{"record":{"id":"ATTACK:enterprise:T1036","title":"Masquerading","type":"Technique","source_url":"https://attack.mitre.org/techniques/T1036","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--42e8de7b-37b2-4258-905a-6897815e58e0","external_id":"T1036","domain":"enterprise","created":"2017-05-31T21:30:38.511Z","modified":"2026-05-12T15:12:00.629Z","version":"2.0","aliases":[],"tactics":["stealth"],"source_references":[{"source_name":"LOLBAS Main Site","url":"https://lolbas-project.github.io/"}]},"assertions":[{"id":"enterprise:relationship--0446f0ed-4214-4294-ba65-962b4fe08b08","subject":"ATTACK:enterprise:M1047","predicate":"mitigates","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0446f0ed-4214-4294-ba65-962b4fe08b08","modified":"2026-04-29T14:23:05.909Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--064f8984-e6cc-4334-a5ad-903a7af9bf4c","subject":"ATTACK:enterprise:T1036.008","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--064f8984-e6cc-4334-a5ad-903a7af9bf4c","modified":"2026-04-29T14:23:05.912Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--06b18704-e29e-4bf9-900f-44aa719df0c6","subject":"ATTACK:enterprise:G0045","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--06b18704-e29e-4bf9-900f-44aa719df0c6","modified":"2026-07-31T18:47:43.515Z","references":[{"source_name":"FireEye APT10 Sept 2018","url":"https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0b24b8de-944d-49ea-a15f-cb732aeb31de","subject":"ATTACK:enterprise:T1036.003","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0b24b8de-944d-49ea-a15f-cb732aeb31de","modified":"2026-04-29T14:23:05.918Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0d7c99f4-b1af-4278-b8bf-3bb04cce166d","subject":"ATTACK:enterprise:G0050","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0d7c99f4-b1af-4278-b8bf-3bb04cce166d","modified":"2026-07-31T18:47:43.903Z","references":[{"source_name":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--10fdc4f4-9f50-40d8-94db-966fcc434a14","subject":"ATTACK:enterprise:T1036.006","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--10fdc4f4-9f50-40d8-94db-966fcc434a14","modified":"2026-04-29T14:23:05.927Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--18ff6d49-0bcb-4878-8a01-821ad1091ef0","subject":"ATTACK:enterprise:G1052","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--18ff6d49-0bcb-4878-8a01-821ad1091ef0","modified":"2026-07-31T18:47:54.418Z","references":[{"source_name":"Sekoia ClickFake 2025","url":"https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"},{"source_name":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"},{"source_name":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1b45a6b4-8c3e-49c2-948c-5606ec872003","subject":"ATTACK:enterprise:C0046","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1b45a6b4-8c3e-49c2-948c-5606ec872003","modified":"2026-07-31T18:47:28.943Z","references":[{"source_name":"Cisco ArcaneDoor 2024","url":"https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--237cd65a-e30e-4f8a-9822-f50b818e1491","subject":"ATTACK:enterprise:S0453","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--237cd65a-e30e-4f8a-9822-f50b818e1491","modified":"2026-04-29T14:23:05.953Z","references":[{"source_name":"Malwarebytes Pony April 2016","url":"https://blog.malwarebytes.com/threat-analysis/2015/11/no-money-but-pony-from-a-mail-to-a-trojan-horse/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--25207694-a0db-46df-bbe8-f700aeb80418","subject":"ATTACK:enterprise:M1018","predicate":"mitigates","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--25207694-a0db-46df-bbe8-f700aeb80418","modified":"2026-04-29T14:23:05.956Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--288d8f70-d2af-44f8-86c9-fb8c2cd5103f","subject":"ATTACK:enterprise:S0565","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--288d8f70-d2af-44f8-86c9-fb8c2cd5103f","modified":"2026-04-29T14:23:05.960Z","references":[{"source_name":"Symantec RAINDROP January 2021","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware"},{"source_name":"Microsoft Deep Dive Solorigate January 2021","url":"https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2c595799-aebe-40f3-baa1-0e52cacee8b5","subject":"ATTACK:enterprise:M1017","predicate":"mitigates","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2c595799-aebe-40f3-baa1-0e52cacee8b5","modified":"2026-04-29T14:23:05.965Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2f2432b0-d985-41d8-bc47-e4aa1dbf8372","subject":"ATTACK:enterprise:G0060","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2f2432b0-d985-41d8-bc47-e4aa1dbf8372","modified":"2026-07-31T18:48:10.234Z","references":[{"source_name":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2f249959-a448-454d-85ab-f71c8c5ff277","subject":"ATTACK:enterprise:S0622","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2f249959-a448-454d-85ab-f71c8c5ff277","modified":"2026-04-29T14:23:05.969Z","references":[{"source_name":"Malwarebytes Kimsuky June 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2ffc25c4-3939-40df-841c-91059c6879d4","subject":"ATTACK:enterprise:G0049","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2ffc25c4-3939-40df-841c-91059c6879d4","modified":"2026-07-31T20:48:35.292Z","references":[{"source_name":"Check Point APT34 April 2021","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--33134dd2-7bc5-47a1-a06a-101f3ecf2878","subject":"ATTACK:enterprise:G1003","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--33134dd2-7bc5-47a1-a06a-101f3ecf2878","modified":"2026-07-31T18:48:12.908Z","references":[{"source_name":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--34371a06-bc30-47c0-89c7-cae8bb7a6f22","subject":"ATTACK:enterprise:G0034","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--34371a06-bc30-47c0-89c7-cae8bb7a6f22","modified":"2026-07-31T20:48:32.749Z","references":[{"source_name":"Leonard TAG 2023","url":"https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--37e3dbd7-9ecc-4e3a-9fa3-488e3a910f55","subject":"ATTACK:enterprise:S1018","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--37e3dbd7-9ecc-4e3a-9fa3-488e3a910f55","modified":"2026-04-29T14:23:05.996Z","references":[{"source_name":"Malwarebytes Saint Bot April 2021","url":"https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/"},{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3cc1b62f-5059-4fb1-be06-72bb13498002","subject":"ATTACK:enterprise:G0133","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3cc1b62f-5059-4fb1-be06-72bb13498002","modified":"2026-07-31T18:48:31.056Z","references":[{"source_name":"Securelist Octopus Oct 2018","url":"https://securelist.com/octopus-infested-seas-of-central-asia/88200/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--49c28aef-b7a2-464f-af3d-e104f9edf119","subject":"ATTACK:enterprise:T1036.004","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--49c28aef-b7a2-464f-af3d-e104f9edf119","modified":"2026-04-29T14:23:06.026Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4d7fd920-ea04-483b-98bf-dbf7bfac67f4","subject":"ATTACK:enterprise:C0059","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4d7fd920-ea04-483b-98bf-dbf7bfac67f4","modified":"2026-07-31T20:48:18.241Z","references":[{"source_name":"Google Salesforce JUN 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4f2f6d11-519c-4489-9104-e3d3b72ef3a8","subject":"ATTACK:enterprise:G1058","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4f2f6d11-519c-4489-9104-e3d3b72ef3a8","modified":"2026-09-22T15:36:30.576Z","references":[{"source_name":"SoučekESET_Gentlemen_Jun2026","url":"https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4fd3ec25-00ed-48c1-af72-e2523959860e","subject":"ATTACK:enterprise:M1045","predicate":"mitigates","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4fd3ec25-00ed-48c1-af72-e2523959860e","modified":"2026-04-29T14:23:06.034Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--51650560-9aff-460b-9766-14c83bdb2198","subject":"ATTACK:enterprise:S0658","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--51650560-9aff-460b-9766-14c83bdb2198","modified":"2026-04-29T14:23:06.036Z","references":[{"source_name":"trendmicro xcsset xcode project 2020","url":"https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf"},{"source_name":"Microsoft March 2025 XCSSET","url":"https://www.microsoft.com/en-us/security/blog/2025/03/11/new-xcsset-malware-adds-new-obfuscation-persistence-techniques-to-infect-xcode-projects/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5566a165-9435-4683-9461-870f15450fd3","subject":"ATTACK:enterprise:M1040","predicate":"mitigates","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5566a165-9435-4683-9461-870f15450fd3","modified":"2026-04-29T14:23:06.042Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5c6230da-a47d-435f-9836-49648f03e76e","subject":"ATTACK:enterprise:S1066","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5c6230da-a47d-435f-9836-49648f03e76e","modified":"2026-04-29T14:23:06.051Z","references":[{"source_name":"Secureworks DarkTortilla Aug 2022","url":"https://www.secureworks.com/research/darktortilla-malware-analysis"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5cd22798-0d6e-4bed-b139-c46a4cfa87a5","subject":"ATTACK:enterprise:S1240","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5cd22798-0d6e-4bed-b139-c46a4cfa87a5","modified":"2026-04-29T14:23:06.052Z","references":[{"source_name":"Kroll RedLine Stealer August 2024","url":"https://www.kroll.com/en/publications/cyber/redlinestealer-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5e7f7b93-bf98-4528-b6bc-dc60e47af788","subject":"ATTACK:enterprise:T1036.002","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5e7f7b93-bf98-4528-b6bc-dc60e47af788","modified":"2026-04-29T14:23:06.054Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--61f793e5-6b95-46db-a54d-74745747a3d5","subject":"ATTACK:enterprise:S9010","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--61f793e5-6b95-46db-a54d-74745747a3d5","modified":"2026-04-29T14:23:06.058Z","references":[{"source_name":"Aikido GlassWorm October 2025","url":"https://www.aikido.dev/blog/the-return-of-the-invisible-threat-hidden-pua-unicode-hits-github-repositorties"},{"source_name":"Koi GlassWorm Rust December 2025","url":"https://www.koi.ai/blog/glassworm-goes-native-same-infrastructure-hardened-delivery"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6c0510e4-a642-4dfe-9632-dff6f97e09de","subject":"ATTACK:enterprise:S0661","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6c0510e4-a642-4dfe-9632-dff6f97e09de","modified":"2026-04-29T14:23:06.072Z","references":[{"source_name":"MSTIC FoggyWeb September 2021","url":"https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--702c674e-110e-4f6d-9117-be1803d84e88","subject":"ATTACK:enterprise:S0696","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--702c674e-110e-4f6d-9117-be1803d84e88","modified":"2026-04-29T14:23:06.078Z","references":[{"source_name":"NTT Security Flagpro new December 2021","url":"https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--72de6e56-e5d1-4a3f-aa85-d7155f7ff42c","subject":"ATTACK:enterprise:M1022","predicate":"mitigates","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--72de6e56-e5d1-4a3f-aa85-d7155f7ff42c","modified":"2026-04-29T14:23:06.082Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--73672e43-5a42-4b6a-934b-a52f57bdd7ac","subject":"ATTACK:enterprise:T1036.005","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--73672e43-5a42-4b6a-934b-a52f57bdd7ac","modified":"2026-04-29T14:23:06.083Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--73952ccb-9ad7-405d-94f4-ad75fdfb8507","subject":"ATTACK:enterprise:G1030","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--73952ccb-9ad7-405d-94f4-ad75fdfb8507","modified":"2026-07-31T18:48:14.821Z","references":[{"source_name":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--757e8e47-b89d-4a70-a785-deefe6468006","subject":"ATTACK:enterprise:S1046","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--757e8e47-b89d-4a70-a785-deefe6468006","modified":"2026-04-29T14:23:06.086Z","references":[{"source_name":"DHS CISA AA22-055A MuddyWater February 2022","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7b43c9ba-49bc-4966-a987-2f991d0f44a2","subject":"ATTACK:enterprise:S1015","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7b43c9ba-49bc-4966-a987-2f991d0f44a2","modified":"2026-04-29T14:23:06.094Z","references":[{"source_name":"ClearSky Siamesekitten August 2021","url":"https://www.clearskysec.com/siamesekitten/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7c0d0a39-3a59-450b-8101-3e79792cd37f","subject":"ATTACK:enterprise:S1183","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7c0d0a39-3a59-450b-8101-3e79792cd37f","modified":"2026-04-29T14:23:06.095Z","references":[{"source_name":"IBM StrelaStealer 2024","url":"https://securityintelligence.com/x-force/strela-stealer-todays-invoice-tomorrows-phish/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--81603db2-a657-4716-a7ca-e6562799e98e","subject":"ATTACK:enterprise:S0466","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--81603db2-a657-4716-a7ca-e6562799e98e","modified":"2026-04-29T14:23:06.102Z","references":[{"source_name":"objective-see windtail1 dec 2018","url":"https://objective-see.com/blog/blog_0x3B.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--84be9d61-ec20-4066-8c99-b99d9127fce2","subject":"ATTACK:enterprise:S0635","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--84be9d61-ec20-4066-8c99-b99d9127fce2","modified":"2026-04-29T14:23:06.107Z","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8d0b4152-800e-4a22-ae48-7701beb7c682","subject":"ATTACK:enterprise:T1036.011","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8d0b4152-800e-4a22-ae48-7701beb7c682","modified":"2026-04-29T14:23:06.117Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8dda1296-0835-4748-92a3-24b34eb8a084","subject":"ATTACK:enterprise:T1036.007","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8dda1296-0835-4748-92a3-24b34eb8a084","modified":"2026-04-29T14:23:06.119Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--937daf9d-0f3c-4257-85ac-86bf104453da","subject":"ATTACK:enterprise:T1036.010","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--937daf9d-0f3c-4257-85ac-86bf104453da","modified":"2026-04-29T14:23:06.126Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--945ebd48-f638-469c-a106-113ab8bbf408","subject":"ATTACK:enterprise:G1007","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--945ebd48-f638-469c-a106-113ab8bbf408","modified":"2026-07-31T18:47:59.534Z","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--970e9eb2-51d7-4986-9480-d8a3b59c3006","subject":"ATTACK:enterprise:G0139","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--970e9eb2-51d7-4986-9480-d8a3b59c3006","modified":"2026-07-31T18:47:49.776Z","references":[{"source_name":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--99717cce-1987-4ca1-8df2-c6ec6ce17cf5","subject":"ATTACK:enterprise:G0140","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--99717cce-1987-4ca1-8df2-c6ec6ce17cf5","modified":"2026-07-31T18:48:13.512Z","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--99bc173b-a825-483c-969e-868356209ff6","subject":"ATTACK:enterprise:S1164","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--99bc173b-a825-483c-969e-868356209ff6","modified":"2026-04-29T14:23:06.134Z","references":[{"source_name":"Volexity UPSTYLE 2024","url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a292f2c5-a071-424e-b8b8-03d195c466ad","subject":"ATTACK:enterprise:G0007","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a292f2c5-a071-424e-b8b8-03d195c466ad","modified":"2026-07-31T20:48:44.993Z","references":[{"source_name":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a38af2cc-ccc7-41aa-936c-fe15a13ddafa","subject":"ATTACK:enterprise:S0458","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a38af2cc-ccc7-41aa-936c-fe15a13ddafa","modified":"2026-04-29T14:23:06.147Z","references":[{"source_name":"Eset Ramsay May 2020","url":"https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a3990ec1-b4bb-43dd-b7d8-51bd3cb7e1c7","subject":"ATTACK:enterprise:G0128","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a3990ec1-b4bb-43dd-b7d8-51bd3cb7e1c7","modified":"2026-07-31T18:47:52.393Z","references":[{"source_name":"Google Election Threats October 2020","url":"https://blog.google/threat-analysis-group/how-were-tackling-evolving-online-threats/"},{"source_name":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a53879ca-2185-42ea-84de-823878fb871d","subject":"ATTACK:enterprise:G1016","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a53879ca-2185-42ea-84de-823878fb871d","modified":"2026-07-31T18:48:31.353Z","references":[{"source_name":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source_name":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a69c8555-cd70-40ca-a250-d6e9c57f9279","subject":"ATTACK:enterprise:C0035","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a69c8555-cd70-40ca-a250-d6e9c57f9279","modified":"2026-07-31T18:47:18.320Z","references":[{"source_name":"Lumen KVBotnet 2023","url":"https://blog.lumen.com/routers-roasting-on-an-open-firewall-the-kv-botnet-investigation/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a8126b8d-8dd7-4e12-a384-96dabb975725","subject":"ATTACK:enterprise:S0266","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a8126b8d-8dd7-4e12-a384-96dabb975725","modified":"2026-04-29T14:23:06.154Z","references":[{"source_name":"Cyberreason Anchor December 2019","url":"https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ab372993-3d63-4ca3-a064-e4b5820d8970","subject":"ATTACK:enterprise:S0368","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ab372993-3d63-4ca3-a064-e4b5820d8970","modified":"2026-04-29T14:23:06.158Z","references":[{"source_name":"Talos Nyetya June 2017","url":"https://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aba65eb4-6bd9-40bc-9b06-48b86e9a85e2","subject":"ATTACK:enterprise:C0016","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aba65eb4-6bd9-40bc-9b06-48b86e9a85e2","modified":"2026-07-31T20:48:14.731Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ad880548-e776-4e7b-995d-ce6fdc91e865","subject":"ATTACK:enterprise:G0112","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ad880548-e776-4e7b-995d-ce6fdc91e865","modified":"2026-09-02T18:52:47.111Z","references":[{"source_name":"objective-see windtail1 dec 2018","url":"https://objective-see.com/blog/blog_0x3B.html"},{"source_name":"BlackBerry Bahamut","url":"https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b771894c-366a-4e73-af67-d6d43d2c9881","subject":"ATTACK:enterprise:G1046","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b771894c-366a-4e73-af67-d6d43d2c9881","modified":"2026-07-31T18:47:48.059Z","references":[{"source_name":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--baedd4b3-1fc9-4056-a282-322496a3cceb","subject":"ATTACK:enterprise:T1036.001","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--baedd4b3-1fc9-4056-a282-322496a3cceb","modified":"2026-04-29T14:23:06.180Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bc2fe4e7-cb7c-4707-b28b-a709c2ac017d","subject":"ATTACK:enterprise:S0637","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bc2fe4e7-cb7c-4707-b28b-a709c2ac017d","modified":"2026-04-29T14:23:06.182Z","references":[{"source_name":"SentinelOne NobleBaron June 2021","url":"https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c0ebb63b-b083-4373-9257-8f3fb0d1b856","subject":"ATTACK:enterprise:T1036.012","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c0ebb63b-b083-4373-9257-8f3fb0d1b856","modified":"2026-04-29T14:23:06.189Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c3c1440f-4585-47a6-8864-e5d3a22c2b84","subject":"ATTACK:enterprise:G1035","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c3c1440f-4585-47a6-8864-e5d3a22c2b84","modified":"2026-07-31T18:48:03.269Z","references":[{"source_name":"SentinelOne WinterVivern 2023","url":"https://www.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espionage/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c5fe3e1e-775e-4fe6-8a70-0a7e70835081","subject":"ATTACK:enterprise:S9038","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c5fe3e1e-775e-4fe6-8a70-0a7e70835081","modified":"2026-04-29T14:23:06.196Z","references":[{"source_name":"CERT Polska","url":"https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"},{"source_name":"ESET DynoWiper Update JAN 2026","url":"https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cb88a1a6-33a4-4c1a-a6ad-10b4b5f827dd","subject":"ATTACK:enterprise:S1246","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cb88a1a6-33a4-4c1a-a6ad-10b4b5f827dd","modified":"2026-04-29T14:23:06.203Z","references":[{"source_name":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d4e0558a-83e2-4d99-bc80-aff1bb367724","subject":"ATTACK:enterprise:S0689","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d4e0558a-83e2-4d99-bc80-aff1bb367724","modified":"2026-04-29T14:23:06.216Z","references":[{"source_name":"Medium S2W WhisperGate January 2022","url":"https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dc595175-bd4d-4409-829b-43c42b762647","subject":"ATTACK:enterprise:M1049","predicate":"mitigates","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dc595175-bd4d-4409-829b-43c42b762647","modified":"2026-04-29T14:23:06.226Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ddc5f723-da25-42b0-b281-4cc20d3e8da1","subject":"ATTACK:enterprise:T1036.009","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ddc5f723-da25-42b0-b281-4cc20d3e8da1","modified":"2026-04-29T14:23:06.228Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--df3548d1-800d-4d18-8566-3a5fe925a2ef","subject":"ATTACK:enterprise:S0446","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--df3548d1-800d-4d18-8566-3a5fe925a2ef","modified":"2026-04-29T14:23:06.230Z","references":[{"source_name":"ANSSI RYUK RANSOMWARE","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e67bb9cd-a76c-4666-a3e5-1e466dceb22b","subject":"ATTACK:enterprise:S0673","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e67bb9cd-a76c-4666-a3e5-1e466dceb22b","modified":"2026-04-29T14:23:06.239Z","references":[{"source_name":"Prevailion DarkWatchman 2021","url":"https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ea99ff52-af1e-49af-9cfe-b224c9a9eea4","subject":"ATTACK:enterprise:S0662","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ea99ff52-af1e-49af-9cfe-b224c9a9eea4","modified":"2026-04-29T14:23:06.244Z","references":[{"source_name":"Secureworks BRONZE PRESIDENT December 2019","url":"https://www.secureworks.com/research/bronze-president-targets-ngos"},{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eb5ade8c-73e9-4b69-9dea-c8a8206dec25","subject":"ATTACK:enterprise:M1038","predicate":"mitigates","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eb5ade8c-73e9-4b69-9dea-c8a8206dec25","modified":"2026-04-29T14:23:06.245Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ebfa89db-b37b-4b66-a820-b863bd012b80","subject":"ATTACK:enterprise:S0497","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ebfa89db-b37b-4b66-a820-b863bd012b80","modified":"2026-04-29T14:23:06.246Z","references":[{"source_name":"SentinelOne Lazarus macOS July 2020","url":"https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eca68811-ebe9-4ee0-8fb0-afa5975eb938","subject":"ATTACK:enterprise:S0682","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eca68811-ebe9-4ee0-8fb0-afa5975eb938","modified":"2026-04-29T14:23:06.247Z","references":[{"source_name":"CrowdStrike StellarParticle January 2022","url":"https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ed149b2f-6743-4d06-b869-158c0f96746e","subject":"ATTACK:enterprise:C0018","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ed149b2f-6743-4d06-b869-158c0f96746e","modified":"2026-07-31T18:47:23.321Z","references":[{"source_name":"Cisco Talos Avos Jun 2022","url":"https://blog.talosintelligence.com/avoslocker-new-arsenal/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f09c9f4a-345f-4352-aaba-7b0b0a24085c","subject":"ATTACK:enterprise:S0634","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f09c9f4a-345f-4352-aaba-7b0b0a24085c","modified":"2026-04-29T14:23:06.252Z","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f2a58ddd-c9d8-4769-a93b-2e876e304105","subject":"ATTACK:enterprise:C0015","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f2a58ddd-c9d8-4769-a93b-2e876e304105","modified":"2026-07-31T18:47:25.856Z","references":[{"source_name":"DFIR Conti Bazar Nov 2021","url":"https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f2e075b3-1125-4259-bf0b-1ff90c738354","subject":"ATTACK:enterprise:G0127","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f2e075b3-1125-4259-bf0b-1ff90c738354","modified":"2026-07-31T18:48:10.546Z","references":[{"source_name":"Unit 42 TA551 Jan 2021","url":"https://unit42.paloaltonetworks.com/ta551-shathak-icedid/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f3b19f07-d8a9-4aca-a649-039024997a4f","subject":"ATTACK:enterprise:G0068","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f3b19f07-d8a9-4aca-a649-039024997a4f","modified":"2026-07-31T18:48:28.012Z","references":[{"source_name":"Twitter ItsReallyNick Platinum Masquerade","url":"https://x.com/ItsReallyNick/status/1055321868641689600"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f40170e7-5246-442e-95ad-1b810107b8b8","subject":"ATTACK:enterprise:S0615","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f40170e7-5246-442e-95ad-1b810107b8b8","modified":"2026-04-29T14:23:06.257Z","references":[{"source_name":"CISA AR21-126A FIVEHANDS May 2021","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f981c633-9333-4c7d-a168-7bea28f64d52","subject":"ATTACK:enterprise:S0148","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f981c633-9333-4c7d-a168-7bea28f64d52","modified":"2026-04-29T14:23:06.264Z","references":[{"source_name":"Unit42 Redaman January 2019","url":"https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fd094102-e496-4dcf-bbf1-1630a762019d","subject":"ATTACK:enterprise:S1111","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fd094102-e496-4dcf-bbf1-1630a762019d","modified":"2026-04-29T14:23:06.269Z","references":[{"source_name":"Ensilo Darkgate 2018","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ff7ecfd6-bbe0-4fc6-9ea2-551ff2359157","subject":"ATTACK:enterprise:C0006","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ff7ecfd6-bbe0-4fc6-9ea2-551ff2359157","modified":"2026-07-31T18:47:21.259Z","references":[{"source_name":"McAfee Honeybee","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ffff35dc-3741-4fba-9680-f0fbe321c0b0","subject":"ATTACK:enterprise:S0268","predicate":"uses","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ffff35dc-3741-4fba-9680-f0fbe321c0b0","modified":"2026-04-29T14:23:06.272Z","references":[{"source_name":"Talos Bisonal Mar 2020","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}