaa-4eaf-8c49-be8b55c059d4","subject":"ATTACK:enterprise:G0004","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--625ebfc0-7aaa-4eaf-8c49-be8b55c059d4","modified":"2026-07-31T18:48:01.080Z","references":[{"source_name":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--63b477c5-b88b-469d-8b2a-bc30507de54f","subject":"ATTACK:enterprise:S0488","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--63b477c5-b88b-469d-8b2a-bc30507de54f","modified":"2026-04-29T14:23:06.061Z","references":[{"source_name":"CME Github September 2018","url":"https://github.com/byt3bl33d3r/CrackMapExec/wiki/SMB-Command-Reference"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--64f0efcd-e46a-4bcf-9cbe-4c890e13c01b","subject":"ATTACK:enterprise:S0428","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--64f0efcd-e46a-4bcf-9cbe-4c890e13c01b","modified":"2026-04-29T14:23:06.062Z","references":[{"source_name":"Talos PoetRAT April 2020","url":"https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6679b9ed-d9ec-4ff3-9961-24f39814f6d0","subject":"ATTACK:enterprise:G1001","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6679b9ed-d9ec-4ff3-9961-24f39814f6d0","modified":"2026-07-31T20:48:51.787Z","references":[{"source_name":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--68b54bc3-77f8-4b4e-bd65-bfb172b85db9","subject":"ATTACK:enterprise:S1212","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--68b54bc3-77f8-4b4e-bd65-bfb172b85db9","modified":"2026-04-29T14:23:06.067Z","references":[{"source_name":"Group-IB RansomHub FEB 2025","url":"https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6e576576-bcd8-42ca-aa0a-8e3e24aaeafc","subject":"ATTACK:enterprise:S0091","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6e576576-bcd8-42ca-aa0a-8e3e24aaeafc","modified":"2026-04-29T14:23:06.075Z","references":[{"source_name":"Kaspersky Turla","url":"https://securelist.com/the-epic-turla-operation/65545/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6efce751-f7b8-4918-b80d-a6c77237516b","subject":"ATTACK:enterprise:C0061","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6efce751-f7b8-4918-b80d-a6c77237516b","modified":"2026-07-31T18:47:24.632Z","references":[{"source_name":"sentinelone operationDigitalEye Dec 2024","url":"https://www.sentinelone.com/labs/operation-digital-eye-chinese-apt-compromises-critical-digital-infrastructure-via-visual-studio-code-tunnels/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--71fd7b73-462f-4629-8d95-59d0129b1503","subject":"ATTACK:enterprise:S0236","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--71fd7b73-462f-4629-8d95-59d0129b1503","modified":"2026-04-29T14:23:06.081Z","references":[{"source_name":"Symantec Orangeworm April 2018","url":"https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--74ef18b6-ca55-4fc3-acf1-10ed585c160f","subject":"ATTACK:enterprise:S1044","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--74ef18b6-ca55-4fc3-acf1-10ed585c160f","modified":"2026-04-29T14:23:06.085Z","references":[{"source_name":"Kaspersky APT Trends Q1 2020","url":"https://securelist.com/apt-trends-report-q1-2020/96826/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7748c6c9-d7a5-44e9-81bf-97d038e6edb1","subject":"ATTACK:enterprise:C0024","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7748c6c9-d7a5-44e9-81bf-97d038e6edb1","modified":"2026-07-31T18:47:26.810Z","references":[{"source_name":"Microsoft Deep Dive Solorigate January 2021","url":"https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--77fbad9a-3a73-4ddb-8d10-60147eb64a81","subject":"ATTACK:enterprise:S0244","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--77fbad9a-3a73-4ddb-8d10-60147eb64a81","modified":"2026-04-29T14:23:06.089Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7a116d1c-33ab-4729-abff-2e37dc387f31","subject":"ATTACK:enterprise:S0366","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7a116d1c-33ab-4729-abff-2e37dc387f31","modified":"2026-04-29T14:23:06.092Z","references":[{"source_name":"SecureWorks WannaCry Analysis","url":"https://www.secureworks.com/research/wcry-ransomware-analysis"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7ad1773a-34ba-498a-ab63-9dea0181f8f8","subject":"ATTACK:enterprise:G1054","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7ad1773a-34ba-498a-ab63-9dea0181f8f8","modified":"2026-07-31T18:48:08.768Z","references":[{"source_name":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7b6eac00-8a13-42e3-b533-a40314eada68","subject":"ATTACK:enterprise:G0027","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7b6eac00-8a13-42e3-b533-a40314eada68","modified":"2026-07-31T18:48:29.237Z","references":[{"source_name":"Nccgroup Emissary Panda May 2018","url":"https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7fe49f05-8f96-4fc2-bc5b-b2eea59efca3","subject":"ATTACK:enterprise:S0018","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7fe49f05-8f96-4fc2-bc5b-b2eea59efca3","modified":"2026-04-29T14:23:06.100Z","references":[{"source_name":"AlienVault Sykipot 2011","url":"https://www.alienvault.com/open-threat-exchange/blog/another-sykipot-sample-likely-targeting-us-federal-agencies"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--80299c96-9450-48bc-8161-e72a41389f6a","subject":"ATTACK:enterprise:S0154","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--80299c96-9450-48bc-8161-e72a41389f6a","modified":"2026-04-29T14:23:06.101Z","references":[{"source_name":"Talos Cobalt Strike September 2020","url":"https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf"},{"source_name":"cobaltstrike manual","url":"https://web.archive.org/web/20210825130434/https://cobaltstrike.com/downloads/csmanual38.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--80b87eab-243c-4e98-a85e-2684520f8824","subject":"ATTACK:enterprise:S0692","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--80b87eab-243c-4e98-a85e-2684520f8824","modified":"2026-04-29T14:23:06.101Z","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--841f6044-8c12-4063-b911-d1da4c8d6fdc","subject":"ATTACK:enterprise:S0521","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--841f6044-8c12-4063-b911-d1da4c8d6fdc","modified":"2026-04-29T14:23:06.106Z","references":[{"source_name":"CrowdStrike BloodHound April 2018","url":"https://www.crowdstrike.com/blog/hidden-administrative-accounts-bloodhound-to-the-rescue/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--86a7ffc8-6107-4854-96a7-d39f8bb4069f","subject":"ATTACK:enterprise:S0694","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--86a7ffc8-6107-4854-96a7-d39f8bb4069f","modified":"2026-04-29T14:23:06.109Z","references":[{"source_name":"ClearSky Lazarus Aug 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8765dd7e-33cc-4040-927d-bf0aa16d3d79","subject":"ATTACK:enterprise:S0165","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8765dd7e-33cc-4040-927d-bf0aa16d3d79","modified":"2026-04-29T14:23:06.110Z","references":[{"source_name":"Symantec Buckeye","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8bda3a33-7524-49e8-aa93-708d2b6a6b17","subject":"ATTACK:enterprise:G1051","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8bda3a33-7524-49e8-aa93-708d2b6a6b17","modified":"2026-07-31T18:48:10.737Z","references":[{"source_name":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8c155a65-b89f-44aa-b4c0-1374208a3fed","subject":"ATTACK:enterprise:S0696","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8c155a65-b89f-44aa-b4c0-1374208a3fed","modified":"2026-04-29T14:23:06.116Z","references":[{"source_name":"NTT Security Flagpro new December 2021","url":"https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8e24b237-b2a1-4d48-ae32-fd0b2d345a74","subject":"ATTACK:enterprise:G1022","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8e24b237-b2a1-4d48-ae32-fd0b2d345a74","modified":"2026-07-31T18:48:14.233Z","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8eebd114-7d43-40da-a6b1-48a11ace403a","subject":"ATTACK:enterprise:S9045","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8eebd114-7d43-40da-a6b1-48a11ace403a","modified":"2026-10-01T17:34:44.386Z","references":[{"source_name":"AI-Mexico-Govt-Breach","url":"https://cdn.prod.website-files.com/69944dd945f20ca4a27a7c47/69d8bb5aea59e31efb3b8a7f_Tech_Report_ai_breach_mex_gov.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9006e828-f70a-4c7e-8dce-07d1040de3e9","subject":"ATTACK:enterprise:S0698","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9006e828-f70a-4c7e-8dce-07d1040de3e9","modified":"2026-04-29T14:23:06.122Z","references":[{"source_name":"ESET Hermetic Wizard March 2022","url":"https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--93a7d544-bed2-4d8c-abda-ab0b82ffa3a9","subject":"ATTACK:enterprise:G0030","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--93a7d544-bed2-4d8c-abda-ab0b82ffa3a9","modified":"2026-07-31T18:48:07.072Z","references":[{"source_name":"Symantec Bilbug 2022","url":"https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--95805281-96b1-49ea-95ee-9d654178c5c3","subject":"ATTACK:enterprise:G0060","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--95805281-96b1-49ea-95ee-9d654178c5c3","modified":"2026-07-31T18:48:10.723Z","references":[{"source_name":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--964233cc-fa6c-4754-9684-6546eb6d5a4a","subject":"ATTACK:enterprise:G0087","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--964233cc-fa6c-4754-9684-6546eb6d5a4a","modified":"2026-07-31T18:47:53.832Z","references":[{"source_name":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"},{"source_name":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"},{"source_name":"Symantec Chafer February 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9b2356e1-6544-40a7-a694-8ac36a1da1b7","subject":"ATTACK:enterprise:S0097","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9b2356e1-6544-40a7-a694-8ac36a1da1b7","modified":"2026-04-29T14:23:06.136Z","references":[{"source_name":"TechNet Ping","url":"https://technet.microsoft.com/en-us/library/bb490968.aspx"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9c424acf-2a41-4b34-867f-590ade731fc2","subject":"ATTACK:enterprise:S0575","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9c424acf-2a41-4b34-867f-590ade731fc2","modified":"2026-04-29T14:23:06.138Z","references":[{"source_name":"CrowdStrike Wizard Spider October 2020","url":"https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9dfdcec6-82b7-42a4-902a-3220f4d67bcf","subject":"ATTACK:enterprise:S0241","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9dfdcec6-82b7-42a4-902a-3220f4d67bcf","modified":"2026-04-29T14:23:06.140Z","references":[{"source_name":"RATANKBA","url":"https://www.trendmicro.com/en_us/research/17/b/ratankba-watering-holes-against-enterprises.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9ea25bfb-3e3a-42cb-8d2a-939169057806","subject":"ATTACK:enterprise:S0063","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9ea25bfb-3e3a-42cb-8d2a-939169057806","modified":"2026-04-29T14:23:06.141Z","references":[{"source_name":"Palo Alto CVE-2015-3113 July 2015","url":"http://researchcenter.paloaltonetworks.com/2015/07/ups-observations-on-cve-2015-3113-prior-zero-days-and-the-pirpi-payload/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a3742518-c231-4492-9673-95e095badddf","subject":"ATTACK:enterprise:S1146","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a3742518-c231-4492-9673-95e095badddf","modified":"2026-04-29T14:23:06.147Z","references":[{"source_name":"Symantec Daggerfly 2023","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a6080757-7935-439b-b70f-72ba841cda03","subject":"ATTACK:enterprise:G0050","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a6080757-7935-439b-b70f-72ba841cda03","modified":"2026-07-31T18:47:45.193Z","references":[{"source_name":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a6dc02a8-2ce3-45db-a7e5-e475d6acec3c","subject":"ATTACK:enterprise:G0091","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a6dc02a8-2ce3-45db-a7e5-e475d6acec3c","modified":"2026-07-31T18:48:21.366Z","references":[{"source_name":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a951bef0-4a5a-49b0-b6bd-6a4dfbd60ca0","subject":"ATTACK:enterprise:S0335","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a951bef0-4a5a-49b0-b6bd-6a4dfbd60ca0","modified":"2026-04-29T14:23:06.156Z","references":[{"source_name":"GovCERT Carbon May 2016","url":"https://web.archive.org/web/20170718174931/https://www.melani.admin.ch/dam/melani/de/dokumente/2016/technical%20report%20ruag.pdf.download.pdf/Report_Ruag-Espionage-Case.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ab0c8d2a-b2da-4566-96f5-1cbbc9a41300","subject":"ATTACK:enterprise:S0599","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ab0c8d2a-b2da-4566-96f5-1cbbc9a41300","modified":"2026-04-29T14:23:06.158Z","references":[{"source_name":"Aqua Kinsing April 2020","url":"https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--abcc0249-0226-440b-a32a-02512fd2db4f","subject":"ATTACK:enterprise:G1058","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--abcc0249-0226-440b-a32a-02512fd2db4f","modified":"2026-09-22T14:46:41.808Z","references":[{"source_name":"Intel471_TheGentlemen_Aug2026","url":"https://www.intel471.com/blog/threat-hunting-case-study-the-gentlemen"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ade72dc6-559e-4a84-9024-1a862faec6a0","subject":"ATTACK:enterprise:G0037","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ade72dc6-559e-4a84-9024-1a862faec6a0","modified":"2026-07-31T20:48:31.017Z","references":[{"source_name":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--afe9286d-076f-49af-90f3-11ebbe82ad40","subject":"ATTACK:enterprise:S0659","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--afe9286d-076f-49af-90f3-11ebbe82ad40","modified":"2026-04-29T14:23:06.165Z","references":[{"source_name":"Fortinet Diavol July 2021","url":"https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b0bba4a5-a3c3-4cf7-9347-c9070cb18998","subject":"ATTACK:enterprise:S0266","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b0bba4a5-a3c3-4cf7-9347-c9070cb18998","modified":"2026-04-29T14:23:06.166Z","references":[{"source_name":"Cyberreason Anchor December 2019","url":"https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b2c02ae1-c62a-4811-a913-b0a26f605e38","subject":"ATTACK:enterprise:G0119","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b2c02ae1-c62a-4811-a913-b0a26f605e38","modified":"2026-07-31T18:47:35.891Z","references":[{"source_name":"Symantec WastedLocker June 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b6609907-ec91-4339-a1ed-811bfe6ca48e","subject":"ATTACK:enterprise:S0646","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b6609907-ec91-4339-a1ed-811bfe6ca48e","modified":"2026-04-29T14:23:06.174Z","references":[{"source_name":"Secureworks GOLD KINGSWOOD September 2018","url":"https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b8a1739d-240b-46c1-a25a-b82d1c4e4765","subject":"ATTACK:enterprise:G0010","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b8a1739d-240b-46c1-a25a-b82d1c4e4765","modified":"2026-07-31T18:48:04.250Z","references":[{"source_name":"Kaspersky Turla","url":"https://securelist.com/the-epic-turla-operation/65545/"},{"source_name":"ESET ComRAT May 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bae9c6ec-2d33-418b-b7db-8b99af22e32f","subject":"ATTACK:enterprise:G1057","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bae9c6ec-2d33-418b-b7db-8b99af22e32f","modified":"2026-07-31T18:47:59.040Z","references":[{"source_name":"Google_SHOracle_Jun2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--be4040ce-c8cf-408d-b126-0954bbc1545b","subject":"ATTACK:enterprise:S0099","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--be4040ce-c8cf-408d-b126-0954bbc1545b","modified":"2026-04-29T14:23:06.185Z","references":[{"source_name":"TechNet Arp","url":"https://technet.microsoft.com/en-us/library/bb490864.aspx"},{"source_name":"Palo Alto ARP","url":"https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-analytics-alert-reference/uncommon-arp-cache-listing-via-arp-exe.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--be8fb0e9-a924-47be-9bb6-1eebe05881b7","subject":"ATTACK:enterprise:S0590","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--be8fb0e9-a924-47be-9bb6-1eebe05881b7","modified":"2026-04-29T14:23:06.186Z","references":[{"source_name":"Debian nbtscan Nov 2019","url":"https://manpages.debian.org/testing/nbtscan/nbtscan.1.en.html"},{"source_name":"SecTools nbtscan June 2003","url":"https://sectools.org/tool/nbtscan/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--beae1b73-f369-4443-8e59-eb9e99665e8d","subject":"ATTACK:enterprise:G0106","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--beae1b73-f369-4443-8e59-eb9e99665e8d","modified":"2026-07-31T18:47:52.587Z","references":[{"source_name":"Talos Rocke August 2018","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bfb1e467-dffc-463b-9f38-a3fafbb9d036","subject":"ATTACK:enterprise:G0077","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bfb1e467-dffc-463b-9f38-a3fafbb9d036","modified":"2026-07-31T18:47:49.254Z","references":[{"source_name":"Symantec Leafminer July 2018","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c1affed6-5eee-4574-a921-a6102416bc5f","subject":"ATTACK:enterprise:G1045","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c1affed6-5eee-4574-a921-a6102416bc5f","modified":"2026-09-22T21:54:25.255Z","references":[{"source_name":"CISA_AA25-239ASaltTyphoon_Sept2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c4a8a9ea-c24a-4ddf-9451-5855da9a4251","subject":"ATTACK:enterprise:S0365","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c4a8a9ea-c24a-4ddf-9451-5855da9a4251","modified":"2026-04-29T14:23:06.194Z","references":[{"source_name":"Talos Olympic Destroyer 2018","url":"https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ca948787-ea4b-4022-be96-8baf0ccff834","subject":"ATTACK:enterprise:G0059","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ca948787-ea4b-4022-be96-8baf0ccff834","modified":"2026-07-31T18:48:29.357Z","references":[{"source_name":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cb9f7bf4-a118-457c-95f8-512d84cf7be2","subject":"ATTACK:enterprise:S0359","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cb9f7bf4-a118-457c-95f8-512d84cf7be2","modified":"2026-04-29T14:23:06.203Z","references":[{"source_name":"Nltest Manual","url":"https://ss64.com/nt/nltest.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cc49c969-b227-437b-9b63-4a464766ff04","subject":"ATTACK:enterprise:G1015","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cc49c969-b227-437b-9b63-4a464766ff04","modified":"2026-07-31T20:48:34.461Z","references":[{"source_name":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d45cd2ee-f0f6-417a-98c2-9a7e9f6dc480","subject":"ATTACK:enterprise:G0114","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d45cd2ee-f0f6-417a-98c2-9a7e9f6dc480","modified":"2026-07-31T20:48:41.597Z","references":[{"source_name":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dae53ce2-d59e-47d2-b3ac-edd4be97a5ee","subject":"ATTACK:enterprise:C0025","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dae53ce2-d59e-47d2-b3ac-edd4be97a5ee","modified":"2026-07-31T21:05:26.405Z","references":[{"source_name":"Dragos Crashoverride 2018","url":"https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--de7f9b12-d6e7-4ef6-b55c-77bbca0f8c83","subject":"ATTACK:enterprise:G0125","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--de7f9b12-d6e7-4ef6-b55c-77bbca0f8c83","modified":"2026-07-31T18:47:44.884Z","references":[{"source_name":"Rapid7 HAFNIUM Mar 2021","url":"https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--de93ce86-0bf9-4959-ab2b-b55df654b9f8","subject":"ATTACK:enterprise:S1242","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--de93ce86-0bf9-4959-ab2b-b55df654b9f8","modified":"2026-04-29T14:23:06.229Z","references":[{"source_name":"Sophos Qilin MSP APR 2025","url":"https://news.sophos.com/en-us/2025/04/01/sophos-mdr-tracks-ongoing-campaign-by-qilin-affiliates-targeting-screenconnect/"},{"source_name":"Picus Qilin MAR 2025","url":"https://www.picussecurity.com/resource/blog/qilin-ransomware"},{"source_name":"Cisco Talos Qilin Ransomware OCT 2025","url":"https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--df13cae2-4e20-4e89-ae60-6bd8b99e2342","subject":"ATTACK:enterprise:G0102","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--df13cae2-4e20-4e89-ae60-6bd8b99e2342","modified":"2026-07-31T20:48:50.560Z","references":[{"source_name":"Red Canary Hospital Thwarted Ryuk October 2020","url":"https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/"},{"source_name":"FireEye Ryuk and Trickbot January 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html"},{"source_name":"CrowdStrike Grim Spider May 2019","url":"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"},{"source_name":"FireEye KEGTAP SINGLEMALT October 2020","url":"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"},{"source_name":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"},{"source_name":"DFIR Ryuk's Return October 2020","url":"https://thedfirreport.com/2020/10/08/ryuks-return/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dfe9acb4-48fe-4241-8b17-d76534f75b62","subject":"ATTACK:enterprise:S0552","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dfe9acb4-48fe-4241-8b17-d76534f75b62","modified":"2026-04-29T14:23:06.230Z","references":[{"source_name":"Red Canary Hospital Thwarted Ryuk October 2020","url":"https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/"},{"source_name":"Cybereason Bumblebee August 2022","url":"https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control"},{"source_name":"FireEye Ryuk and Trickbot January 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html"},{"source_name":"FireEye FIN6 Apr 2019","url":"https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e1f4c08f-b5b1-4d62-8f1c-75f4302b0bce","subject":"ATTACK:enterprise:S0140","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e1f4c08f-b5b1-4d62-8f1c-75f4302b0bce","modified":"2026-04-29T14:23:06.233Z","references":[{"source_name":"FireEye Shamoon Nov 2016","url":"https://web.archive.org/web/20210126065851/https://www.fireeye.com/blog/threat-research/2016/11/fireeye_respondsto.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e66503db-f92a-4795-a350-732a2f92b2cd","subject":"ATTACK:enterprise:S1159","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e66503db-f92a-4795-a350-732a2f92b2cd","modified":"2026-04-29T14:23:06.239Z","references":[{"source_name":"Google Cloud APT41 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e7714693-e792-44f0-a224-9899df75fced","subject":"ATTACK:enterprise:G0022","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e7714693-e792-44f0-a224-9899df75fced","modified":"2026-07-31T18:47:38.260Z","references":[{"source_name":"FireEye Clandestine Fox","url":"https://www.fireeye.com/blog/threat-research/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html"},{"source_name":"Symantec Buckeye","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e79f7f56-3a5e-4957-8070-360f630f3c2e","subject":"ATTACK:enterprise:C0015","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e79f7f56-3a5e-4957-8070-360f630f3c2e","modified":"2026-07-31T18:47:25.753Z","references":[{"source_name":"DFIR Conti Bazar Nov 2021","url":"https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ea71022e-7f2a-4065-9cb1-304f85dbaf6d","subject":"ATTACK:enterprise:G0093","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ea71022e-7f2a-4065-9cb1-304f85dbaf6d","modified":"2026-07-31T18:47:37.616Z","references":[{"source_name":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ebc6ef1b-fc26-4911-9637-3adb0e9b384f","subject":"ATTACK:enterprise:S9042","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ebc6ef1b-fc26-4911-9637-3adb0e9b384f","modified":"2026-07-27T19:45:32.848Z","references":[{"source_name":"Aikido CanisterWorm MAR 2026","url":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--edabd2c1-4640-4cad-b23f-c2ea4e64c7d5","subject":"ATTACK:enterprise:G1043","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--edabd2c1-4640-4cad-b23f-c2ea4e64c7d5","modified":"2026-07-31T18:47:36.682Z","references":[{"source_name":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source_name":"FBI BlackByte 2022","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ee46b157-d368-42e4-98f6-b76f6e65c9bd","subject":"ATTACK:enterprise:G0061","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ee46b157-d368-42e4-98f6-b76f6e65c9bd","modified":"2026-07-31T18:48:30.113Z","references":[{"source_name":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"},{"source_name":"Bitdefender FIN8 July 2021","url":"https://businessinsights.bitdefender.com/deep-dive-into-a-fin8-attack-a-forensic-investigation"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--efa28055-ee37-4501-8316-32a9c709ee98","subject":"ATTACK:enterprise:S0093","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--efa28055-ee37-4501-8316-32a9c709ee98","modified":"2026-04-29T14:23:06.251Z","references":[{"source_name":"Gigamon Berserk Bear October 2021","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f5362c13-271a-486c-8665-996367599fd8","subject":"ATTACK:enterprise:G0035","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f5362c13-271a-486c-8665-996367599fd8","modified":"2026-07-31T20:48:28.799Z","references":[{"source_name":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fb038a8a-d851-4f8e-bda5-fe2d5ab20181","subject":"ATTACK:enterprise:S1229","predicate":"uses","object":"ATTACK:enterprise:T1018","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fb038a8a-d851-4f8e-bda5-fe2d5ab20181","modified":"2026-04-29T14:23:06.266Z","references":[{"source_name":"Havoc Framework Documentation","url":"https://havocframework.com/docs/welcome"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}