Source assertions are not new attribution claims. No sole inventor or transitive actor-CVE inference.
{
  "record": {
    "id": "ATTACK:enterprise:T1027",
    "title": "Obfuscated Files or Information",
    "type": "Technique",
    "source_url": "https://attack.mitre.org/techniques/T1027",
    "snapshot": "enterprise-attack-20.0.json",
    "status": "active",
    "rights": "Source metadata only; source notices retained; no operational prose or payloads",
    "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
    "stix_id": "attack-pattern--b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
    "external_id": "T1027",
    "domain": "enterprise",
    "created": "2017-05-31T21:30:32.662Z",
    "modified": "2026-09-11T19:32:58.098Z",
    "version": "2.0",
    "aliases": [

    ],
    "tactics": [
      "stealth"
    ],
    "source_references": [
      {
        "source_name": "Volexity PowerDuke November 2016",
        "url": "https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/"
      },
      {
        "source_name": "FireEye Obfuscation June 2017",
        "url": "https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html"
      },
      {
        "source_name": "FireEye Revoke-Obfuscation July 2017",
        "url": "https://www.blackhat.com/docs/us-17/thursday/us-17-Bohannon-Revoke-Obfuscation-PowerShell-Obfuscation-Detection-And%20Evasion-Using-Science-wp.pdf"
      },
      {
        "source_name": "Linux/Cdorked.A We Live Security Analysis",
        "url": "https://www.welivesecurity.com/2013/04/26/linuxcdorked-new-apache-backdoor-in-the-wild-serves-blackhole/"
      },
      {
        "source_name": "Carbon Black Obfuscation Sept 2016",
        "url": "https://www.carbonblack.com/2016/09/23/security-advisory-variants-well-known-adware-families-discovered-include-sophisticated-obfuscation-techniques-previously-associated-nation-state-attacks/"
      },
      {
        "source_name": "PaloAlto EncodedCommand March 2017",
        "url": "https://researchcenter.paloaltonetworks.com/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/"
      }
    ]
  },
  "assertions": [
    {
      "id": "enterprise:relationship--015b902b-4370-4b55-884a-a6c8d2b15687",
      "subject": "ATTACK:enterprise:S9008",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--015b902b-4370-4b55-884a-a6c8d2b15687",
      "modified": "2026-04-29T14:23:05.904Z",
      "references": [
        {
          "source_name": "Aikido Shai-Hulud September 2025",
          "url": "https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-again"
        },
        {
          "source_name": "Netskope Shai-Hulud November 2025",
          "url": "https://www.netskope.com/blog/shai-hulud-2-0-aggressive-automated-one-of-fastest-spreading-npm-supply-chain-attacks-ever-observed"
        },
        {
          "source_name": "Wiz Shai-Hulud September 2025",
          "url": "https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack"
        },
        {
          "source_name": "Socket Shai-Hulud November 2025",
          "url": "https://socket.dev/blog/shai-hulud-strikes-again-v2"
        },
        {
          "source_name": "Socket Shai-Hulud Trufflehog September 2025",
          "url": "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--034b1ca2-8202-4eb9-9fbe-b519ed3dd5a8",
      "subject": "ATTACK:enterprise:G0135",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--034b1ca2-8202-4eb9-9fbe-b519ed3dd5a8",
      "modified": "2026-07-31T18:48:11.112Z",
      "references": [
        {
          "source_name": "ESET BackdoorDiplomacy Jun 2021",
          "url": "https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--051683e6-0a6a-4a40-bf5d-d2c5f25586e8",
      "subject": "ATTACK:enterprise:S0633",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--051683e6-0a6a-4a40-bf5d-d2c5f25586e8",
      "modified": "2026-04-29T14:23:05.910Z",
      "references": [
        {
          "source_name": "Microsoft Sliver 2022",
          "url": "https://www.microsoft.com/en-us/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--06f16826-1100-4958-86e3-784a22998060",
      "subject": "ATTACK:enterprise:S0446",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--06f16826-1100-4958-86e3-784a22998060",
      "modified": "2026-04-29T14:23:05.913Z",
      "references": [
        {
          "source_name": "CrowdStrike Wizard Spider October 2020",
          "url": "https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--06fbdb2f-97d5-4140-9300-0a1f6ab72cb2",
      "subject": "ATTACK:enterprise:G1039",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--06fbdb2f-97d5-4140-9300-0a1f6ab72cb2",
      "modified": "2026-07-31T18:48:05.888Z",
      "references": [
        {
          "source_name": "therecord_redcurl",
          "url": "https://therecord.media/redcurl-hackers-russian-bank-australian-company"
        },
        {
          "source_name": "group-ib_redcurl1",
          "url": "https://www.group-ib.com/resources/research-hub/red-curl/"
        },
        {
          "source_name": "group-ib_redcurl2",
          "url": "https://www.group-ib.com/resources/research-hub/red-curl-2/"
        },
        {
          "source_name": "trendmicro_redcurl",
          "url": "https://www.trendmicro.com/en_us/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0a7810c5-850a-41e9-9d44-cbbdeebd8044",
      "subject": "ATTACK:enterprise:T1027.005",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0a7810c5-850a-41e9-9d44-cbbdeebd8044",
      "modified": "2026-09-02T18:17:25.130Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0b58e2e5-9be5-4132-a65f-19db8acd7033",
      "subject": "ATTACK:enterprise:S1066",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0b58e2e5-9be5-4132-a65f-19db8acd7033",
      "modified": "2026-04-29T14:23:05.919Z",
      "references": [
        {
          "source_name": "Secureworks DarkTortilla Aug 2022",
          "url": "https://www.secureworks.com/research/darktortilla-malware-analysis"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0dd73de5-d615-4455-a552-ff382ec75e82",
      "subject": "ATTACK:enterprise:S0447",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0dd73de5-d615-4455-a552-ff382ec75e82",
      "modified": "2026-04-29T14:23:05.922Z",
      "references": [
        {
          "source_name": "Infoblox Lokibot January 2019",
          "url": "https://insights.infoblox.com/threat-intelligence-reports/threat-intelligence--22"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0ec0af54-0182-4ad4-9b0e-4542a822de7f",
      "subject": "ATTACK:enterprise:T1027.009",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0ec0af54-0182-4ad4-9b0e-4542a822de7f",
      "modified": "2026-04-29T14:23:05.924Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0fee6145-185d-417f-a431-201a5b3e3259",
      "subject": "ATTACK:enterprise:T1027.013",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0fee6145-185d-417f-a431-201a5b3e3259",
      "modified": "2026-04-29T14:23:05.925Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1098fd1c-b615-4730-bc99-3cda386f2e4c",
      "subject": "ATTACK:enterprise:S1064",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1098fd1c-b615-4730-bc99-3cda386f2e4c",
      "modified": "2026-04-29T14:23:05.926Z",
      "references": [
        {
          "source_name": "HP SVCReady Jun 2022",
          "url": "https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--11ea144c-253e-4f68-bb2c-1f942cba6b54",
      "subject": "ATTACK:enterprise:S0393",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--11ea144c-253e-4f68-bb2c-1f942cba6b54",
      "modified": "2026-04-29T14:23:05.928Z",
      "references": [
        {
          "source_name": "ESET Turla PowerShell May 2019",
          "url": "https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--130768d0-0f98-4a1b-b4bb-34c5e372cda1",
      "subject": "ATTACK:enterprise:S9015",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--130768d0-0f98-4a1b-b4bb-34c5e372cda1",
      "modified": "2026-04-29T14:23:05.930Z",
      "references": [
        {
          "source_name": "Picus Security BRICKSTORM UNC5221 October 2025",
          "url": "https://www.picussecurity.com/resource/blog/brickstorm-malware-unc5221-targets-tech-and-legal-sectors-in-the-united-states"
        },
        {
          "source_name": "Google BRICKSTORM September 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--142ef662-460f-4082-8f76-f08dd312bc30",
      "subject": "ATTACK:enterprise:S0242",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--142ef662-460f-4082-8f76-f08dd312bc30",
      "modified": "2026-04-29T14:23:05.931Z",
      "references": [
        {
          "source_name": "SecureList SynAck Doppelgänging May 2018",
          "url": "https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/"
        },
        {
          "source_name": "Kaspersky Lab SynAck May 2018",
          "url": "https://usa.kaspersky.com/about/press-releases/2018_synack-doppelganging"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1793516c-a4dd-4726-9bb3-c3b2bbecc605",
      "subject": "ATTACK:enterprise:S1025",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1793516c-a4dd-4726-9bb3-c3b2bbecc605",
      "modified": "2026-04-29T14:23:05.936Z",
      "references": [
        {
          "source_name": "BlackBerry Amadey 2020",
          "url": "https://blogs.blackberry.com/en/2020/01/threat-spotlight-amadey-bot"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--194d773b-a9b6-43fc-8113-8e120be95c5c",
      "subject": "ATTACK:enterprise:S0518",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--194d773b-a9b6-43fc-8113-8e120be95c5c",
      "modified": "2026-04-29T14:23:05.939Z",
      "references": [
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1970d1b3-ed23-44b5-a83f-d6a952714144",
      "subject": "ATTACK:enterprise:C0057",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1970d1b3-ed23-44b5-a83f-d6a952714144",
      "modified": "2026-07-31T18:47:22.255Z",
      "references": [
        {
          "source_name": "Volexity 3CX Supply Chain Compromise AppleJeus IconicStealer March 2023",
          "url": "https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/"
        },
        {
          "source_name": "Mandiant 3cx UNC4736 2023",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1a1fd6b3-bc40-4646-958a-34c35d1b0451",
      "subject": "ATTACK:enterprise:S1149",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1a1fd6b3-bc40-4646-958a-34c35d1b0451",
      "modified": "2026-04-29T14:23:05.940Z",
      "references": [
        {
          "source_name": "Mandiant ROADSWEEP August 2022",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1bf7899f-98c1-4600-a15a-4e77880c21ee",
      "subject": "ATTACK:enterprise:S9033",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1bf7899f-98c1-4600-a15a-4e77880c21ee",
      "modified": "2026-04-29T14:23:05.943Z",
      "references": [
        {
          "source_name": "ESET_MuddyWater_Dec2025",
          "url": "https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1f8be617-c842-4828-a352-9d5eafb8f477",
      "subject": "ATTACK:enterprise:S0197",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1f8be617-c842-4828-a352-9d5eafb8f477",
      "modified": "2026-04-29T14:23:05.947Z",
      "references": [
        {
          "source_name": "FireEye Fin8 May 2016",
          "url": "https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1ffbf752-ed3a-47bb-8351-92ed7118dc5d",
      "subject": "ATTACK:enterprise:S0593",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1ffbf752-ed3a-47bb-8351-92ed7118dc5d",
      "modified": "2026-04-29T14:23:05.948Z",
      "references": [
        {
          "source_name": "CISA EB Aug 2020",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-239a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--20196489-8426-4cb7-a8f0-ca51bef7a385",
      "subject": "ATTACK:enterprise:S0502",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--20196489-8426-4cb7-a8f0-ca51bef7a385",
      "modified": "2026-04-29T14:23:05.948Z",
      "references": [
        {
          "source_name": "NSA/FBI Drovorub August 2020",
          "url": "https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--25b8b66a-a9d0-4400-8b41-dd12208a25de",
      "subject": "ATTACK:enterprise:S0476",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--25b8b66a-a9d0-4400-8b41-dd12208a25de",
      "modified": "2026-04-29T14:23:05.956Z",
      "references": [
        {
          "source_name": "Unit 42 Valak July 2020",
          "url": "https://unit42.paloaltonetworks.com/valak-evolution/"
        },
        {
          "source_name": "SentinelOne Valak June 2020",
          "url": "https://assets.sentinelone.com/labs/sentinel-one-valak-i"
        },
        {
          "source_name": "Cybereason Valak May 2020",
          "url": "https://www.cybereason.com/blog/valak-more-than-meets-the-eye"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--26402760-e6cb-47b7-aabc-8271549e5f22",
      "subject": "ATTACK:enterprise:S1183",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--26402760-e6cb-47b7-aabc-8271549e5f22",
      "modified": "2026-04-29T14:23:05.957Z",
      "references": [
        {
          "source_name": "DCSO StrelaStealer 2022",
          "url": "https://medium.com/@DCSO_CyTec/shortandmalicious-strelastealer-aims-for-mail-credentials-a4c3e78c8abc"
        },
        {
          "source_name": "IBM StrelaStealer 2024",
          "url": "https://securityintelligence.com/x-force/strela-stealer-todays-invoice-tomorrows-phish/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--277971c7-d42e-497f-8df4-be5b4bc094f8",
      "subject": "ATTACK:enterprise:G0106",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--277971c7-d42e-497f-8df4-be5b4bc094f8",
      "modified": "2026-07-31T18:47:52.118Z",
      "references": [
        {
          "source_name": "Anomali Rocke March 2019",
          "url": "https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--27f8b192-9e86-49dc-abca-5bda3f8f7e89",
      "subject": "ATTACK:enterprise:S0012",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--27f8b192-9e86-49dc-abca-5bda3f8f7e89",
      "modified": "2026-04-29T14:23:05.959Z",
      "references": [
        {
          "source_name": "Symantec Darkmoon Aug 2005",
          "url": "https://www.symantec.com/security_response/writeup.jsp?docid=2005-081910-3934-99"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--28c56887-5dbb-4269-b783-8a7f8d4c9204",
      "subject": "ATTACK:enterprise:S0594",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--28c56887-5dbb-4269-b783-8a7f8d4c9204",
      "modified": "2026-04-29T14:23:05.960Z",
      "references": [
        {
          "source_name": "Trend Micro Muddy Water March 2021",
          "url": "https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--291b7fbf-5b5f-460a-8009-cadb383b3262",
      "subject": "ATTACK:enterprise:S0070",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--291b7fbf-5b5f-460a-8009-cadb383b3262",
      "modified": "2026-04-29T14:23:05.961Z",
      "references": [
        {
          "source_name": "Dell TG-3390",
          "url": "https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2b00f3f4-ddde-4874-8315-5a5c5d671a33",
      "subject": "ATTACK:enterprise:S0094",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2b00f3f4-ddde-4874-8315-5a5c5d671a33",
      "modified": "2026-04-29T14:23:05.963Z",
      "references": [
        {
          "source_name": "Secureworks Karagany July 2019",
          "url": "https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2bff8dad-2ef1-485c-8c0b-62a5ba4c384b",
      "subject": "ATTACK:enterprise:G0093",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2bff8dad-2ef1-485c-8c0b-62a5ba4c384b",
      "modified": "2026-07-31T18:47:37.052Z",
      "references": [
        {
          "source_name": "Cybereason Soft Cell June 2019",
          "url": "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2cea4c8c-4b22-4656-8e4e-fc52555f7b22",
      "subject": "ATTACK:enterprise:T1027.012",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2cea4c8c-4b22-4656-8e4e-fc52555f7b22",
      "modified": "2026-04-29T14:23:05.965Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2d3d9c31-1bd9-400e-a8b5-af9e4b53ebdb",
      "subject": "ATTACK:enterprise:T1027.017",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2d3d9c31-1bd9-400e-a8b5-af9e4b53ebdb",
      "modified": "2026-04-29T14:23:05.966Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2e165a8a-928e-488e-ad16-afb77a94b460",
      "subject": "ATTACK:enterprise:G0084",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2e165a8a-928e-488e-ad16-afb77a94b460",
      "modified": "2026-07-31T18:47:47.673Z",
      "references": [
        {
          "source_name": "Symantec Gallmaker Oct 2018",
          "url": "https://www.symantec.com/blogs/threat-intelligence/gallmaker-attack-group"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2e8b176a-b8a8-4bd0-8542-97ff009c673c",
      "subject": "ATTACK:enterprise:S1018",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2e8b176a-b8a8-4bd0-8542-97ff009c673c",
      "modified": "2026-04-29T14:23:05.967Z",
      "references": [
        {
          "source_name": "Palo Alto Unit 42 OutSteel SaintBot February 2022 ",
          "url": "https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2f884873-308c-4bee-94bd-90bb2267fea7",
      "subject": "ATTACK:enterprise:S0336",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2f884873-308c-4bee-94bd-90bb2267fea7",
      "modified": "2026-04-29T14:23:05.971Z",
      "references": [
        {
          "source_name": "PaloAlto NanoCore Feb 2016",
          "url": "https://researchcenter.paloaltonetworks.com/2016/02/nanocorerat-behind-an-increase-in-tax-themed-phishing-e-mails/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--315aab88-9b01-4a70-8f8c-173a3f29e79c",
      "subject": "ATTACK:enterprise:S0063",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--315aab88-9b01-4a70-8f8c-173a3f29e79c",
      "modified": "2026-04-29T14:23:05.980Z",
      "references": [
        {
          "source_name": "FireEye Clandestine Wolf",
          "url": "https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-wolf-adobe-flash-zero-day.html"
        },
        {
          "source_name": "Palo Alto CVE-2015-3113 July 2015",
          "url": "http://researchcenter.paloaltonetworks.com/2015/07/ups-observations-on-cve-2015-3113-prior-zero-days-and-the-pirpi-payload/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--32035519-2c91-4fc2-a9c4-64c766510374",
      "subject": "ATTACK:enterprise:S0627",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--32035519-2c91-4fc2-a9c4-64c766510374",
      "modified": "2026-04-29T14:23:05.983Z",
      "references": [
        {
          "source_name": "Securelist APT10 March 2021",
          "url": "https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--342502b6-c8fc-4ed5-ba10-209a824b78ed",
      "subject": "ATTACK:enterprise:S0369",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--342502b6-c8fc-4ed5-ba10-209a824b78ed",
      "modified": "2026-04-29T14:23:05.989Z",
      "references": [
        {
          "source_name": "CoinTicker 2019",
          "url": "https://blog.malwarebytes.com/threat-analysis/2018/10/mac-cryptocurrency-ticker-app-installs-backdoors/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--37fc58a8-d37f-45cc-a1d7-8d4d8afa13bc",
      "subject": "ATTACK:enterprise:T1027.018",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--37fc58a8-d37f-45cc-a1d7-8d4d8afa13bc",
      "modified": "2026-04-29T14:23:05.996Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--388ebc0a-6839-4b03-959c-766c1893cf64",
      "subject": "ATTACK:enterprise:S0647",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--388ebc0a-6839-4b03-959c-766c1893cf64",
      "modified": "2026-04-29T14:23:05.997Z",
      "references": [
        {
          "source_name": "ESET BackdoorDiplomacy Jun 2021",
          "url": "https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3979ca39-09a1-4a2b-a7d3-2eca5f1fb166",
      "subject": "ATTACK:enterprise:S1086",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3979ca39-09a1-4a2b-a7d3-2eca5f1fb166",
      "modified": "2026-04-29T14:23:05.999Z",
      "references": [
        {
          "source_name": "Morphisec Snip3 May 2021",
          "url": "https://blog.morphisec.com/revealing-the-snip3-crypter-a-highly-evasive-rat-loader"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3a86072e-4ca6-4b5d-bf31-b17c250f572e",
      "subject": "ATTACK:enterprise:S0126",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3a86072e-4ca6-4b5d-bf31-b17c250f572e",
      "modified": "2026-04-29T14:23:06.001Z",
      "references": [
        {
          "source_name": "CISA ComRAT Oct 2020",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303a"
        },
        {
          "source_name": "ESET ComRAT May 2020",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3c92a16b-9f72-4f79-a656-e79c6c04e48f",
      "subject": "ATTACK:enterprise:S0355",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3c92a16b-9f72-4f79-a656-e79c6c04e48f",
      "modified": "2026-04-29T14:23:06.007Z",
      "references": [
        {
          "source_name": "Unit 42 Nokki Oct 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/10/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--40772ec1-2f25-425f-aad5-635f64ba8fd2",
      "subject": "ATTACK:enterprise:S0062",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--40772ec1-2f25-425f-aad5-635f64ba8fd2",
      "modified": "2026-04-29T14:23:06.013Z",
      "references": [
        {
          "source_name": "DustySky",
          "url": "https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--41118997-c45e-4123-be61-1b0c5d456256",
      "subject": "ATTACK:enterprise:S0562",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--41118997-c45e-4123-be61-1b0c5d456256",
      "modified": "2026-04-29T14:23:06.014Z",
      "references": [
        {
          "source_name": "CrowdStrike SUNSPOT Implant January 2021",
          "url": "https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--426db174-3cc4-4f9c-ae34-6398a86ec3bd",
      "subject": "ATTACK:enterprise:S0517",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--426db174-3cc4-4f9c-ae34-6398a86ec3bd",
      "modified": "2026-04-29T14:23:06.016Z",
      "references": [
        {
          "source_name": "Trustwave Pillowmint June 2020",
          "url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4347eb2b-b33d-4e17-94f2-3701e18f0cab",
      "subject": "ATTACK:enterprise:T1027.006",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4347eb2b-b33d-4e17-94f2-3701e18f0cab",
      "modified": "2026-04-29T14:23:06.017Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--451a9d37-4e16-4822-85db-821b1dd49ddc",
      "subject": "ATTACK:enterprise:S0681",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--451a9d37-4e16-4822-85db-821b1dd49ddc",
      "modified": "2026-04-29T14:23:06.020Z",
      "references": [
        {
          "source_name": "SekoiaBourhis_DiceLoader_Feb2024",
          "url": "https://blog.sekoia.io/unveiling-the-intricacies-of-diceloader/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4527c528-8377-4349-ae5c-95c04cabd3d4",
      "subject": "ATTACK:enterprise:S0132",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4527c528-8377-4349-ae5c-95c04cabd3d4",
      "modified": "2026-04-29T14:23:06.020Z",
      "references": [
        {
          "source_name": "Cisco H1N1 Part 1",
          "url": "http://blogs.cisco.com/security/h1n1-technical-analysis-reveals-new-capabilities"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--464e688d-b243-4619-a60b-1be6e2d6a827",
      "subject": "ATTACK:enterprise:S0265",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--464e688d-b243-4619-a60b-1be6e2d6a827",
      "modified": "2026-04-29T14:23:06.021Z",
      "references": [
        {
          "source_name": "Unit 42 Kazuar May 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4a339bd7-d356-44fb-9677-8f082af2fc11",
      "subject": "ATTACK:enterprise:S0198",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4a339bd7-d356-44fb-9677-8f082af2fc11",
      "modified": "2026-04-29T14:23:06.026Z",
      "references": [
        {
          "source_name": "FireEye NETWIRE March 2019",
          "url": "https://www.mandiant.com/resources/blog/dissecting-netwire-phishing-campaigns-usage-process-hollowing"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4a79cc78-872f-49f0-80c5-20f1b2dcd9f2",
      "subject": "ATTACK:enterprise:S0615",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4a79cc78-872f-49f0-80c5-20f1b2dcd9f2",
      "modified": "2026-04-29T14:23:06.027Z",
      "references": [
        {
          "source_name": "BlackBerry CostaRicto November 2020",
          "url": "https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"
        },
        {
          "source_name": "FireEye FiveHands April 2021",
          "url": "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
        },
        {
          "source_name": "CISA AR21-126A FIVEHANDS May 2021",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4ad9aa86-f489-4f0f-926f-f381221c3705",
      "subject": "ATTACK:enterprise:G0063",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4ad9aa86-f489-4f0f-926f-f381221c3705",
      "modified": "2026-07-31T18:48:22.805Z",
      "references": [
        {
          "source_name": "Securelist BlackOasis Oct 2017",
          "url": "https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4d7e8d98-9894-4dfa-9013-af8d83e6faea",
      "subject": "ATTACK:enterprise:S0331",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4d7e8d98-9894-4dfa-9013-af8d83e6faea",
      "modified": "2026-04-29T14:23:06.031Z",
      "references": [
        {
          "source_name": "Fortinet Agent Tesla April 2018",
          "url": "https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html"
        },
        {
          "source_name": "Malwarebytes Agent Tesla April 2020",
          "url": "https://blog.malwarebytes.com/threat-analysis/2020/04/new-agenttesla-variant-steals-wifi-credentials/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4ff492bf-f91d-445d-a29e-6e60c67a05c1",
      "subject": "ATTACK:enterprise:S0266",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4ff492bf-f91d-445d-a29e-6e60c67a05c1",
      "modified": "2026-04-29T14:23:06.034Z",
      "references": [
        {
          "source_name": "S2 Grupo TrickBot June 2017",
          "url": "https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--549fdc30-5269-48ee-9dc8-60db8deb836a",
      "subject": "ATTACK:enterprise:S0259",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--549fdc30-5269-48ee-9dc8-60db8deb836a",
      "modified": "2026-04-29T14:23:06.041Z",
      "references": [
        {
          "source_name": "ASERT InnaputRAT April 2018",
          "url": "https://asert.arbornetworks.com/innaput-actors-utilize-remote-access-trojan-since-2016-presumably-targeting-victim-files/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--569815f7-4a3f-47f3-8903-0b0b2d409c3c",
      "subject": "ATTACK:enterprise:S0051",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--569815f7-4a3f-47f3-8903-0b0b2d409c3c",
      "modified": "2026-04-29T14:23:06.043Z",
      "references": [
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--56c927c5-f64e-4b31-9a14-7ce78fd1c8a1",
      "subject": "ATTACK:enterprise:G0022",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--56c927c5-f64e-4b31-9a14-7ce78fd1c8a1",
      "modified": "2026-07-31T18:47:37.857Z",
      "references": [
        {
          "source_name": "Symantec Buckeye",
          "url": "https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--570df7f7-f2d5-4de9-ba74-4adfa99e980f",
      "subject": "ATTACK:enterprise:S0560",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--570df7f7-f2d5-4de9-ba74-4adfa99e980f",
      "modified": "2026-04-29T14:23:06.044Z",
      "references": [
        {
          "source_name": "FireEye SUNBURST Backdoor December 2020",
          "url": "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
        },
        {
          "source_name": "Check Point Sunburst Teardrop December 2020",
          "url": "https://research.checkpoint.com/2020/sunburst-teardrop-and-the-netsec-new-normal/"
        },
        {
          "source_name": "Microsoft Deep Dive Solorigate January 2021",
          "url": "https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--573916d8-804d-4453-be37-e6b1865e87db",
      "subject": "ATTACK:enterprise:S0167",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--573916d8-804d-4453-be37-e6b1865e87db",
      "modified": "2026-04-29T14:23:06.044Z",
      "references": [
        {
          "source_name": "CopyKittens Nov 2015",
          "url": "https://cdn2.hubspot.net/hubfs/1903456/Whitepapers/CopyKittens.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--57c72f80-38bf-48b4-9f5d-eefef4025e34",
      "subject": "ATTACK:enterprise:S0660",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--57c72f80-38bf-48b4-9f5d-eefef4025e34",
      "modified": "2026-04-29T14:23:06.045Z",
      "references": [
        {
          "source_name": "Trend Micro DRBControl February 2020",
          "url": "https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--58d4910f-9d51-4961-84eb-9ef0ee2e8bc3",
      "subject": "ATTACK:enterprise:S1063",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--58d4910f-9d51-4961-84eb-9ef0ee2e8bc3",
      "modified": "2026-04-29T14:23:06.046Z",
      "references": [
        {
          "source_name": "MDSec Brute Ratel August 2022",
          "url": "https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/"
        },
        {
          "source_name": "Palo Alto Brute Ratel July 2022",
          "url": "https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--59b7cc7f-469c-4dba-8ee0-4d458777abe7",
      "subject": "ATTACK:enterprise:T1027.011",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--59b7cc7f-469c-4dba-8ee0-4d458777abe7",
      "modified": "2026-04-29T14:23:06.047Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--59df5f14-e570-417e-8184-e8e7c6c1ea75",
      "subject": "ATTACK:enterprise:S0140",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--59df5f14-e570-417e-8184-e8e7c6c1ea75",
      "modified": "2026-04-29T14:23:06.048Z",
      "references": [
        {
          "source_name": "Palo Alto Shamoon Nov 2016",
          "url": "http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5d2d9aea-5ae2-45bd-9276-7af65e50c28f",
      "subject": "ATTACK:enterprise:T1027.014",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5d2d9aea-5ae2-45bd-9276-7af65e50c28f",
      "modified": "2026-04-29T14:23:06.052Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5ef1c7d8-70bc-4634-b705-644f4d1db3b0",
      "subject": "ATTACK:enterprise:S0203",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5ef1c7d8-70bc-4634-b705-644f4d1db3b0",
      "modified": "2026-04-29T14:23:06.054Z",
      "references": [
        {
          "source_name": "Symantec Elderwood Sept 2012",
          "url": "https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf"
        },
        {
          "source_name": "Symantec Trojan.Hydraq Jan 2010",
          "url": "https://www.symantec.com/connect/blogs/trojanhydraq-incident"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--604fa5ae-0a32-45d7-9b9b-595fb43688b6",
      "subject": "ATTACK:enterprise:S0650",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--604fa5ae-0a32-45d7-9b9b-595fb43688b6",
      "modified": "2026-04-29T14:23:06.056Z",
      "references": [
        {
          "source_name": "Cyberint Qakbot May 2021",
          "url": "https://blog.cyberint.com/qakbot-banking-trojan"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--624b57dc-3cae-45c7-8473-c5116df57697",
      "subject": "ATTACK:enterprise:S1111",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--624b57dc-3cae-45c7-8473-c5116df57697",
      "modified": "2026-04-29T14:23:06.059Z",
      "references": [
        {
          "source_name": "Trellix Darkgate 2023",
          "url": "https://www.trellix.com/blogs/research/the-continued-evolution-of-the-darkgate-malware-as-a-service/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6610cf22-0a8c-4c30-bc6f-817b8cf29e61",
      "subject": "ATTACK:enterprise:S0696",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6610cf22-0a8c-4c30-bc6f-817b8cf29e61",
      "modified": "2026-04-29T14:23:06.064Z",
      "references": [
        {
          "source_name": "NTT Security Flagpro new December 2021",
          "url": "https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--662e03e7-a7bb-4c5b-ada4-e00275885fbb",
      "subject": "ATTACK:enterprise:C0017",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--662e03e7-a7bb-4c5b-ada4-e00275885fbb",
      "modified": "2026-07-31T21:12:31.353Z",
      "references": [
        {
          "source_name": "Mandiant APT41",
          "url": "https://www.mandiant.com/resources/apt41-us-state-governments"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--662f14ec-90c6-48f7-98c6-ba028ca38621",
      "subject": "ATTACK:enterprise:S0625",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--662f14ec-90c6-48f7-98c6-ba028ca38621",
      "modified": "2026-04-29T14:23:06.064Z",
      "references": [
        {
          "source_name": "McAfee Cuba April 2021",
          "url": "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6b8d8354-0fa9-4a45-8df9-57709beace42",
      "subject": "ATTACK:enterprise:S0384",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6b8d8354-0fa9-4a45-8df9-57709beace42",
      "modified": "2026-04-29T14:23:06.071Z",
      "references": [
        {
          "source_name": "Checkpoint Dridex Jan 2021",
          "url": "https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6c75071d-6997-4d41-88fa-bcd8d7b4cb76",
      "subject": "ATTACK:enterprise:S0624",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6c75071d-6997-4d41-88fa-bcd8d7b4cb76",
      "modified": "2026-04-29T14:23:06.073Z",
      "references": [
        {
          "source_name": "Securelist APT10 March 2021",
          "url": "https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6d5d5bcd-eb2e-47ae-9e8a-0d539b994144",
      "subject": "ATTACK:enterprise:S9007",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6d5d5bcd-eb2e-47ae-9e8a-0d539b994144",
      "modified": "2026-04-29T14:23:06.074Z",
      "references": [
        {
          "source_name": "Gen Digital Kimsuky HTTPTroy October 2025",
          "url": "https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6f5973be-3c51-4bd1-b652-f12903caa3e2",
      "subject": "ATTACK:enterprise:S0353",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6f5973be-3c51-4bd1-b652-f12903caa3e2",
      "modified": "2026-04-29T14:23:06.077Z",
      "references": [
        {
          "source_name": "Unit 42 NOKKI Sept 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--70edcba2-e777-4ced-a52d-5dfc3965211c",
      "subject": "ATTACK:enterprise:S0150",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--70edcba2-e777-4ced-a52d-5dfc3965211c",
      "modified": "2026-04-29T14:23:06.079Z",
      "references": [
        {
          "source_name": "FireEye POSHSPY April 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7139ac4a-7ece-47da-a5e5-0da99847d6fa",
      "subject": "ATTACK:enterprise:T1027.010",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7139ac4a-7ece-47da-a5e5-0da99847d6fa",
      "modified": "2026-04-29T14:23:06.080Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--713fdffc-8955-43d6-b1bd-4515d3ca06a6",
      "subject": "ATTACK:enterprise:S0559",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--713fdffc-8955-43d6-b1bd-4515d3ca06a6",
      "modified": "2026-04-29T14:23:06.080Z",
      "references": [
        {
          "source_name": "FireEye SUNBURST Backdoor December 2020",
          "url": "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--71a121ba-b01c-418c-af8d-63df2cec70de",
      "subject": "ATTACK:enterprise:S0332",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--71a121ba-b01c-418c-af8d-63df2cec70de",
      "modified": "2026-04-29T14:23:06.080Z",
      "references": [
        {
          "source_name": "Talos Remcos Aug 2018",
          "url": "https://blog.talosintelligence.com/2018/08/picking-apart-remcos.html"
        },
        {
          "source_name": "Check Point Blind Eagle MAR 2025",
          "url": "https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7b17bab3-6c5a-4db2-969b-7724f71afc09",
      "subject": "ATTACK:enterprise:S0512",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7b17bab3-6c5a-4db2-969b-7724f71afc09",
      "modified": "2026-04-29T14:23:06.094Z",
      "references": [
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7b39173a-092f-4e79-ad19-3af1c780c06c",
      "subject": "ATTACK:enterprise:T1027.004",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7b39173a-092f-4e79-ad19-3af1c780c06c",
      "modified": "2026-04-29T14:23:06.094Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7b4b8d0b-fbc3-469a-ab62-72c5c4c4653d",
      "subject": "ATTACK:enterprise:G0099",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7b4b8d0b-fbc3-469a-ab62-72c5c4c4653d",
      "modified": "2026-07-31T18:48:18.573Z",
      "references": [
        {
          "source_name": "Kaspersky BlindEagle AUG 2024",
          "url": "https://securelist.com/blindeagle-apt/113414/"
        },
        {
          "source_name": "QiAnXin APT-C-36 Feb2019",
          "url": "https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7c30237d-5d03-4f5f-9488-3629f2b1813c",
      "subject": "ATTACK:enterprise:T1027.007",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7c30237d-5d03-4f5f-9488-3629f2b1813c",
      "modified": "2026-04-29T14:23:06.095Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7c3f8d37-e2da-45c3-8ef2-a067cd46d340",
      "subject": "ATTACK:enterprise:S0030",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7c3f8d37-e2da-45c3-8ef2-a067cd46d340",
      "modified": "2026-04-29T14:23:06.095Z",
      "references": [
        {
          "source_name": "FireEye CARBANAK June 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7d8a48be-2429-401f-b963-ec0f5927a282",
      "subject": "ATTACK:enterprise:S1028",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7d8a48be-2429-401f-b963-ec0f5927a282",
      "modified": "2026-04-29T14:23:06.097Z",
      "references": [
        {
          "source_name": "MalwareBytes SideCopy Dec 2021",
          "url": "https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7dfc877a-4563-4c7f-91e0-b5f5adfcb873",
      "subject": "ATTACK:enterprise:S1035",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7dfc877a-4563-4c7f-91e0-b5f5adfcb873",
      "modified": "2026-04-29T14:23:06.098Z",
      "references": [
        {
          "source_name": "NCSC GCHQ Small Sieve Jan 2022",
          "url": "https://www.ncsc.gov.uk/files/NCSC-Malware-Analysis-Report-Small-Sieve.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7fa59950-8a54-430f-b10a-4eb12566ece7",
      "subject": "ATTACK:enterprise:C0025",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7fa59950-8a54-430f-b10a-4eb12566ece7",
      "modified": "2026-07-31T21:05:25.921Z",
      "references": [
        {
          "source_name": "ESET Industroyer",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--885c54e7-6b1c-4399-a051-1e0b047d6f92",
      "subject": "ATTACK:enterprise:S0482",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--885c54e7-6b1c-4399-a051-1e0b047d6f92",
      "modified": "2026-04-29T14:23:06.111Z",
      "references": [
        {
          "source_name": "MacKeeper Bundlore Apr 2019",
          "url": "https://mackeeper.com/blog/post/610-macos-bundlore-adware-analysis/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--89567fdb-433a-4821-85bb-a4a9f55cfef5",
      "subject": "ATTACK:enterprise:S0607",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--89567fdb-433a-4821-85bb-a4a9f55cfef5",
      "modified": "2026-04-29T14:23:06.113Z",
      "references": [
        {
          "source_name": "Trend Micro KillDisk 1",
          "url": "https://www.trendmicro.com/en_us/research/18/f/new-killdisk-variant-hits-latin-american-financial-organizations-again.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8a41eff0-83f3-414a-af49-54f0f8c1b84a",
      "subject": "ATTACK:enterprise:S0240",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8a41eff0-83f3-414a-af49-54f0f8c1b84a",
      "modified": "2026-04-29T14:23:06.114Z",
      "references": [
        {
          "source_name": "Volexity InkySquid RokRAT August 2021",
          "url": "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
        },
        {
          "source_name": "Malwarebytes RokRAT VBA January 2021",
          "url": "https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8a636bff-c509-4d29-a28c-1be14ed2d92c",
      "subject": "ATTACK:enterprise:S9062",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8a636bff-c509-4d29-a28c-1be14ed2d92c",
      "modified": "2026-10-01T13:52:52.985Z",
      "references": [
        {
          "source_name": "CheckPoint_NimbusManticoreEurope_Sept2025",
          "url": "https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8c73e0be-f105-4f22-93b4-cb765fb8f419",
      "subject": "ATTACK:enterprise:S0598",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8c73e0be-f105-4f22-93b4-cb765fb8f419",
      "modified": "2026-04-29T14:23:06.117Z",
      "references": [
        {
          "source_name": "ANSSI Sandworm January 2021",
          "url": "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8c9ecd8e-44d6-4e03-84c6-ff6f44b3bc33",
      "subject": "ATTACK:enterprise:S1228",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8c9ecd8e-44d6-4e03-84c6-ff6f44b3bc33",
      "modified": "2026-04-29T14:23:06.117Z",
      "references": [
        {
          "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
          "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8e82a523-fc73-4f3b-98dc-3b1e7199cd93",
      "subject": "ATTACK:enterprise:S0138",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8e82a523-fc73-4f3b-98dc-3b1e7199cd93",
      "modified": "2026-04-29T14:23:06.119Z",
      "references": [
        {
          "source_name": "FireEye APT28",
          "url": "https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8f748caa-dd1e-41aa-b09a-333ce8916bd0",
      "subject": "ATTACK:enterprise:T1027.003",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8f748caa-dd1e-41aa-b09a-333ce8916bd0",
      "modified": "2026-04-29T14:23:06.121Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9297d0b8-3a96-4fb9-90f2-8e3aa9fe4aca",
      "subject": "ATTACK:enterprise:S0504",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9297d0b8-3a96-4fb9-90f2-8e3aa9fe4aca",
      "modified": "2026-04-29T14:23:06.125Z",
      "references": [
        {
          "source_name": "Cyberreason Anchor December 2019",
          "url": "https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--92b34cc0-b059-4294-824f-bb92298f3ae6",
      "subject": "ATTACK:enterprise:S0187",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--92b34cc0-b059-4294-824f-bb92298f3ae6",
      "modified": "2026-04-29T14:23:06.125Z",
      "references": [
        {
          "source_name": "Trend Micro Daserf Nov 2017",
          "url": "http://blog.trendmicro.com/trendlabs-security-intelligence/redbaldknight-bronze-butler-daserf-backdoor-now-using-steganography/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--92f9a003-2bd1-482e-bf0f-7ee7760a43a8",
      "subject": "ATTACK:enterprise:T1027.015",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--92f9a003-2bd1-482e-bf0f-7ee7760a43a8",
      "modified": "2026-04-29T14:23:06.125Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--996defcb-8a62-4271-9d01-93d66525b159",
      "subject": "ATTACK:enterprise:G0112",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--996defcb-8a62-4271-9d01-93d66525b159",
      "modified": "2026-09-02T18:52:47.089Z",
      "references": [
        {
          "source_name": "BlackBerry Bahamut",
          "url": "https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9a823773-6bcc-4923-8f27-4729e771df2b",
      "subject": "ATTACK:enterprise:G0004",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9a823773-6bcc-4923-8f27-4729e771df2b",
      "modified": "2026-07-31T18:48:01.447Z",
      "references": [
        {
          "source_name": "Microsoft NICKEL December 2021",
          "url": "https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9af6241d-355a-4673-b772-8384a718ed64",
      "subject": "ATTACK:enterprise:S0377",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9af6241d-355a-4673-b772-8384a718ed64",
      "modified": "2026-04-29T14:23:06.136Z",
      "references": [
        {
          "source_name": "ESET Ebury Feb 2014",
          "url": "https://www.welivesecurity.com/2014/02/21/an-in-depth-analysis-of-linuxebury/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9cc5bd19-ab08-4eb7-886b-ce55fde60421",
      "subject": "ATTACK:enterprise:S0575",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9cc5bd19-ab08-4eb7-886b-ce55fde60421",
      "modified": "2026-04-29T14:23:06.139Z",
      "references": [
        {
          "source_name": "CarbonBlack Conti July 2020",
          "url": "https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/"
        },
        {
          "source_name": "Cybereason Conti Jan 2021",
          "url": "https://www.cybereason.com/blog/cybereason-vs.-conti-ransomware"
        },
        {
          "source_name": "CrowdStrike Wizard Spider October 2020",
          "url": "https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9d11c36e-e738-4d2a-98cf-f5f962a716ea",
      "subject": "ATTACK:enterprise:S0641",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9d11c36e-e738-4d2a-98cf-f5f962a716ea",
      "modified": "2026-04-29T14:23:06.139Z",
      "references": [
        {
          "source_name": "ESET Kobalos Feb 2021",
          "url": "https://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9d88636c-32f1-4ea4-b7d9-948e48055d37",
      "subject": "ATTACK:enterprise:G0067",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9d88636c-32f1-4ea4-b7d9-948e48055d37",
      "modified": "2026-07-31T18:47:55.553Z",
      "references": [
        {
          "source_name": "Talos Group123",
          "url": "https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"
        },
        {
          "source_name": "Securelist ScarCruft May 2019",
          "url": "https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/"
        },
        {
          "source_name": "Volexity InkySquid RokRAT August 2021",
          "url": "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9e35b5e0-dfac-4c0d-a257-415e091a7344",
      "subject": "ATTACK:enterprise:S9025",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9e35b5e0-dfac-4c0d-a257-415e091a7344",
      "modified": "2026-04-29T14:23:06.141Z",
      "references": [
        {
          "source_name": "JPCERT MirrorFace JUL 2024",
          "url": "https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"
        },
        {
          "source_name": "Trend Micro Earth Kasha NOV 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9e44c694-2fc7-4ebd-8e18-7562dce4d60e",
      "subject": "ATTACK:enterprise:S9037",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9e44c694-2fc7-4ebd-8e18-7562dce4d60e",
      "modified": "2026-04-29T14:23:06.141Z",
      "references": [
        {
          "source_name": "CloudSEK_RustyWater_Jan2026",
          "url": "https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9e8f8dce-1921-4738-ae7f-30290a350cf2",
      "subject": "ATTACK:enterprise:S0260",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9e8f8dce-1921-4738-ae7f-30290a350cf2",
      "modified": "2026-04-29T14:23:06.141Z",
      "references": [
        {
          "source_name": "ESET InvisiMole June 2018",
          "url": "https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"
        },
        {
          "source_name": "ESET InvisiMole June 2020",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9f42ded2-e291-4856-91ab-cf5ff8be461a",
      "subject": "ATTACK:enterprise:M1047",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9f42ded2-e291-4856-91ab-cf5ff8be461a",
      "modified": "2026-04-29T14:23:06.142Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a0040bac-4445-4999-bf0f-53b340f02218",
      "subject": "ATTACK:enterprise:S1039",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a0040bac-4445-4999-bf0f-53b340f02218",
      "modified": "2026-04-29T14:23:06.143Z",
      "references": [
        {
          "source_name": "Cybereason Bumblebee August 2022",
          "url": "https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control"
        },
        {
          "source_name": "Proofpoint Bumblebee April 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"
        },
        {
          "source_name": "Medium Ali Salem Bumblebee April 2022",
          "url": "https://elis531989.medium.com/the-chronicles-of-bumblebee-the-hook-the-bee-and-the-trickbot-connection-686379311056"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a0500766-a6ba-4672-b7fc-2a712cd0cfca",
      "subject": "ATTACK:enterprise:S0189",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a0500766-a6ba-4672-b7fc-2a712cd0cfca",
      "modified": "2026-04-29T14:23:06.144Z",
      "references": [
        {
          "source_name": "OilRig New Delivery Oct 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/10/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a17d1fee-c44e-4e38-85be-68e7dff9d69c",
      "subject": "ATTACK:enterprise:G0094",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a17d1fee-c44e-4e38-85be-68e7dff9d69c",
      "modified": "2026-07-31T20:48:25.271Z",
      "references": [
        {
          "source_name": "Gen Digital Kimsuky HTTPTroy October 2025",
          "url": "https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"
        },
        {
          "source_name": "Talos Kimsuky Nov 2021",
          "url": "https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"
        },
        {
          "source_name": "VirusBulletin Kimsuky October 2019",
          "url": "https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-kimsuky-group-tracking-king-spearphishing/"
        },
        {
          "source_name": "ThreatConnect Kimsuky September 2020",
          "url": "https://threatconnect.com/blog/kimsuky-phishing-operations-putting-in-work/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a6ea2a1c-dfe9-4599-812a-d1f846fb775b",
      "subject": "ATTACK:enterprise:G1036",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a6ea2a1c-dfe9-4599-812a-d1f846fb775b",
      "modified": "2026-07-31T18:48:24.904Z",
      "references": [
        {
          "source_name": "Microsoft Moonstone Sleet 2024",
          "url": "https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a7361e2b-9cdc-4fa6-97e4-1b191e9f3952",
      "subject": "ATTACK:enterprise:S0690",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a7361e2b-9cdc-4fa6-97e4-1b191e9f3952",
      "modified": "2026-04-29T14:23:06.153Z",
      "references": [
        {
          "source_name": "Objective See Green Lambert for OSX Oct 2021",
          "url": "https://objective-see.com/blog/blog_0x68.html"
        },
        {
          "source_name": "Glitch-Cat Green Lambert ATTCK Oct 2021",
          "url": "https://web.archive.org/web/20211018145402/https://www.glitch-cat.com/blog/green-lambert-and-attack"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a81df141-ff2a-4be9-a6ea-c5b19d29bc0e",
      "subject": "ATTACK:enterprise:C0015",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a81df141-ff2a-4be9-a6ea-c5b19d29bc0e",
      "modified": "2026-07-31T18:47:25.518Z",
      "references": [
        {
          "source_name": "DFIR Conti Bazar Nov 2021",
          "url": "https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--aa2d7045-fbad-4b5c-a24e-fd904e089875",
      "subject": "ATTACK:enterprise:S1213",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--aa2d7045-fbad-4b5c-a24e-fd904e089875",
      "modified": "2026-04-29T14:23:06.156Z",
      "references": [
        {
          "source_name": "Fortinet LummaStealer 2024",
          "url": "https://www.fortinet.com/blog/threat-research/lumma-variant-on-youtube"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--aac99c91-e1b1-42c0-8a13-f166027d5168",
      "subject": "ATTACK:enterprise:S0335",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--aac99c91-e1b1-42c0-8a13-f166027d5168",
      "modified": "2026-04-29T14:23:06.157Z",
      "references": [
        {
          "source_name": "Accenture HyperStack October 2020",
          "url": "https://web.archive.org/web/20201101015247/https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity"
        },
        {
          "source_name": "ESET Carbon Mar 2017",
          "url": "https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ac6100b4-8a41-4353-8cbf-46e596d8d212",
      "subject": "ATTACK:enterprise:S0659",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ac6100b4-8a41-4353-8cbf-46e596d8d212",
      "modified": "2026-04-29T14:23:06.160Z",
      "references": [
        {
          "source_name": "Fortinet Diavol July 2021",
          "url": "https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ae282182-36be-41be-98bb-33ff7e5d29a6",
      "subject": "ATTACK:enterprise:T1027.016",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ae282182-36be-41be-98bb-33ff7e5d29a6",
      "modified": "2026-04-29T14:23:06.162Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--aefb92ff-56e9-47d9-adc9-ed504f271863",
      "subject": "ATTACK:enterprise:S0500",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--aefb92ff-56e9-47d9-adc9-ed504f271863",
      "modified": "2026-04-29T14:23:06.163Z",
      "references": [
        {
          "source_name": "Secureworks MCMD July 2019",
          "url": "https://www.secureworks.com/research/mcmd-malware-analysis"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b001d78a-afd6-47bb-bdb5-73e967e35a13",
      "subject": "ATTACK:enterprise:T1027.008",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b001d78a-afd6-47bb-bdb5-73e967e35a13",
      "modified": "2026-04-29T14:23:06.165Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b49fe95b-bd40-4dc7-a42c-b5741cde4941",
      "subject": "ATTACK:enterprise:S0622",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b49fe95b-bd40-4dc7-a42c-b5741cde4941",
      "modified": "2026-04-29T14:23:06.172Z",
      "references": [
        {
          "source_name": "Malwarebytes Kimsuky June 2021",
          "url": "https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b6bfd59b-086e-4559-9bc0-159945c84e78",
      "subject": "ATTACK:enterprise:S0651",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b6bfd59b-086e-4559-9bc0-159945c84e78",
      "modified": "2026-04-29T14:23:06.175Z",
      "references": [
        {
          "source_name": "Checkpoint IndigoZebra July 2021",
          "url": "https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b6fc7740-4e5f-4f4c-8b1e-d0e3368eee03",
      "subject": "ATTACK:enterprise:S0045",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b6fc7740-4e5f-4f4c-8b1e-d0e3368eee03",
      "modified": "2026-04-29T14:23:06.175Z",
      "references": [
        {
          "source_name": "Kaspersky Sofacy",
          "url": "https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/"
        },
        {
          "source_name": "Bitdefender APT28 Dec 2015",
          "url": "https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b9de1f4c-1978-4efe-9bd0-f525b6acaeb1",
      "subject": "ATTACK:enterprise:S0608",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b9de1f4c-1978-4efe-9bd0-f525b6acaeb1",
      "modified": "2026-04-29T14:23:06.178Z",
      "references": [
        {
          "source_name": "Trend Micro Conficker",
          "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/conficker"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bb671992-02f2-430d-9d33-f43fae135735",
      "subject": "ATTACK:enterprise:S0623",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bb671992-02f2-430d-9d33-f43fae135735",
      "modified": "2026-04-29T14:23:06.181Z",
      "references": [
        {
          "source_name": "Unit 42 Siloscape Jun 2021",
          "url": "https://unit42.paloaltonetworks.com/siloscape/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bc1c0019-3072-413f-add4-da266e467edf",
      "subject": "ATTACK:enterprise:S1161",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bc1c0019-3072-413f-add4-da266e467edf",
      "modified": "2026-04-29T14:23:06.182Z",
      "references": [
        {
          "source_name": "Sandfly BPFDoor 2022",
          "url": "https://sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bf78e7f6-2dc5-4b1b-95bb-03e8e5e0e5a1",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bf78e7f6-2dc5-4b1b-95bb-03e8e5e0e5a1",
      "modified": "2026-07-31T18:47:53.263Z",
      "references": [
        {
          "source_name": "Eset PlugX Korplug Mustang Panda March 2022",
          "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
        },
        {
          "source_name": "Anomali MUSTANG PANDA October 2019",
          "url": "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"
        },
        {
          "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
          "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
        },
        {
          "source_name": "Secureworks BRONZE PRESIDENT December 2019",
          "url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
        },
        {
          "source_name": "Recorded Future REDDELTA July 2020",
          "url": "https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"
        },
        {
          "source_name": "Crowdstrike MUSTANG PANDA June 2018",
          "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"
        },
        {
          "source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload",
          "url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
        },
        {
          "source_name": "Proofpoint TA416 November 2020",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/ta416-goes-ground-and-returns-golang-plugx-malware-loader"
        },
        {
          "source_name": "Proofpoint TA416 Europe March 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"
        },
        {
          "source_name": "Unit42 Bookworm Nov2015",
          "url": "https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"
        },
        {
          "source_name": "Sophos PlugX September 2022",
          "url": "https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"
        },
        {
          "source_name": "Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"
        },
        {
          "source_name": "Zscaler",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c0876037-56b6-409c-bda5-7aa5e6091c94",
      "subject": "ATTACK:enterprise:S0596",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c0876037-56b6-409c-bda5-7aa5e6091c94",
      "modified": "2026-04-29T14:23:06.189Z",
      "references": [
        {
          "source_name": "TrendMicro EarthLusca 2022",
          "url": "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"
        },
        {
          "source_name": "Securelist ShadowPad Aug 2017",
          "url": "https://securelist.com/shadowpad-in-corporate-networks/81432/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c17229de-8778-4dd9-adb9-7b9c6bb2b99b",
      "subject": "ATTACK:enterprise:S0605",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c17229de-8778-4dd9-adb9-7b9c6bb2b99b",
      "modified": "2026-04-29T14:23:06.190Z",
      "references": [
        {
          "source_name": "FireEye Ransomware Feb 2020",
          "url": "https://www.fireeye.com/blog/threat-research/2020/02/ransomware-against-machine-learning-to-disrupt-industrial-production.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c1b912a1-ffb4-4b33-88ec-6a567a1fcfd4",
      "subject": "ATTACK:enterprise:S0511",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c1b912a1-ffb4-4b33-88ec-6a567a1fcfd4",
      "modified": "2026-04-29T14:23:06.190Z",
      "references": [
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c1dddcf3-c3b1-498a-9a80-8dcbf6887d10",
      "subject": "ATTACK:enterprise:S1090",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c1dddcf3-c3b1-498a-9a80-8dcbf6887d10",
      "modified": "2026-04-29T14:23:06.190Z",
      "references": [
        {
          "source_name": "MoustachedBouncer ESET August 2023",
          "url": "https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c2e9f949-59a5-4e96-b0dd-0bde1a507909",
      "subject": "ATTACK:enterprise:G0034",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c2e9f949-59a5-4e96-b0dd-0bde1a507909",
      "modified": "2026-07-31T20:48:33.248Z",
      "references": [
        {
          "source_name": "iSight Sandworm Oct 2014",
          "url": "https://web.archive.org/web/20160503234007/https:/www.isightpartners.com/2014/10/cve-2014-4114/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c3aa5639-a8e1-4de3-8f39-cc98593973ed",
      "subject": "ATTACK:enterprise:S0434",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c3aa5639-a8e1-4de3-8f39-cc98593973ed",
      "modified": "2026-04-29T14:23:06.193Z",
      "references": [
        {
          "source_name": "QiAnXin APT-C-36 Feb2019",
          "url": "https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c5afcc91-bdd7-489a-a9d5-9840f5ba2259",
      "subject": "ATTACK:enterprise:S9027",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c5afcc91-bdd7-489a-a9d5-9840f5ba2259",
      "modified": "2026-04-29T14:23:06.196Z",
      "references": [
        {
          "source_name": "Trend Micro Earth Kasha Anel NOV 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c74dfd33-e17a-4fc7-b2bd-154499fc3ac2",
      "subject": "ATTACK:enterprise:G1006",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c74dfd33-e17a-4fc7-b2bd-154499fc3ac2",
      "modified": "2026-07-31T20:48:48.382Z",
      "references": [
        {
          "source_name": "TrendMicro EarthLusca 2022",
          "url": "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c76875e8-006d-493b-880a-332faf28f3ca",
      "subject": "ATTACK:enterprise:S0516",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c76875e8-006d-493b-880a-332faf28f3ca",
      "modified": "2026-04-29T14:23:06.198Z",
      "references": [
        {
          "source_name": "CISA SoreFang July 2016",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c8fb4459-4352-4ee6-bfaf-a97be333bf64",
      "subject": "ATTACK:enterprise:S0499",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c8fb4459-4352-4ee6-bfaf-a97be333bf64",
      "modified": "2026-04-29T14:23:06.200Z",
      "references": [
        {
          "source_name": "Threatpost Hancitor",
          "url": "https://threatpost.com/spammers-revive-hancitor-downloader-campaigns/123011/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cbc4c186-028e-4a24-93ff-5f2bb7edd98a",
      "subject": "ATTACK:enterprise:S0124",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cbc4c186-028e-4a24-93ff-5f2bb7edd98a",
      "modified": "2026-04-29T14:23:06.204Z",
      "references": [
        {
          "source_name": "Palo Alto DNS Requests",
          "url": "http://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cc134d2d-64eb-469a-b8eb-90ea632c0adc",
      "subject": "ATTACK:enterprise:S0640",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cc134d2d-64eb-469a-b8eb-90ea632c0adc",
      "modified": "2026-04-29T14:23:06.204Z",
      "references": [
        {
          "source_name": "Arxiv Avaddon Feb 2021",
          "url": "https://arxiv.org/pdf/2102.04796.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cca451aa-d4ca-4697-ac64-745841fb8658",
      "subject": "ATTACK:enterprise:M1040",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cca451aa-d4ca-4697-ac64-745841fb8658",
      "modified": "2026-04-29T14:23:06.205Z",
      "references": [
        {
          "source_name": "win10_asr",
          "url": "https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d0b79bdf-75ba-4133-bab0-2fe21f3ded43",
      "subject": "ATTACK:enterprise:S1226",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d0b79bdf-75ba-4133-bab0-2fe21f3ded43",
      "modified": "2026-04-29T14:23:06.211Z",
      "references": [
        {
          "source_name": "Unit42 Bookworm Nov2015",
          "url": "https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d2263afd-2fd3-4f98-96a5-a00e5f33b99e",
      "subject": "ATTACK:enterprise:S0201",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d2263afd-2fd3-4f98-96a5-a00e5f33b99e",
      "modified": "2026-04-29T14:23:06.213Z",
      "references": [
        {
          "source_name": "Microsoft PLATINUM April 2016",
          "url": "https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d2d1291b-5a6a-4494-9cdd-402745e346e1",
      "subject": "ATTACK:enterprise:S9053",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d2d1291b-5a6a-4494-9cdd-402745e346e1",
      "modified": "2026-09-24T22:26:17.184Z",
      "references": [
        {
          "source_name": "CheckPoint_NimbusManticoreEurope_Sept2025",
          "url": "https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d4d7bda4-83fa-4cff-8842-f1b058cafe25",
      "subject": "ATTACK:enterprise:S9050",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d4d7bda4-83fa-4cff-8842-f1b058cafe25",
      "modified": "2026-09-25T17:01:56.377Z",
      "references": [
        {
          "source_name": "Intrinsec_Vidar_April2026",
          "url": "https://www.intrinsec.com/wp-content/uploads/2026/04/TLP_CLEAR-20260424-New_Vidar.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d5c86dd3-3cfa-4ade-8984-fdf079b9f81b",
      "subject": "ATTACK:enterprise:S0148",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d5c86dd3-3cfa-4ade-8984-fdf079b9f81b",
      "modified": "2026-04-29T14:23:06.217Z",
      "references": [
        {
          "source_name": "Unit42 Redaman January 2019",
          "url": "https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/"
        },
        {
          "source_name": "ESET RTM Feb 2017",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d8557c07-240a-4dbb-b372-1111a05a5303",
      "subject": "ATTACK:enterprise:S0465",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d8557c07-240a-4dbb-b372-1111a05a5303",
      "modified": "2026-04-29T14:23:06.221Z",
      "references": [
        {
          "source_name": "Unit 42 CARROTBAT January 2020",
          "url": "https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d93b7c7b-e4b2-416c-9122-6f687642ce6e",
      "subject": "ATTACK:enterprise:S1085",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d93b7c7b-e4b2-416c-9122-6f687642ce6e",
      "modified": "2026-04-29T14:23:06.222Z",
      "references": [
        {
          "source_name": "Symantec FIN8 Jul 2023",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d99149ea-7a52-455c-a56d-1f78a727a846",
      "subject": "ATTACK:enterprise:S1130",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d99149ea-7a52-455c-a56d-1f78a727a846",
      "modified": "2026-04-29T14:23:06.222Z",
      "references": [
        {
          "source_name": "RedCanary RaspberryRobin 2022",
          "url": "https://redcanary.com/blog/threat-intelligence/raspberry-robin/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--dca5cde1-ebf3-4cb8-ab80-1a5ab13000fa",
      "subject": "ATTACK:enterprise:T1027.002",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--dca5cde1-ebf3-4cb8-ab80-1a5ab13000fa",
      "modified": "2026-04-29T14:23:06.226Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--dd84b767-1623-421b-8f31-048924be5f17",
      "subject": "ATTACK:enterprise:G0047",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--dd84b767-1623-421b-8f31-048924be5f17",
      "modified": "2026-07-31T18:47:48.117Z",
      "references": [
        {
          "source_name": "ESET Gamaredon June 2020",
          "url": "https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"
        },
        {
          "source_name": "SymantecCarbonBlack_ShuckwormUSB_Apr2025",
          "url": "https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ddac1aee-5aca-4ccb-bba4-52a2b52e2abc",
      "subject": "ATTACK:enterprise:S9020",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ddac1aee-5aca-4ccb-bba4-52a2b52e2abc",
      "modified": "2026-04-29T14:23:06.228Z",
      "references": [
        {
          "source_name": "ITOCHU LODEINFO JAN 2024",
          "url": "https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--de300ca1-3935-4b44-9b35-e32eee5304f7",
      "subject": "ATTACK:enterprise:S0584",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--de300ca1-3935-4b44-9b35-e32eee5304f7",
      "modified": "2026-04-29T14:23:06.228Z",
      "references": [
        {
          "source_name": "CISA AppleJeus Feb 2021",
          "url": "https://us-cert.cisa.gov/ncas/alerts/aa21-048a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--def1a889-9341-4179-9d14-a5c10aa100b2",
      "subject": "ATTACK:enterprise:S0694",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--def1a889-9341-4179-9d14-a5c10aa100b2",
      "modified": "2026-04-29T14:23:06.229Z",
      "references": [
        {
          "source_name": "ClearSky Lazarus Aug 2020",
          "url": "https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e12155de-d422-47e4-9ce5-a7fe8011b74b",
      "subject": "ATTACK:enterprise:S1053",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e12155de-d422-47e4-9ce5-a7fe8011b74b",
      "modified": "2026-04-29T14:23:06.232Z",
      "references": [
        {
          "source_name": "Malwarebytes AvosLocker Jul 2021",
          "url": "https://www.malwarebytes.com/blog/threat-intelligence/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e159049f-70c1-4349-b299-c1d99d06901d",
      "subject": "ATTACK:enterprise:S0428",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e159049f-70c1-4349-b299-c1d99d06901d",
      "modified": "2026-04-29T14:23:06.232Z",
      "references": [
        {
          "source_name": "Talos PoetRAT April 2020",
          "url": "https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e273286f-8ca7-4d3e-bdc3-08929c7cbd12",
      "subject": "ATTACK:enterprise:S0458",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e273286f-8ca7-4d3e-bdc3-08929c7cbd12",
      "modified": "2026-04-29T14:23:06.234Z",
      "references": [
        {
          "source_name": "Eset Ramsay May 2020",
          "url": "https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e2e74982-a4a6-428f-888a-a910453b7e82",
      "subject": "ATTACK:enterprise:S0196",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e2e74982-a4a6-428f-888a-a910453b7e82",
      "modified": "2026-04-29T14:23:06.234Z",
      "references": [
        {
          "source_name": "Morphisec ShellTea June 2019",
          "url": "http://blog.morphisec.com/security-alert-fin8-is-back"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e3602962-691a-4a34-a49b-4682405da8ad",
      "subject": "ATTACK:enterprise:S1105",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e3602962-691a-4a34-a49b-4682405da8ad",
      "modified": "2026-04-29T14:23:06.235Z",
      "references": [
        {
          "source_name": "NCSC-NL COATHANGER Feb 2024",
          "url": "https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear/TLP-CLEAR+MIVD+AIVD+Advisory+COATHANGER.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e3864ffa-3348-4791-b979-7d8b2e2151cc",
      "subject": "ATTACK:enterprise:S0449",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e3864ffa-3348-4791-b979-7d8b2e2151cc",
      "modified": "2026-04-29T14:23:06.235Z",
      "references": [
        {
          "source_name": "McAfee Maze March 2020",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-maze/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e44f4171-5601-4b92-964a-908af35b98e2",
      "subject": "ATTACK:enterprise:S1138",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e44f4171-5601-4b92-964a-908af35b98e2",
      "modified": "2026-04-29T14:23:06.236Z",
      "references": [
        {
          "source_name": "SentinelOne Gootloader June 2021",
          "url": "https://www.sentinelone.com/labs/gootloader-initial-access-as-a-service-platform-expands-its-search-for-high-value-targets/"
        },
        {
          "source_name": "Sophos Gootloader",
          "url": "https://news.sophos.com/en-us/2021/03/01/gootloader-expands-its-payload-delivery-options/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e600fe60-36d1-4053-af2f-13830d95bd14",
      "subject": "ATTACK:enterprise:S0091",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e600fe60-36d1-4053-af2f-13830d95bd14",
      "modified": "2026-04-29T14:23:06.238Z",
      "references": [
        {
          "source_name": "Kaspersky Turla",
          "url": "https://securelist.com/the-epic-turla-operation/65545/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e6f5bde4-869f-4c9a-9414-11ea48386204",
      "subject": "ATTACK:enterprise:S0137",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e6f5bde4-869f-4c9a-9414-11ea48386204",
      "modified": "2026-04-29T14:23:06.239Z",
      "references": [
        {
          "source_name": "FireEye APT28",
          "url": "https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e809f78f-344d-4169-a145-89023f4530d5",
      "subject": "ATTACK:enterprise:S0013",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e809f78f-344d-4169-a145-89023f4530d5",
      "modified": "2026-04-29T14:23:06.241Z",
      "references": [
        {
          "source_name": "Trend Micro DRBControl February 2020",
          "url": "https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"
        },
        {
          "source_name": "Proofpoint TA416 Europe March 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e8d2c3f1-7c86-438c-bead-6a86f9a36463",
      "subject": "ATTACK:enterprise:S0117",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e8d2c3f1-7c86-438c-bead-6a86f9a36463",
      "modified": "2026-04-29T14:23:06.242Z",
      "references": [
        {
          "source_name": "ESET Sednit Part 2",
          "url": "http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e97ea9e0-3988-4135-9c7d-d4e2d1900c34",
      "subject": "ATTACK:enterprise:S9051",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e97ea9e0-3988-4135-9c7d-d4e2d1900c34",
      "modified": "2026-09-23T16:26:54.253Z",
      "references": [
        {
          "source_name": "MSTI_GentelmenRansomware_May2026",
          "url": "https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ec2e27c9-71fe-4650-a5b9-1247193c39f6",
      "subject": "ATTACK:enterprise:S0283",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ec2e27c9-71fe-4650-a5b9-1247193c39f6",
      "modified": "2026-04-29T14:23:06.246Z",
      "references": [
        {
          "source_name": "jRAT Symantec Aug 2018",
          "url": "https://www.symantec.com/blogs/threat-intelligence/jrat-new-anti-parsing-techniques"
        },
        {
          "source_name": "Symantec Frutas Feb 2013",
          "url": "https://www.symantec.com/connect/blogs/cross-platform-frutas-rat-builder-and-back-door"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ec9e1757-50c1-4fd8-a0be-2694b1bc9e99",
      "subject": "ATTACK:enterprise:S0264",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ec9e1757-50c1-4fd8-a0be-2694b1bc9e99",
      "modified": "2026-04-29T14:23:06.247Z",
      "references": [
        {
          "source_name": "Unit 42 OopsIE! Feb 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"
        },
        {
          "source_name": "Unit 42 OilRig Sept 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/09/unit42-oilrig-targets-middle-eastern-government-adds-evasion-techniques-oopsie/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ecd6c482-51ae-402c-8482-4feb9cda9b05",
      "subject": "ATTACK:enterprise:S0632",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ecd6c482-51ae-402c-8482-4feb9cda9b05",
      "modified": "2026-04-29T14:23:06.247Z",
      "references": [
        {
          "source_name": "Group IB GrimAgent July 2021",
          "url": "https://www.group-ib.com/blog/grimagent/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ecdbe751-ef08-41fe-8c13-27ffaae30312",
      "subject": "ATTACK:enterprise:T1027.001",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ecdbe751-ef08-41fe-8c13-27ffaae30312",
      "modified": "2026-04-29T14:23:06.247Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ed1cb231-7e2d-461c-a9c8-56a2d1f43c0f",
      "subject": "ATTACK:enterprise:S0445",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ed1cb231-7e2d-461c-a9c8-56a2d1f43c0f",
      "modified": "2026-04-29T14:23:06.248Z",
      "references": [
        {
          "source_name": "FOX-IT May 2016 Mofang",
          "url": "https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ee51d531-5cc4-4836-a55c-6062bde1a4d4",
      "subject": "ATTACK:enterprise:S0142",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ee51d531-5cc4-4836-a55c-6062bde1a4d4",
      "modified": "2026-04-29T14:23:06.249Z",
      "references": [
        {
          "source_name": "Cylance Shell Crew Feb 2017",
          "url": "https://www.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f1a9d2b9-f5ec-4119-b3b5-8b46085c01b5",
      "subject": "ATTACK:enterprise:G0096",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f1a9d2b9-f5ec-4119-b3b5-8b46085c01b5",
      "modified": "2026-07-31T20:48:27.632Z",
      "references": [
        {
          "source_name": "FireEye APT41 March 2020",
          "url": "https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f252d0e6-019a-4711-9069-c16930236aa4",
      "subject": "ATTACK:enterprise:S0461",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f252d0e6-019a-4711-9069-c16930236aa4",
      "modified": "2026-04-29T14:23:06.254Z",
      "references": [
        {
          "source_name": "Proofpoint TA505 October 2019",
          "url": "https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f35fa774-0344-4678-b104-a0dd1003197a",
      "subject": "ATTACK:enterprise:S1104",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f35fa774-0344-4678-b104-a0dd1003197a",
      "modified": "2026-04-29T14:23:06.256Z",
      "references": [
        {
          "source_name": "Mandiant Pulse Secure Zero-Day April 2021",
          "url": "https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f43dedfa-261d-41af-bb74-e1f2eff5cbae",
      "subject": "ATTACK:enterprise:S0467",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f43dedfa-261d-41af-bb74-e1f2eff5cbae",
      "modified": "2026-04-29T14:23:06.257Z",
      "references": [
        {
          "source_name": "Kaspersky TajMahal April 2019",
          "url": "https://securelist.com/project-tajmahal/90240/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f4881cea-8d6f-4cb6-ab86-5aab2379c695",
      "subject": "ATTACK:enterprise:S0354",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f4881cea-8d6f-4cb6-ab86-5aab2379c695",
      "modified": "2026-04-29T14:23:06.257Z",
      "references": [
        {
          "source_name": "Cybereason Cobalt Kitty 2017",
          "url": "https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f4d1e337-60ba-4e28-89d1-ff206bae1750",
      "subject": "ATTACK:enterprise:M1017",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f4d1e337-60ba-4e28-89d1-ff206bae1750",
      "modified": "2026-04-29T14:23:06.258Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f75caad1-161a-4833-b3ec-f4538e1603fe",
      "subject": "ATTACK:enterprise:S0182",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f75caad1-161a-4833-b3ec-f4538e1603fe",
      "modified": "2026-04-29T14:23:06.261Z",
      "references": [
        {
          "source_name": "Microsoft FinFisher March 2018",
          "url": "https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/"
        },
        {
          "source_name": "FinFisher Citation",
          "url": "https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f785ff3b-923c-478e-a194-c13c6bdbf071",
      "subject": "ATTACK:enterprise:S1099",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f785ff3b-923c-478e-a194-c13c6bdbf071",
      "modified": "2026-04-29T14:23:06.261Z",
      "references": [
        {
          "source_name": "Kaspersky ToddyCat June 2022",
          "url": "https://securelist.com/toddycat/106799/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fa6f0d89-8a80-421b-bcb1-ef5ee31f0879",
      "subject": "ATTACK:enterprise:S0229",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fa6f0d89-8a80-421b-bcb1-ef5ee31f0879",
      "modified": "2026-04-29T14:23:06.265Z",
      "references": [
        {
          "source_name": "Proofpoint Leviathan Oct 2017",
          "url": "https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fce01f90-b298-4a34-8c15-0a84c351ba19",
      "subject": "ATTACK:enterprise:S1118",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fce01f90-b298-4a34-8c15-0a84c351ba19",
      "modified": "2026-04-29T14:23:06.269Z",
      "references": [
        {
          "source_name": "Mandiant Cutting Edge Part 2 January 2024",
          "url": "https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fd79762c-1718-4c6b-adaa-a9a004bcdbca",
      "subject": "ATTACK:enterprise:S0635",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fd79762c-1718-4c6b-adaa-a9a004bcdbca",
      "modified": "2026-04-29T14:23:06.269Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Toolset May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fdd667be-ef2f-4def-ab36-1a64f960fb1d",
      "subject": "ATTACK:enterprise:G1059",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fdd667be-ef2f-4def-ab36-1a64f960fb1d",
      "modified": "2026-10-01T19:12:26.276Z",
      "references": [
        {
          "source_name": "CheckPoint_NimbusManticoreEurope_Sept2025",
          "url": "https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fe57d6a5-09d4-4642-9b71-cfcf9b9e0de1",
      "subject": "ATTACK:enterprise:S0154",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fe57d6a5-09d4-4642-9b71-cfcf9b9e0de1",
      "modified": "2026-04-29T14:23:06.270Z",
      "references": [
        {
          "source_name": "Talos Cobalt Strike September 2020",
          "url": "https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf"
        },
        {
          "source_name": "Cobalt Strike Manual 4.3 November 2020",
          "url": "https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fea9df26-2ff4-4fa4-8306-f10af6cdd7cd",
      "subject": "ATTACK:enterprise:S0604",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fea9df26-2ff4-4fa4-8306-f10af6cdd7cd",
      "modified": "2026-04-29T14:23:06.271Z",
      "references": [
        {
          "source_name": "ESET Industroyer",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ff3d2ebf-ea7b-4fd2-a524-9a6f20bcf3e3",
      "subject": "ATTACK:enterprise:S0244",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ff3d2ebf-ea7b-4fd2-a524-9a6f20bcf3e3",
      "modified": "2026-04-29T14:23:06.271Z",
      "references": [
        {
          "source_name": "Palo Alto Comnie",
          "url": "https://researchcenter.paloaltonetworks.com/2018/01/unit42-comnie-continues-target-organizations-east-asia/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ffa8f46b-615f-4b95-8ed5-90f86eaedd20",
      "subject": "ATTACK:enterprise:M1049",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ffa8f46b-615f-4b95-8ed5-90f86eaedd20",
      "modified": "2026-04-29T14:23:06.272Z",
      "references": [
        {
          "source_name": "Microsoft AMSI June 2015",
          "url": "https://cloudblogs.microsoft.com/microsoftsecure/2015/06/09/windows-10-to-offer-application-developers-new-malware-defenses/?source=mmpc"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    }
  ],
  "source_snapshot": {
    "file": "enterprise-attack-20.0.json",
    "url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
    "sha256": "81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352",
    "bytes": 55271014,
    "checked_at": "2026-10-16T03:31:39Z"
  },
  "notices_url": "https://aol.pm/source-notices.txt",
  "notices": "License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"
}

License
-------
The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,
development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce
MITRE's copyright designation and this license in any such copy.

"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation."

Disclaimers
-----------
MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part
of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover
full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or
variations on existing techniques not documented by ATT&CK.

ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE
ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,
AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT
THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR
FITNESS FOR A PARTICULAR PURPOSE.