{"record":{"id":"ATTACK:enterprise:T1056.001","title":"Keylogging","type":"Subtechnique","source_url":"https://attack.mitre.org/techniques/T1056/001","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--09a60ea3-a8d1-4ae5-976e-5783248b72a4","external_id":"T1056.001","domain":"enterprise","created":"2020-02-11T18:58:11.791Z","modified":"2026-05-12T15:12:00.620Z","version":"1.3","aliases":[],"tactics":["collection","credential-access"],"source_references":[{"source_name":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source_name":"Cisco Blog Legacy Device Attacks","url":"https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954"},{"source_name":"Adventures of a Keystroke","url":"http://opensecuritytraining.info/Keylogging_files/The%20Adventures%20of%20a%20Keystroke.pdf"}]},"assertions":[{"id":"enterprise:relationship--023ff141-8ed7-4132-85a0-494fe075236b","subject":"ATTACK:enterprise:G0059","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--023ff141-8ed7-4132-85a0-494fe075236b","modified":"2026-07-31T18:48:28.001Z","references":[{"source_name":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--034a2bc9-62a9-413f-b167-0b348928eba0","subject":"ATTACK:enterprise:C0014","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--034a2bc9-62a9-413f-b167-0b348928eba0","modified":"2026-07-31T18:47:31.320Z","references":[{"source_name":"FoxIT Wocao December 2019","url":"https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--062874d1-8ca9-400f-8367-670b9c7c3280","subject":"ATTACK:enterprise:S0021","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--062874d1-8ca9-400f-8367-670b9c7c3280","modified":"2026-04-29T14:23:05.911Z","references":[{"source_name":"FireEye Periscope March 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--06e5b331-d382-4864-ab8c-083e006ede8a","subject":"ATTACK:enterprise:S1012","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--06e5b331-d382-4864-ab8c-083e006ede8a","modified":"2026-04-29T14:23:05.913Z","references":[{"source_name":"Cybereason PowerLess February 2022","url":"https://www.cybereason.com/blog/research/powerless-trojan-iranian-apt-phosphorus-adds-new-powershell-backdoor-for-espionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0a37825f-2f48-4810-8d5e-a4421d1fe122","subject":"ATTACK:enterprise:S0643","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0a37825f-2f48-4810-8d5e-a4421d1fe122","modified":"2026-04-29T14:23:05.917Z","references":[{"source_name":"Proofpoint Operation Transparent Tribe March 2016","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0b3b2d98-213c-487f-b526-9336c2ed4555","subject":"ATTACK:enterprise:S0670","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0b3b2d98-213c-487f-b526-9336c2ed4555","modified":"2026-04-29T14:23:05.918Z","references":[{"source_name":"Check Point Warzone Feb 2020","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"},{"source_name":"Uptycs Warzone UAC Bypass November 2020","url":"https://www.uptycs.com/blog/warzone-rat-comes-with-uac-bypass-technique"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0b823cda-4775-4690-9ea6-02bbaa3522a1","subject":"ATTACK:enterprise:S0038","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0b823cda-4775-4690-9ea6-02bbaa3522a1","modified":"2026-06-12T15:51:16.720Z","references":[{"source_name":"Symantec W32.Duqu","url":"https://web.archive.org/web/20111213083345/https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0b9a4cdc-8305-49ec-879f-6cfa35763af2","subject":"ATTACK:enterprise:S0283","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0b9a4cdc-8305-49ec-879f-6cfa35763af2","modified":"2026-04-29T14:23:05.919Z","references":[{"source_name":"jRAT Symantec Aug 2018","url":"https://www.symantec.com/blogs/threat-intelligence/jrat-new-anti-parsing-techniques"},{"source_name":"Kaspersky Adwind Feb 2016","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07195002/KL_AdwindPublicReport_2016.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0c2259d0-2d56-4bbc-bd98-e35ac991b6e8","subject":"ATTACK:enterprise:S0455","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0c2259d0-2d56-4bbc-bd98-e35ac991b6e8","modified":"2026-04-29T14:23:05.920Z","references":[{"source_name":"Fortinet Metamorfo Feb 2020","url":"https://www.fortinet.com/blog/threat-research/another-metamorfo-variant-targeting-customers-of-financial-institutions"},{"source_name":"ESET Casbaneiro Oct 2019","url":"https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0d328be7-85d2-4558-a4e3-cc5ce8bc7e2e","subject":"ATTACK:enterprise:S0045","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0d328be7-85d2-4558-a4e3-cc5ce8bc7e2e","modified":"2026-04-29T14:23:05.921Z","references":[{"source_name":"ESET Sednit Part 2","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"},{"source_name":"Bitdefender APT28 Dec 2015","url":"https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0dc3db64-17d3-4a1e-9f11-5e974d28db4f","subject":"ATTACK:enterprise:S1146","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0dc3db64-17d3-4a1e-9f11-5e974d28db4f","modified":"2026-04-29T14:23:05.922Z","references":[{"source_name":"ESET EvasivePanda 2023","url":"https://www.welivesecurity.com/2023/04/26/evasive-panda-apt-group-malware-updates-popular-chinese-software/"},{"source_name":"Symantec Daggerfly 2023","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0ddcf163-015f-46a2-8de7-375712d92bae","subject":"ATTACK:enterprise:G0087","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0ddcf163-015f-46a2-8de7-375712d92bae","modified":"2026-07-31T18:47:53.068Z","references":[{"source_name":"Symantec Chafer February 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"},{"source_name":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0e58b447-7b3e-404c-b8e5-003734c34574","subject":"ATTACK:enterprise:S0149","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0e58b447-7b3e-404c-b8e5-003734c34574","modified":"2026-04-29T14:23:05.923Z","references":[{"source_name":"Palo Alto MoonWind March 2017","url":"http://researchcenter.paloaltonetworks.com/2017/03/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0fec9b91-cd45-493b-b23e-abb3ed2513a0","subject":"ATTACK:enterprise:S0152","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0fec9b91-cd45-493b-b23e-abb3ed2513a0","modified":"2026-04-29T14:23:05.925Z","references":[{"source_name":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--11ed82c1-88af-4c23-860e-185505389288","subject":"ATTACK:enterprise:S0161","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--11ed82c1-88af-4c23-860e-185505389288","modified":"2026-04-29T14:23:05.928Z","references":[{"source_name":"XAgentOSX 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--14dcdf1b-6788-429d-a7d0-910e86a2e6d6","subject":"ATTACK:enterprise:S0363","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--14dcdf1b-6788-429d-a7d0-910e86a2e6d6","modified":"2026-04-29T14:23:05.932Z","references":[{"source_name":"Github PowerShell Empire","url":"https://github.com/PowerShellEmpire/Empire"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--15d01a81-5d77-4373-81d0-8962e708ad20","subject":"ATTACK:enterprise:S0339","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--15d01a81-5d77-4373-81d0-8962e708ad20","modified":"2026-04-29T14:23:05.934Z","references":[{"source_name":"Radware Micropsia July 2018","url":"https://www.radware.com/blog/security/2018/07/micropsia-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1879905d-a4f6-43a7-aafe-a7e436e5c559","subject":"ATTACK:enterprise:S0113","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1879905d-a4f6-43a7-aafe-a7e436e5c559","modified":"2026-04-29T14:23:05.938Z","references":[{"source_name":"ESET Operation Groundbait","url":"http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1a49c7e5-32b0-4393-a464-1491b1ebc279","subject":"ATTACK:enterprise:G0082","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1a49c7e5-32b0-4393-a464-1491b1ebc279","modified":"2026-07-31T20:48:23.070Z","references":[{"source_name":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1b023598-278c-4a0f-b058-4d169b51f45a","subject":"ATTACK:enterprise:S0410","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1b023598-278c-4a0f-b058-4d169b51f45a","modified":"2026-04-29T14:23:05.941Z","references":[{"source_name":"Fysbis Palo Alto Analysis","url":"https://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1bd467ff-6e94-40c5-ae4d-2ed7c62bc0d5","subject":"ATTACK:enterprise:S0194","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1bd467ff-6e94-40c5-ae4d-2ed7c62bc0d5","modified":"2026-04-29T14:23:05.942Z","references":[{"source_name":"GitHub PowerSploit May 2012","url":"https://github.com/PowerShellMafia/PowerSploit"},{"source_name":"PowerSploit Documentation","url":"http://powersploit.readthedocs.io"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1d65c2d6-6f59-40e4-af56-83ad4d9efea8","subject":"ATTACK:enterprise:S0379","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1d65c2d6-6f59-40e4-af56-83ad4d9efea8","modified":"2026-04-29T14:23:05.945Z","references":[{"source_name":"Cofense RevengeRAT Feb 2019","url":"https://web.archive.org/web/20200428173819/https://cofense.com/upgrades-delivery-support-infrastructure-revenge-rat-malware-bigger-threat/"},{"source_name":"Cylance Shaheen Nov 2018","url":"https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1f02b84e-b79e-402f-b1c1-3f5b5c8bc8c6","subject":"ATTACK:enterprise:G1017","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1f02b84e-b79e-402f-b1c1-3f5b5c8bc8c6","modified":"2026-07-31T18:47:39.817Z","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1f99a883-e78f-423d-9837-2b5ebb14fe63","subject":"ATTACK:enterprise:S0167","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1f99a883-e78f-423d-9837-2b5ebb14fe63","modified":"2026-04-29T14:23:05.948Z","references":[{"source_name":"ClearSky Wilted Tulip July 2017","url":"http://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf"},{"source_name":"CopyKittens Nov 2015","url":"https://cdn2.hubspot.net/hubfs/1903456/Whitepapers/CopyKittens.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1fbd56ed-e8fe-4601-b676-62e42370cbcc","subject":"ATTACK:enterprise:G0130","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1fbd56ed-e8fe-4601-b676-62e42370cbcc","modified":"2026-07-31T18:48:28.019Z","references":[{"source_name":"Check Point Rocket Kitten","url":"https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1ff4d9b1-3a94-4bde-87cf-d4f19ac1ef50","subject":"ATTACK:enterprise:S0381","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1ff4d9b1-3a94-4bde-87cf-d4f19ac1ef50","modified":"2026-04-29T14:23:05.948Z","references":[{"source_name":"Korean FSI TA505 2020","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--23e2dc58-4b8d-48d8-82fd-d051892a7d58","subject":"ATTACK:enterprise:S0148","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--23e2dc58-4b8d-48d8-82fd-d051892a7d58","modified":"2026-04-29T14:23:05.954Z","references":[{"source_name":"ESET RTM Feb 2017","url":"https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"},{"source_name":"Unit42 Redaman January 2019","url":"https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--26339d57-98d9-4323-97e8-03642f82e245","subject":"ATTACK:enterprise:S0454","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--26339d57-98d9-4323-97e8-03642f82e245","modified":"2026-04-29T14:23:05.957Z","references":[{"source_name":"Symantec Chafer Dec 2015","url":"https://www.symantec.com/connect/blogs/iran-based-attackers-use-back-door-threats-spy-middle-eastern-targets"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--28636e59-9685-4b10-8364-11d8f38d6945","subject":"ATTACK:enterprise:S1249","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--28636e59-9685-4b10-8364-11d8f38d6945","modified":"2026-04-29T14:23:05.960Z","references":[{"source_name":"Socket HexEval BeaverTail Contagious Interview June 2025","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--28bde4e9-cc84-4356-a872-b18fc3dd49ab","subject":"ATTACK:enterprise:S0567","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--28bde4e9-cc84-4356-a872-b18fc3dd49ab","modified":"2026-04-29T14:23:05.960Z","references":[{"source_name":"Securelist Dtrack","url":"https://securelist.com/my-name-is-dtrack/93338/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--28d30695-5015-431d-baa6-9e75088a2a83","subject":"ATTACK:enterprise:S0434","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--28d30695-5015-431d-baa6-9e75088a2a83","modified":"2026-04-29T14:23:05.960Z","references":[{"source_name":"Imminent Unit42 Dec2019","url":"https://unit42.paloaltonetworks.com/imminent-monitor-a-rat-down-under/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--29f2ee6a-682d-4812-b7d6-ff00cabf09dc","subject":"ATTACK:enterprise:S0261","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--29f2ee6a-682d-4812-b7d6-ff00cabf09dc","modified":"2026-04-29T14:23:05.962Z","references":[{"source_name":"Symantec Catchamas April 2018","url":"https://web.archive.org/web/20190508165711/https://www-west.symantec.com/content/symantec/english/en/security-center/writeup.html/2018-040209-1742-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2aa0dea4-ca6d-4095-8c20-9250308c3315","subject":"ATTACK:enterprise:S0154","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2aa0dea4-ca6d-4095-8c20-9250308c3315","modified":"2026-04-29T14:23:05.963Z","references":[{"source_name":"cobaltstrike manual","url":"https://web.archive.org/web/20210825130434/https://cobaltstrike.com/downloads/csmanual38.pdf"},{"source_name":"Amnesty Intl. Ocean Lotus February 2021","url":"https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2be17426-9704-4913-981b-6d8fe4471147","subject":"ATTACK:enterprise:S0033","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2be17426-9704-4913-981b-6d8fe4471147","modified":"2026-04-29T14:23:05.964Z","references":[{"source_name":"Kaspersky NetTraveler","url":"https://web.archive.org/web/20160326004042/http://kasperskycontenthub.com/wp-content/uploads/sites/43/vlpdfs/kaspersky-the-net-traveler-part1-final.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2d450e2f-25c9-49af-b83f-6c91029ed28a","subject":"ATTACK:enterprise:G0007","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2d450e2f-25c9-49af-b83f-6c91029ed28a","modified":"2026-07-31T20:48:44.559Z","references":[{"source_name":"Microsoft SIR Vol 19","url":"http://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf"},{"source_name":"TrendMicro Pawn Storm Dec 2020","url":"https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html"},{"source_name":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2ede8fe4-0a44-4c31-ba4c-d3282d57b4b8","subject":"ATTACK:enterprise:S0262","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2ede8fe4-0a44-4c31-ba4c-d3282d57b4b8","modified":"2026-04-29T14:23:05.968Z","references":[{"source_name":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"},{"source_name":"GitHub QuasarRAT","url":"https://github.com/quasar/QuasarRAT"},{"source_name":"Volexity Patchwork June 2018","url":"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2f5f2d31-739e-4dc5-b137-840401985244","subject":"ATTACK:enterprise:S0125","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2f5f2d31-739e-4dc5-b137-840401985244","modified":"2026-04-29T14:23:05.971Z","references":[{"source_name":"Symantec Remsec IOCs","url":"http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/Symantec_Remsec_IOCs.pdf"},{"source_name":"Kaspersky ProjectSauron Technical Analysis","url":"https://securelist.com/files/2016/07/The-ProjectSauron-APT_Technical_Analysis_KL.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--30bbf24a-ee93-46e1-be89-d948f3248c17","subject":"ATTACK:enterprise:S1159","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--30bbf24a-ee93-46e1-be89-d948f3248c17","modified":"2026-04-29T14:23:05.978Z","references":[{"source_name":"Google Cloud APT41 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--33caa1a2-8465-47b9-89c4-94f4e9a899c7","subject":"ATTACK:enterprise:S0072","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--33caa1a2-8465-47b9-89c4-94f4e9a899c7","modified":"2026-04-29T14:23:05.987Z","references":[{"source_name":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3450fcde-caba-4595-b28b-99f18b4a4b7a","subject":"ATTACK:enterprise:S0234","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3450fcde-caba-4595-b28b-99f18b4a4b7a","modified":"2026-04-29T14:23:05.989Z","references":[{"source_name":"BH Manul Aug 2016","url":"https://www.blackhat.com/docs/us-16/materials/us-16-Quintin-When-Governments-Attack-State-Sponsored-Malware-Attacks-Against-Activists-Lawyers-And-Journalists.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--366c4cf9-7ea1-4751-9415-bcd3a1c52b27","subject":"ATTACK:enterprise:S0240","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--366c4cf9-7ea1-4751-9415-bcd3a1c52b27","modified":"2026-04-29T14:23:05.994Z","references":[{"source_name":"Volexity InkySquid RokRAT August 2021","url":"https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"},{"source_name":"Talos ROKRAT","url":"https://blog.talosintelligence.com/2017/04/introducing-rokrat.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--37c94531-1e56-4640-93fd-e9fd65da4f80","subject":"ATTACK:enterprise:G0012","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--37c94531-1e56-4640-93fd-e9fd65da4f80","modified":"2026-07-31T18:48:11.878Z","references":[{"source_name":"Kaspersky Darkhotel","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070903/darkhotel_kl_07.11.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--385f57f4-87b6-4126-ab67-531e482ec9bc","subject":"ATTACK:enterprise:S0019","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--385f57f4-87b6-4126-ab67-531e482ec9bc","modified":"2026-04-29T14:23:05.997Z","references":[{"source_name":"Kaspersky Regin","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070305/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--38f209df-bb69-4971-bbd8-db5a54bbf217","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--38f209df-bb69-4971-bbd8-db5a54bbf217","modified":"2026-04-29T14:23:05.998Z","references":[{"source_name":"CIRCL PlugX March 2013","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--39b38f3b-e878-4bce-967b-59035a528595","subject":"ATTACK:enterprise:S0533","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--39b38f3b-e878-4bce-967b-59035a528595","modified":"2026-04-29T14:23:05.999Z","references":[{"source_name":"CISA MAR SLOTHFULMEDIA October 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3a0c8e81-6110-4cf3-a965-b700e00fd66c","subject":"ATTACK:enterprise:S0414","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3a0c8e81-6110-4cf3-a965-b700e00fd66c","modified":"2026-04-29T14:23:05.999Z","references":[{"source_name":"Unit42 BabyShark Apr 2019","url":"https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3dde25bf-03e8-4842-94cd-d596688c44d9","subject":"ATTACK:enterprise:S0257","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3dde25bf-03e8-4842-94cd-d596688c44d9","modified":"2026-04-29T14:23:06.009Z","references":[{"source_name":"Unit 42 VERMIN Jan 2018","url":"https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3e09a5ce-a6a0-4f03-8c23-a7ebb4dfd74c","subject":"ATTACK:enterprise:S0128","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3e09a5ce-a6a0-4f03-8c23-a7ebb4dfd74c","modified":"2026-04-29T14:23:06.009Z","references":[{"source_name":"Forcepoint Monsoon","url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"},{"source_name":"PaloAlto Patchwork Mar 2018","url":"https://researchcenter.paloaltonetworks.com/2018/03/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/"},{"source_name":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3ef89472-470c-42c9-be01-155efe607b78","subject":"ATTACK:enterprise:S0012","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3ef89472-470c-42c9-be01-155efe607b78","modified":"2026-04-29T14:23:06.011Z","references":[{"source_name":"FireEye Poison Ivy","url":"https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf"},{"source_name":"Symantec Darkmoon Aug 2005","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2005-081910-3934-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--42407045-4fd2-42b0-9686-ba6bbeafcaea","subject":"ATTACK:enterprise:S0652","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--42407045-4fd2-42b0-9686-ba6bbeafcaea","modified":"2026-04-29T14:23:06.015Z","references":[{"source_name":"Kaspersky Ferocious Kitten Jun 2021","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--438f9fb0-bf82-4c72-8fdf-0dbc39bcf4fc","subject":"ATTACK:enterprise:S0595","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--438f9fb0-bf82-4c72-8fdf-0dbc39bcf4fc","modified":"2026-04-29T14:23:06.017Z","references":[{"source_name":"Trendmicro Evolving ThiefQuest 2020","url":"https://www.trendmicro.com/en_us/research/20/g/updates-on-quickly-evolving-thiefquest-macos-malware.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4484ae6e-e546-4033-81c1-fe824f4f3ed3","subject":"ATTACK:enterprise:S1233","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4484ae6e-e546-4033-81c1-fe824f4f3ed3","modified":"2026-04-29T14:23:06.019Z","references":[{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--458eebea-e73b-4417-9ce0-11417f6b0289","subject":"ATTACK:enterprise:S0348","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--458eebea-e73b-4417-9ce0-11417f6b0289","modified":"2026-04-29T14:23:06.020Z","references":[{"source_name":"PaloAlto CardinalRat Apr 2017","url":"https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--49421e3d-7c36-4f68-b7f3-c72442c3d44c","subject":"ATTACK:enterprise:S1235","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--49421e3d-7c36-4f68-b7f3-c72442c3d44c","modified":"2026-04-29T14:23:06.025Z","references":[{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4df0f8e9-5956-4ccf-b603-00c32afee0d0","subject":"ATTACK:enterprise:S0375","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4df0f8e9-5956-4ccf-b603-00c32afee0d0","modified":"2026-04-29T14:23:06.031Z","references":[{"source_name":"Securelist Remexi Jan 2019","url":"https://securelist.com/chafer-used-remexi-malware/89538/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--50001cfb-68b5-423c-9c18-6c26f6daad3f","subject":"ATTACK:enterprise:S0260","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--50001cfb-68b5-423c-9c18-6c26f6daad3f","modified":"2026-04-29T14:23:06.034Z","references":[{"source_name":"ESET InvisiMole June 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5208e38a-0f5c-49cc-ad0e-860a94e21ff5","subject":"ATTACK:enterprise:S1239","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5208e38a-0f5c-49cc-ad0e-860a94e21ff5","modified":"2026-04-29T14:23:06.037Z","references":[{"source_name":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--52278e18-f8b3-4bf1-a5d3-ac819ccfd301","subject":"ATTACK:enterprise:S0213","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--52278e18-f8b3-4bf1-a5d3-ac819ccfd301","modified":"2026-04-29T14:23:06.037Z","references":[{"source_name":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"},{"source_name":"Unit 42 Nokki Oct 2018","url":"https://researchcenter.paloaltonetworks.com/2018/10/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5375b22d-1da8-4178-b728-5b91b6917a5c","subject":"ATTACK:enterprise:S0253","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5375b22d-1da8-4178-b728-5b91b6917a5c","modified":"2026-04-29T14:23:06.039Z","references":[{"source_name":"McAfee Gold Dragon","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--55b5ee19-4623-4c5d-9f8f-1c20a3263af6","subject":"ATTACK:enterprise:S9013","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--55b5ee19-4623-4c5d-9f8f-1c20a3263af6","modified":"2026-04-29T14:23:06.042Z","references":[{"source_name":"Google UNC5221 Ivanti January 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day"},{"source_name":"Picus Security UNC5221 Ivanti May 2025","url":"https://www.picussecurity.com/resource/blog/unc5221-cve-2025-22457-ivanti-connect-secure"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--56694ef7-3ce3-4d8a-914b-71a201dc5921","subject":"ATTACK:enterprise:S0569","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--56694ef7-3ce3-4d8a-914b-71a201dc5921","modified":"2026-04-29T14:23:06.043Z","references":[{"source_name":"CheckPoint Volatile Cedar March 2015","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf"},{"source_name":"ClearSky Lebanese Cedar Jan 2021","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5680146f-fc33-4b3e-bbc0-66a7f74587d3","subject":"ATTACK:enterprise:G0045","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5680146f-fc33-4b3e-bbc0-66a7f74587d3","modified":"2026-07-31T18:47:43.937Z","references":[{"source_name":"District Court of NY APT10 Indictment December 2018","url":"https://www.justice.gov/opa/page/file/1122671/download"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5903c147-70f5-45fe-a63c-418c61566422","subject":"ATTACK:enterprise:S0622","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5903c147-70f5-45fe-a63c-418c61566422","modified":"2026-04-29T14:23:06.046Z","references":[{"source_name":"Malwarebytes Kimsuky June 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"},{"source_name":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5d7243c5-e35d-4547-bfff-bcacefe76122","subject":"ATTACK:enterprise:S1207","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5d7243c5-e35d-4547-bfff-bcacefe76122","modified":"2026-04-29T14:23:06.053Z","references":[{"source_name":"Google XLoader 2017","url":"https://cloud.google.com/blog/topics/threat-intelligence/formbook-malware-distribution-campaigns/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5dcc3242-4a1e-4789-b70e-be6c66534e61","subject":"ATTACK:enterprise:S0115","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5dcc3242-4a1e-4789-b70e-be6c66534e61","modified":"2026-04-29T14:23:06.053Z","references":[{"source_name":"Kaspersky Transparent Tribe August 2020","url":"https://securelist.com/transparent-tribe-part-1/98127/"},{"source_name":"Proofpoint Operation Transparent Tribe March 2016","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"},{"source_name":"Cisco Talos Transparent Tribe Education Campaign July 2022","url":"https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5e2e672a-02d4-4510-a629-942d44a558f1","subject":"ATTACK:enterprise:S0062","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5e2e672a-02d4-4510-a629-942d44a558f1","modified":"2026-04-29T14:23:06.053Z","references":[{"source_name":"DustySky","url":"https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5eac9edf-ec42-4ad9-846e-e36b533fd257","subject":"ATTACK:enterprise:T1056.001","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1056","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5eac9edf-ec42-4ad9-846e-e36b533fd257","modified":"2026-04-29T14:23:06.054Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5f8f4204-228c-49d3-8ec6-863b13038001","subject":"ATTACK:enterprise:S0378","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5f8f4204-228c-49d3-8ec6-863b13038001","modified":"2026-04-29T14:23:06.055Z","references":[{"source_name":"GitHub PoshC2","url":"https://github.com/nettitude/PoshC2_Python"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--612c9ce1-a4d6-45bb-b807-5808207c6c45","subject":"ATTACK:enterprise:S1050","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--612c9ce1-a4d6-45bb-b807-5808207c6c45","modified":"2026-04-29T14:23:06.057Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--61c71926-6802-44e8-9918-d2b3a8b19f94","subject":"ATTACK:enterprise:G1023","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--61c71926-6802-44e8-9918-d2b3a8b19f94","modified":"2026-07-31T18:48:16.932Z","references":[{"source_name":"FireEye Southeast Asia Threat Landscape March 2015","url":"https://web.archive.org/web/20220122121143/https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/rpt-southeast-asia-threat-landscape.pdf"},{"source_name":"Mandiant Advanced Persistent Threats","url":"https://www.mandiant.com/resources/insights/apt-groups"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--61ecf569-fd27-4c61-b1a9-a516fba16fac","subject":"ATTACK:enterprise:G0131","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--61ecf569-fd27-4c61-b1a9-a516fba16fac","modified":"2026-07-31T18:48:18.893Z","references":[{"source_name":"TrendMicro Tonto Team October 2020","url":"https://vb2020.vblocalhost.com/uploads/VB2020-06.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6249eaef-c1bd-4c5f-945c-ce6df3248147","subject":"ATTACK:enterprise:S9020","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6249eaef-c1bd-4c5f-945c-ce6df3248147","modified":"2026-04-29T14:23:06.059Z","references":[{"source_name":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"},{"source_name":"ITOCHU LODEINFO JAN 2024","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"},{"source_name":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--626b1cb2-60a8-4077-913e-1ee4e788cec6","subject":"ATTACK:enterprise:S0337","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--626b1cb2-60a8-4077-913e-1ee4e788cec6","modified":"2026-04-29T14:23:06.059Z","references":[{"source_name":"Unit 42 BadPatch Oct 2017","url":"https://researchcenter.paloaltonetworks.com/2017/10/unit42-badpatch/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6494b2d2-8f8f-4e81-886c-dadd57df6edc","subject":"ATTACK:enterprise:S0447","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6494b2d2-8f8f-4e81-886c-dadd57df6edc","modified":"2026-04-29T14:23:06.062Z","references":[{"source_name":"FSecure Lokibot November 2019","url":"https://www.f-secure.com/v-descs/trojan_w32_lokibot.shtml"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--64eedc04-9dca-4e47-9465-a3d0b51d02f1","subject":"ATTACK:enterprise:S0625","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--64eedc04-9dca-4e47-9465-a3d0b51d02f1","modified":"2026-04-29T14:23:06.062Z","references":[{"source_name":"McAfee Cuba April 2021","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--64fc52d7-7e49-4fda-8193-8e38e8ac1811","subject":"ATTACK:enterprise:S0662","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--64fc52d7-7e49-4fda-8193-8e38e8ac1811","modified":"2026-04-29T14:23:06.062Z","references":[{"source_name":"Profero APT27 December 2020","url":"https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf"},{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--65f57f42-9784-4ca2-8192-bfa90ffc075f","subject":"ATTACK:enterprise:S0387","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--65f57f42-9784-4ca2-8192-bfa90ffc075f","modified":"2026-04-29T14:23:06.064Z","references":[{"source_name":"Rapid7 KeyBoy Jun 2013","url":"https://blog.rapid7.com/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6672498e-4e40-4f1a-b469-fa7fc05ee68a","subject":"ATTACK:enterprise:S1245","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6672498e-4e40-4f1a-b469-fa7fc05ee68a","modified":"2026-04-29T14:23:06.064Z","references":[{"source_name":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--668b180d-a227-4585-98ee-55dddd6eea92","subject":"ATTACK:enterprise:S1122","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--668b180d-a227-4585-98ee-55dddd6eea92","modified":"2026-04-29T14:23:06.064Z","references":[{"source_name":"ESET Security Mispadu Facebook Ads 2019","url":"https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/"},{"source_name":"Metabase Q Mispadu Trojan 2023","url":"https://www.metabaseq.com/mispadu-banking-trojan/"},{"source_name":"SCILabs URSA/Mispadu Evolution 2023","url":"https://blog.scilabs.mx/en/evolution-of-banking-trojan-ursa-mispadu/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--699ac754-3f3e-46de-9b2a-5ea450ef47fd","subject":"ATTACK:enterprise:S0170","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--699ac754-3f3e-46de-9b2a-5ea450ef47fd","modified":"2026-04-29T14:23:06.069Z","references":[{"source_name":"Palo Alto OilRig May 2016","url":"http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6b5c6fc2-615a-46fc-80a4-9ab332159722","subject":"ATTACK:enterprise:G0027","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6b5c6fc2-615a-46fc-80a4-9ab332159722","modified":"2026-07-31T18:48:29.086Z","references":[{"source_name":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source_name":"Hacker News LuckyMouse June 2018","url":"https://thehackernews.com/2018/06/chinese-watering-hole-attack.html"},{"source_name":"Securelist LuckyMouse June 2018","url":"https://securelist.com/luckymouse-hits-national-data-center/86083/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6d2d4146-bf9e-4b75-9a23-052c09e99eeb","subject":"ATTACK:enterprise:S0050","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6d2d4146-bf9e-4b75-9a23-052c09e99eeb","modified":"2026-04-29T14:23:06.074Z","references":[{"source_name":"F-Secure The Dukes","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6de0bf91-2034-4821-b231-795aa75db97f","subject":"ATTACK:enterprise:S0373","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6de0bf91-2034-4821-b231-795aa75db97f","modified":"2026-04-29T14:23:06.075Z","references":[{"source_name":"Cofense Astaroth Sept 2018","url":"https://web.archive.org/web/20200302071436/https://cofense.com/seeing-resurgence-demonic-astaroth-wmic-trojan/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6ea21ff2-85d8-4c2f-a6b9-10a6e32814e5","subject":"ATTACK:enterprise:S0649","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6ea21ff2-85d8-4c2f-a6b9-10a6e32814e5","modified":"2026-04-29T14:23:06.076Z","references":[{"source_name":"FireEye Shining A Light on DARKSIDE May 2021","url":"https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"},{"source_name":"FireEye SMOKEDHAM June 2021","url":"https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6f3aca10-b419-4cfe-bbb8-06e3973e6c0e","subject":"ATTACK:enterprise:S9017","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6f3aca10-b419-4cfe-bbb8-06e3973e6c0e","modified":"2026-04-29T14:23:06.077Z","references":[{"source_name":"Zscaler BlindEagle DEC 2025","url":"https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7808fe28-aa6f-4e81-9029-8b95bec15ad3","subject":"ATTACK:enterprise:S0094","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7808fe28-aa6f-4e81-9029-8b95bec15ad3","modified":"2026-04-29T14:23:06.089Z","references":[{"source_name":"Secureworks Karagany July 2019","url":"https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--78da5fc8-6f66-43a5-8ad4-c9c79b506408","subject":"ATTACK:enterprise:S0201","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--78da5fc8-6f66-43a5-8ad4-c9c79b506408","modified":"2026-04-29T14:23:06.090Z","references":[{"source_name":"Microsoft PLATINUM April 2016","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7a30e6e7-ed64-47b1-b368-c1cec96d5fbf","subject":"ATTACK:enterprise:S0018","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7a30e6e7-ed64-47b1-b368-c1cec96d5fbf","modified":"2026-04-29T14:23:06.092Z","references":[{"source_name":"Alienvault Sykipot DOD Smart Cards","url":"https://www.alienvault.com/open-threat-exchange/blog/sykipot-variant-hijacks-dod-and-windows-smart-cards"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7b1b450f-eda2-499e-8133-dbaddea8059f","subject":"ATTACK:enterprise:S1111","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7b1b450f-eda2-499e-8133-dbaddea8059f","modified":"2026-04-29T14:23:06.094Z","references":[{"source_name":"Ensilo Darkgate 2018","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"},{"source_name":"Rapid7 BlackBasta 2024","url":"https://www.rapid7.com/blog/post/2024/12/04/black-basta-ransomware-campaign-drops-zbot-darkgate-and-custom-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7b25dfb3-e1f5-4f75-94b3-a465e7f76cfb","subject":"ATTACK:enterprise:S1044","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7b25dfb3-e1f5-4f75-94b3-a465e7f76cfb","modified":"2026-04-29T14:23:06.094Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7b88429e-9024-442f-a40c-d9ea5d0320e1","subject":"ATTACK:enterprise:S1066","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7b88429e-9024-442f-a40c-d9ea5d0320e1","modified":"2026-04-29T14:23:06.095Z","references":[{"source_name":"Secureworks DarkTortilla Aug 2022","url":"https://www.secureworks.com/research/darktortilla-malware-analysis"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7d086d88-59d1-444a-a766-ef52216625ff","subject":"ATTACK:enterprise:S0437","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7d086d88-59d1-444a-a766-ef52216625ff","modified":"2026-04-29T14:23:06.096Z","references":[{"source_name":"TrendMicro BlackTech June 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7f695d14-17e1-46c6-92eb-7c2f57fc6553","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7f695d14-17e1-46c6-92eb-7c2f57fc6553","modified":"2026-07-31T20:48:46.919Z","references":[{"source_name":"Novetta Blockbuster Tools","url":"https://web.archive.org/web/20220425194457/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--80a95235-abd0-4911-abca-91ec1f7e27d3","subject":"ATTACK:enterprise:S0531","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--80a95235-abd0-4911-abca-91ec1f7e27d3","modified":"2026-04-29T14:23:06.101Z","references":[{"source_name":"ESET Grandoreiro April 2020","url":"https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--811d0ef6-047f-4813-801e-33ebf1cae22a","subject":"ATTACK:enterprise:S0192","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--811d0ef6-047f-4813-801e-33ebf1cae22a","modified":"2026-04-29T14:23:06.102Z","references":[{"source_name":"GitHub Pupy","url":"https://github.com/n1nj4sec/pupy"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--82384148-90fd-4bfa-a734-e9c8b37b584f","subject":"ATTACK:enterprise:S0030","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--82384148-90fd-4bfa-a734-e9c8b37b584f","modified":"2026-04-29T14:23:06.103Z","references":[{"source_name":"Kaspersky Carbanak","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf"},{"source_name":"FireEye CARBANAK June 2017","url":"https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8447c89e-a743-430e-8ef5-41abfcde1a01","subject":"ATTACK:enterprise:G0043","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8447c89e-a743-430e-8ef5-41abfcde1a01","modified":"2026-07-31T18:48:02.518Z","references":[{"source_name":"Citizen Lab Group5","url":"https://citizenlab.ca/2016/08/group5-syria/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8907c952-38f8-49de-900d-4f2fa0c485c1","subject":"ATTACK:enterprise:S0338","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8907c952-38f8-49de-900d-4f2fa0c485c1","modified":"2026-04-29T14:23:06.112Z","references":[{"source_name":"Zscaler Cobian Aug 2017","url":"https://www.zscaler.com/blogs/research/cobian-rat-backdoored-rat"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--891217a4-3822-4345-b77f-448f41fd9361","subject":"ATTACK:enterprise:S0331","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--891217a4-3822-4345-b77f-448f41fd9361","modified":"2026-04-29T14:23:06.112Z","references":[{"source_name":"Talos Agent Tesla Oct 2018","url":"https://blog.talosintelligence.com/2018/10/old-dog-new-tricks-analysing-new-rtf_15.html"},{"source_name":"DigiTrust Agent Tesla Jan 2017","url":"https://www.digitrustgroup.com/agent-tesla-keylogger/"},{"source_name":"Fortinet Agent Tesla June 2017","url":"https://www.fortinet.com/blog/threat-research/in-depth-analysis-of-net-malware-javaupdtr.html"},{"source_name":"Bitdefender Agent Tesla April 2020","url":"https://labs.bitdefender.com/2020/04/oil-gas-spearphishing-campaigns-drop-agent-tesla-spyware-in-advance-of-historic-opec-deal/"},{"source_name":"SentinelLabs Agent Tesla Aug 2020","url":"https://labs.sentinelone.com/agent-tesla-old-rat-uses-new-tricks-to-stay-on-top/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8ba987a9-3a03-4996-8fb7-80f34a35f406","subject":"ATTACK:enterprise:G0068","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8ba987a9-3a03-4996-8fb7-80f34a35f406","modified":"2026-07-31T18:48:27.912Z","references":[{"source_name":"Microsoft PLATINUM April 2016","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8cac77c8-0a5f-4950-8217-e280f3b16bd7","subject":"ATTACK:enterprise:S1226","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8cac77c8-0a5f-4950-8217-e280f3b16bd7","modified":"2026-04-29T14:23:06.117Z","references":[{"source_name":"Unit42 Bookworm Nov2015","url":"https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8cb59548-2e8d-4635-809b-b9ba22c94c31","subject":"ATTACK:enterprise:G0085","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8cb59548-2e8d-4635-809b-b9ba22c94c31","modified":"2026-07-31T20:48:48.772Z","references":[{"source_name":"FireEye Hacking FIN4 Video Dec 2014","url":"https://www2.fireeye.com/WBNR-14Q4NAMFIN4.html"},{"source_name":"FireEye Hacking FIN4 Dec 2014","url":"https://web.archive.org/web/20220313062515/https://www.mandiant.com/sites/default/files/2021-09/rpt-fin4.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8d4effdd-6d91-473d-aa81-d121f1c77881","subject":"ATTACK:enterprise:S0058","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8d4effdd-6d91-473d-aa81-d121f1c77881","modified":"2026-04-29T14:23:06.118Z","references":[{"source_name":"Baumgartner Naikon 2015","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--954961e4-0bf5-496e-b200-e63d99c006de","subject":"ATTACK:enterprise:S0023","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--954961e4-0bf5-496e-b200-e63d99c006de","modified":"2026-04-29T14:23:06.128Z","references":[{"source_name":"Crowdstrike DNC June 2016","url":"https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"},{"source_name":"ESET Sednit Part 2","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"},{"source_name":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9631e908-4538-4d61-943f-2b682e72b903","subject":"ATTACK:enterprise:S1090","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9631e908-4538-4d61-943f-2b682e72b903","modified":"2026-04-29T14:23:06.130Z","references":[{"source_name":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--96c1ab08-b165-447b-afa7-5c1d30cd6219","subject":"ATTACK:enterprise:G0034","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--96c1ab08-b165-447b-afa7-5c1d30cd6219","modified":"2026-07-31T20:48:33.116Z","references":[{"source_name":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--96f31a7f-76d9-4aa6-81b7-cc4656213657","subject":"ATTACK:enterprise:S0660","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--96f31a7f-76d9-4aa6-81b7-cc4656213657","modified":"2026-04-29T14:23:06.131Z","references":[{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"},{"source_name":"Talent-Jump Clambling February 2020","url":"https://www.talent-jump.com/article/2020/02/17/CLAMBLING-A-New-Backdoor-Base-On-Dropbox-en/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--97e7c5ec-8f7e-48a8-9ef4-f736e6e481bf","subject":"ATTACK:enterprise:S1149","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--97e7c5ec-8f7e-48a8-9ef4-f736e6e481bf","modified":"2026-04-29T14:23:06.132Z","references":[{"source_name":"Mandiant ROADSWEEP August 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9818eeca-be12-4dd3-bf9f-e33d5b409248","subject":"ATTACK:enterprise:S0247","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9818eeca-be12-4dd3-bf9f-e33d5b409248","modified":"2026-04-29T14:23:06.132Z","references":[{"source_name":"Talos NavRAT May 2018","url":"https://blog.talosintelligence.com/2018/05/navrat.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9e300a25-28f0-4373-939c-16d4d27577af","subject":"ATTACK:enterprise:S0385","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9e300a25-28f0-4373-939c-16d4d27577af","modified":"2026-04-29T14:23:06.141Z","references":[{"source_name":"Fidelis njRAT June 2013","url":"https://www.threatminer.org/_reports/2013/fta-1009---njrat-uncovered-1.pdf"},{"source_name":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"},{"source_name":"Trend Micro njRAT 2018","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/autoit-compiled-worm-affecting-removable-media-delivers-fileless-version-of-bladabindi-njrat-backdoor/"},{"source_name":"Citizen Lab Group5","url":"https://citizenlab.ca/2016/08/group5-syria/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a09b9e3f-96b8-4fde-9f7d-261b449cdabd","subject":"ATTACK:enterprise:S0336","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a09b9e3f-96b8-4fde-9f7d-261b449cdabd","modified":"2026-04-29T14:23:06.144Z","references":[{"source_name":"PaloAlto NanoCore Feb 2016","url":"https://researchcenter.paloaltonetworks.com/2016/02/nanocorerat-behind-an-increase-in-tax-themed-phishing-e-mails/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a1596d76-9ade-4acb-a570-2515f69a706e","subject":"ATTACK:enterprise:S0279","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a1596d76-9ade-4acb-a570-2515f69a706e","modified":"2026-04-29T14:23:06.145Z","references":[{"source_name":"objsee mac malware 2017","url":"https://objective-see.com/blog/blog_0x25.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a5c8b6af-8685-4068-8046-122bbd5f8845","subject":"ATTACK:enterprise:S0409","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a5c8b6af-8685-4068-8046-122bbd5f8845","modified":"2026-04-29T14:23:06.151Z","references":[{"source_name":"ESET Machete July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"},{"source_name":"Securelist Machete Aug 2014","url":"https://securelist.com/el-machete/66108/"},{"source_name":"Cylance Machete Mar 2017","url":"https://threatvector.cylance.com/en_us/home/el-machete-malware-attacks-cut-through-latam.html"},{"source_name":"360 Machete Sep 2020","url":"https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a70ec2cc-5eeb-41c3-8dd3-2816a9010104","subject":"ATTACK:enterprise:G0094","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a70ec2cc-5eeb-41c3-8dd3-2816a9010104","modified":"2026-07-31T20:48:25.302Z","references":[{"source_name":"EST Kimsuky April 2019","url":"https://blog.alyac.co.kr/2234"},{"source_name":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source_name":"Netscout Stolen Pencil Dec 2018","url":"https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/"},{"source_name":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"},{"source_name":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source_name":"Securelist Kimsuky Sept 2013","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"},{"source_name":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a8d7e4da-53d8-45c2-8c87-70424d96a949","subject":"ATTACK:enterprise:G0049","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a8d7e4da-53d8-45c2-8c87-70424d96a949","modified":"2026-07-31T20:48:35.751Z","references":[{"source_name":"FireEye APT34 July 2019","url":"https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"},{"source_name":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"},{"source_name":"Symantec Crambus OCT 2023","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a9ebd162-da0a-4582-ba63-6bb54e165730","subject":"ATTACK:enterprise:S0438","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a9ebd162-da0a-4582-ba63-6bb54e165730","modified":"2026-04-29T14:23:06.156Z","references":[{"source_name":"ESET Attor Oct 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aaf34dd8-3ce7-4c6a-b4f1-c87dc7262e9f","subject":"ATTACK:enterprise:G1044","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aaf34dd8-3ce7-4c6a-b4f1-c87dc7262e9f","modified":"2026-07-31T18:48:16.362Z","references":[{"source_name":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ab7faed6-3c50-4b04-a31b-ac2c933a51ef","subject":"ATTACK:enterprise:S0070","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ab7faed6-3c50-4b04-a31b-ac2c933a51ef","modified":"2026-04-29T14:23:06.158Z","references":[{"source_name":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ae1600d0-8271-4709-a1a6-6fb62494fa23","subject":"ATTACK:enterprise:G0054","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ae1600d0-8271-4709-a1a6-6fb62494fa23","modified":"2026-07-31T18:48:21.290Z","references":[{"source_name":"Symantec Sowbug Nov 2017","url":"https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b2f180de-6c03-41cd-a6ed-a49ac674740b","subject":"ATTACK:enterprise:S0248","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b2f180de-6c03-41cd-a6ed-a49ac674740b","modified":"2026-04-29T14:23:06.170Z","references":[{"source_name":"ASERT Donot March 2018","url":"https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b5a39593-27ad-44dc-99f9-fcadc6d464ed","subject":"ATTACK:enterprise:S1016","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b5a39593-27ad-44dc-99f9-fcadc6d464ed","modified":"2026-04-29T14:23:06.173Z","references":[{"source_name":"SentinelOne MacMa Nov 2021","url":"https://www.sentinelone.com/labs/infect-if-needed-a-deeper-dive-into-targeted-backdoor-macos-macma/"},{"source_name":"Objective-See MacMa Nov 2021","url":"https://objective-see.org/blog/blog_0x69.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bbd9b8d7-431c-44fa-95ac-61f73271ae92","subject":"ATTACK:enterprise:S0089","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bbd9b8d7-431c-44fa-95ac-61f73271ae92","modified":"2026-04-29T14:23:06.182Z","references":[{"source_name":"Securelist BlackEnergy Nov 2014","url":"https://securelist.com/be2-custom-plugins-router-abuse-and-target-profiles/67353/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bc215902-f577-4968-8447-b4a22432b1c2","subject":"ATTACK:enterprise:S0593","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bc215902-f577-4968-8447-b4a22432b1c2","modified":"2026-04-29T14:23:06.182Z","references":[{"source_name":"CISA EB Aug 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-239a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--becf0a5e-4636-4d2f-bd4a-fd60b15ee74a","subject":"ATTACK:enterprise:S0032","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--becf0a5e-4636-4d2f-bd4a-fd60b15ee74a","modified":"2026-04-29T14:23:06.186Z","references":[{"source_name":"Alintanahin 2014","url":"http://blog.trendmicro.com/trendlabs-security-intelligence/kunming-attack-leads-to-gh0st-rat-variant/"},{"source_name":"Gh0stRAT ATT March 2019","url":"https://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bfd49393-75b6-4e67-af74-4bf3c87624b0","subject":"ATTACK:enterprise:S0076","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bfd49393-75b6-4e67-af74-4bf3c87624b0","modified":"2026-04-29T14:23:06.188Z","references":[{"source_name":"Scarlet Mimic Jan 2016","url":"http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c1ed0848-df59-4cd1-8e39-a0d87002c652","subject":"ATTACK:enterprise:S0198","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c1ed0848-df59-4cd1-8e39-a0d87002c652","modified":"2026-04-29T14:23:06.190Z","references":[{"source_name":"FireEye APT33 Webinar Sept 2017","url":"https://www.brighttalk.com/webcast/10703/275683"},{"source_name":"Red Canary NETWIRE January 2020","url":"https://redcanary.com/blog/netwire-remote-access-trojan-on-linux/"},{"source_name":"FireEye NETWIRE March 2019","url":"https://www.mandiant.com/resources/blog/dissecting-netwire-phishing-campaigns-usage-process-hollowing"},{"source_name":"McAfee Netwire Mar 2015","url":"https://securingtomorrow.mcafee.com/mcafee-labs/netwire-rat-behind-recent-targeted-attacks/"},{"source_name":"Proofpoint NETWIRE December 2020","url":"https://www.proofpoint.com/us/blog/threat-insight/geofenced-netwire-campaigns"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c50fd202-d4af-4157-b368-b4525af075c1","subject":"ATTACK:enterprise:S0332","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c50fd202-d4af-4157-b368-b4525af075c1","modified":"2026-04-29T14:23:06.194Z","references":[{"source_name":"Fortinet Remcos Feb 2017","url":"https://www.fortinet.com/blog/threat-research/remcos-a-new-rat-in-the-wild-2.html"},{"source_name":"Talos Remcos Aug 2018","url":"https://blog.talosintelligence.com/2018/08/picking-apart-remcos.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c6051e93-2d02-4890-bb0d-d0f3c8be8d15","subject":"ATTACK:enterprise:S0650","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c6051e93-2d02-4890-bb0d-d0f3c8be8d15","modified":"2026-04-29T14:23:06.196Z","references":[{"source_name":"Kaspersky QakBot September 2021","url":"https://securelist.com/qakbot-technical-analysis/103931/"},{"source_name":"Kroll Qakbot June 2020","url":"https://www.kroll.com/en/insights/publications/cyber/qakbot-malware-exfiltrating-emails-thread-hijacking-attacks"},{"source_name":"Trend Micro Qakbot December 2020","url":"https://success.trendmicro.com/en-US/solution/KA-0011282"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ce4bf5bc-4935-429b-843e-3232fb810e90","subject":"ATTACK:enterprise:S0342","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ce4bf5bc-4935-429b-843e-3232fb810e90","modified":"2026-04-29T14:23:06.207Z","references":[{"source_name":"ESET GreyEnergy Oct 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cecdfe74-68df-4008-8d83-226d0de77782","subject":"ATTACK:enterprise:G1001","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cecdfe74-68df-4008-8d83-226d0de77782","modified":"2026-07-31T20:48:51.910Z","references":[{"source_name":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"},{"source_name":"SecureWorks August 2019","url":"https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d2aa3c9f-0f1f-49ff-81ef-94e229f7c6e2","subject":"ATTACK:enterprise:C0028","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d2aa3c9f-0f1f-49ff-81ef-94e229f7c6e2","modified":"2026-08-04T20:48:45.170Z","references":[{"source_name":"Booz Allen Hamilton","url":"https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"},{"source_name":"Ukraine15 - EISAC - 201603","url":"https://nsarchive.gwu.edu/sites/default/files/documents/3891751/SANS-and-Electricity-Information-Sharing-and.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d2bc1c1b-987b-4a1a-b488-8199f8113697","subject":"ATTACK:enterprise:S0187","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d2bc1c1b-987b-4a1a-b488-8199f8113697","modified":"2026-04-29T14:23:06.214Z","references":[{"source_name":"Trend Micro Daserf Nov 2017","url":"http://blog.trendmicro.com/trendlabs-security-intelligence/redbaldknight-bronze-butler-daserf-backdoor-now-using-steganography/"},{"source_name":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d8f5283b-fe44-4206-8a7d-393d216beb7e","subject":"ATTACK:enterprise:S0004","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d8f5283b-fe44-4206-8a7d-393d216beb7e","modified":"2026-04-29T14:23:06.221Z","references":[{"source_name":"Cylance Cleaver","url":"https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d96d964f-fec6-475e-acc5-d25ff0d46af9","subject":"ATTACK:enterprise:S0439","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d96d964f-fec6-475e-acc5-d25ff0d46af9","modified":"2026-04-29T14:23:06.222Z","references":[{"source_name":"ESET Okrum July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--da288184-6537-4a23-b26e-e4329690bddb","subject":"ATTACK:enterprise:S0334","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--da288184-6537-4a23-b26e-e4329690bddb","modified":"2026-04-29T14:23:06.223Z","references":[{"source_name":"TrendMicro DarkComet Sept 2014","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/DARKCOMET"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dc8bedf8-c6fe-4b99-bde0-db676ba35a91","subject":"ATTACK:enterprise:G0050","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dc8bedf8-c6fe-4b99-bde0-db676ba35a91","modified":"2026-07-31T18:47:45.665Z","references":[{"source_name":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--de045bf6-5f26-485b-ab6d-74552b0cded9","subject":"ATTACK:enterprise:C0029","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--de045bf6-5f26-485b-ab6d-74552b0cded9","modified":"2026-07-31T18:47:23.481Z","references":[{"source_name":"Volexity Ivanti Zero-Day Exploitation January 2024","url":"https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--de539175-4740-4d78-a46d-5555be905dcf","subject":"ATTACK:enterprise:S0673","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--de539175-4740-4d78-a46d-5555be905dcf","modified":"2026-04-29T14:23:06.228Z","references":[{"source_name":"Prevailion DarkWatchman 2021","url":"https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--df0784ed-8411-4215-bebc-51c6ac3bf5df","subject":"ATTACK:enterprise:S0330","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--df0784ed-8411-4215-bebc-51c6ac3bf5df","modified":"2026-04-29T14:23:06.229Z","references":[{"source_name":"GDATA Zeus Panda June 2017","url":"https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dfe16a67-5f63-40a8-9f60-2d0313e55e46","subject":"ATTACK:enterprise:S0017","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dfe16a67-5f63-40a8-9f60-2d0313e55e46","modified":"2026-04-29T14:23:06.230Z","references":[{"source_name":"Mandiant APT1 Appendix","url":"https://www.mandiant.com/sites/default/files/2021-09/mandiant-apt1-report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e39aaec3-2473-4986-9278-eb1e880d127d","subject":"ATTACK:enterprise:S1059","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e39aaec3-2473-4986-9278-eb1e880d127d","modified":"2026-04-29T14:23:06.235Z","references":[{"source_name":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"},{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e45cdf20-e182-4346-8c98-a48575282ae6","subject":"ATTACK:enterprise:S0088","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e45cdf20-e182-4346-8c98-a48575282ae6","modified":"2026-04-29T14:23:06.236Z","references":[{"source_name":"Zscaler Kasidet","url":"http://research.zscaler.com/2016/01/malicious-office-files-dropping-kasidet.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e6884060-8245-46ff-b71f-025c6a82eb3f","subject":"ATTACK:enterprise:S0282","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e6884060-8245-46ff-b71f-025c6a82eb3f","modified":"2026-04-29T14:23:06.239Z","references":[{"source_name":"objsee mac malware 2017","url":"https://objective-see.com/blog/blog_0x25.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e6a21902-3d34-444c-a528-f86b764375e9","subject":"ATTACK:enterprise:S0692","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e6a21902-3d34-444c-a528-f86b764375e9","modified":"2026-04-29T14:23:06.239Z","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e77c6605-41e9-470f-80fc-2a383aeccc5e","subject":"ATTACK:enterprise:S0356","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e77c6605-41e9-470f-80fc-2a383aeccc5e","modified":"2026-04-29T14:23:06.240Z","references":[{"source_name":"Talos Konni May 2017","url":"https://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e7e2eed9-ef15-4b6b-890b-72d2b47ca685","subject":"ATTACK:enterprise:S0526","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e7e2eed9-ef15-4b6b-890b-72d2b47ca685","modified":"2026-04-29T14:23:06.241Z","references":[{"source_name":"Cybereason Kimsuky November 2020","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ecde1551-bca2-4f45-8692-cbc583cf3d4f","subject":"ATTACK:enterprise:S0130","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ecde1551-bca2-4f45-8692-cbc583cf3d4f","modified":"2026-04-29T14:23:06.247Z","references":[{"source_name":"Forcepoint Monsoon","url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ed283e07-a029-4d23-aa8f-55f92abb5203","subject":"ATTACK:enterprise:G0022","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ed283e07-a029-4d23-aa8f-55f92abb5203","modified":"2026-07-31T18:47:38.269Z","references":[{"source_name":"Symantec Buckeye","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eda8746d-ef63-450b-ab75-c2c97d94db44","subject":"ATTACK:enterprise:S0467","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eda8746d-ef63-450b-ab75-c2c97d94db44","modified":"2026-04-29T14:23:06.248Z","references":[{"source_name":"Kaspersky TajMahal April 2019","url":"https://securelist.com/project-tajmahal/90240/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ee3648f7-1066-4a85-9652-2ce54fc7964a","subject":"ATTACK:enterprise:G1016","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ee3648f7-1066-4a85-9652-2ce54fc7964a","modified":"2026-07-31T18:48:31.558Z","references":[{"source_name":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f0a91093-3827-49b0-82c4-a1c882f074cf","subject":"ATTACK:enterprise:S0412","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f0a91093-3827-49b0-82c4-a1c882f074cf","modified":"2026-04-29T14:23:06.252Z","references":[{"source_name":"Talos ZxShell Oct 2014","url":"https://blogs.cisco.com/security/talos/opening-zxshell"},{"source_name":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f39446a9-07d1-456a-b48b-241aab979e55","subject":"ATTACK:enterprise:G0004","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f39446a9-07d1-456a-b48b-241aab979e55","modified":"2026-07-31T18:48:01.844Z","references":[{"source_name":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"},{"source_name":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f4480854-9424-49d5-8b54-f839302e3ee7","subject":"ATTACK:enterprise:S0090","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f4480854-9424-49d5-8b54-f839302e3ee7","modified":"2026-04-29T14:23:06.257Z","references":[{"source_name":"Palo Alto Rover","url":"http://researchcenter.paloaltonetworks.com/2016/02/new-malware-rover-targets-indian-ambassador-to-afghanistan/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f480c10c-6a40-4fc7-9380-c2690c70a599","subject":"ATTACK:enterprise:G0096","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f480c10c-6a40-4fc7-9380-c2690c70a599","modified":"2026-07-31T20:48:27.667Z","references":[{"source_name":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f8999244-37ea-40f1-aa90-444a676dd592","subject":"ATTACK:enterprise:S1087","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f8999244-37ea-40f1-aa90-444a676dd592","modified":"2026-04-29T14:23:06.263Z","references":[{"source_name":"AsyncRAT GitHub","url":"https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp/blob/master/README.md"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fac88cac-2935-4c68-af9f-c16fb93d6eac","subject":"ATTACK:enterprise:S0428","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fac88cac-2935-4c68-af9f-c16fb93d6eac","modified":"2026-04-29T14:23:06.265Z","references":[{"source_name":"Talos PoetRAT April 2020","url":"https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}