{"record":{"id":"ATTACK:enterprise:T1057","title":"Process Discovery","type":"Technique","source_url":"https://attack.mitre.org/techniques/T1057","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--8f4a33ec-8b1f-4b80-a2f6-642b2e479580","external_id":"T1057","domain":"enterprise","created":"2017-05-31T21:30:48.728Z","modified":"2026-09-11T19:40:13.112Z","version":"1.6","aliases":[],"tactics":["discovery"],"source_references":[{"source_name":"show_processes_cisco_cmd","url":"https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/show_monitor_permit_list_through_show_process_memory.html#wp3599497760"},{"source_name":"Crowdstrike Hypervisor Jackpotting Pt 2 2021","url":"https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/"},{"source_name":"US-CERT-TA18-106A","url":"https://www.us-cert.gov/ncas/alerts/TA18-106A"},{"source_name":"Sygnia ESXi Ransomware 2025","url":"https://www.sygnia.co/blog/esxi-ransomware-ssh-tunneling-defense-strategies/"}]},"assertions":[{"id":"enterprise:relationship--01f98d14-77b9-439f-8b44-920fcaca2b2b","subject":"ATTACK:enterprise:S0091","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--01f98d14-77b9-439f-8b44-920fcaca2b2b","modified":"2026-04-29T14:23:05.905Z","references":[{"source_name":"Kaspersky Turla","url":"https://securelist.com/the-epic-turla-operation/65545/"},{"source_name":"Kaspersky Turla Aug 2014","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08080105/KL_Epic_Turla_Technical_Appendix_20140806.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--029f4f57-f14b-47c3-9c34-afe3c2e465ae","subject":"ATTACK:enterprise:S9024","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--029f4f57-f14b-47c3-9c34-afe3c2e465ae","modified":"2026-04-29T14:23:05.906Z","references":[{"source_name":"CISA SPAWNCHIMERA RESURGE February 2026","url":"https://www.cisa.gov/news-events/analysis-reports/ar25-087a"},{"source_name":"Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--057815bb-550c-4e00-bfdb-c7e4bf6461cb","subject":"ATTACK:enterprise:S0670","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--057815bb-550c-4e00-bfdb-c7e4bf6461cb","modified":"2026-04-29T14:23:05.911Z","references":[{"source_name":"Check Point Warzone Feb 2020","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--058c67f3-9345-42be-a433-a4cea314d26d","subject":"ATTACK:enterprise:S0267","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--058c67f3-9345-42be-a433-a4cea314d26d","modified":"2026-04-29T14:23:05.911Z","references":[{"source_name":"ESET GreyEnergy Oct 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--06f0aaf3-c2ff-4d54-8279-2e7f66b5d819","subject":"ATTACK:enterprise:C0056","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--06f0aaf3-c2ff-4d54-8279-2e7f66b5d819","modified":"2026-07-31T18:47:19.800Z","references":[{"source_name":"Juniper RedPenguin MAR 2025","url":"https://supportportal.juniper.net/sfc/servlet.shepherd/document/download/069Dp00000FzdmIIAR?operationContext=S1"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--07e77aac-6518-41d9-9330-7df48651933b","subject":"ATTACK:enterprise:S9020","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--07e77aac-6518-41d9-9330-7df48651933b","modified":"2026-04-29T14:23:05.914Z","references":[{"source_name":"Kaspersky LODEINFO Part II OCT 2022","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-ii/107745/"},{"source_name":"ITOCHU LODEINFO JAN 2024","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--08052557-0aa5-49d0-9254-722e4f04804f","subject":"ATTACK:enterprise:C0001","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--08052557-0aa5-49d0-9254-722e4f04804f","modified":"2026-07-31T18:47:18.581Z","references":[{"source_name":"Talos Frankenstein June 2019","url":"https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--08cdfbc3-eefb-44a2-9ec1-59b2dbc76392","subject":"ATTACK:enterprise:G1054","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--08cdfbc3-eefb-44a2-9ec1-59b2dbc76392","modified":"2026-07-31T18:48:08.169Z","references":[{"source_name":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--09237e32-a423-4ce3-bb15-4e47848ee7f7","subject":"ATTACK:enterprise:G0112","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--09237e32-a423-4ce3-bb15-4e47848ee7f7","modified":"2026-09-02T18:52:46.849Z","references":[{"source_name":"BlackBerry Bahamut","url":"https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--09f6307c-819e-4e35-bfc7-5314b0c3ce85","subject":"ATTACK:enterprise:S0562","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--09f6307c-819e-4e35-bfc7-5314b0c3ce85","modified":"2026-04-29T14:23:05.917Z","references":[{"source_name":"CrowdStrike SUNSPOT Implant January 2021","url":"https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0a7ee066-d242-437c-976d-a59de4dff90e","subject":"ATTACK:enterprise:S9012","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0a7ee066-d242-437c-976d-a59de4dff90e","modified":"2026-04-29T14:23:05.918Z","references":[{"source_name":"Google UNC5221 Ivanti April 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-exploiting-critical-ivanti-vulnerability"},{"source_name":"Picus Security UNC5221 Ivanti May 2025","url":"https://www.picussecurity.com/resource/blog/unc5221-cve-2025-22457-ivanti-connect-secure"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0cbc1f3f-7a32-4056-bfa6-25186ac5e6a4","subject":"ATTACK:enterprise:S0142","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0cbc1f3f-7a32-4056-bfa6-25186ac5e6a4","modified":"2026-04-29T14:23:05.920Z","references":[{"source_name":"Cylance Shell Crew Feb 2017","url":"https://www.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0e60931e-34df-4a29-936f-32064ec007c1","subject":"ATTACK:enterprise:S9019","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0e60931e-34df-4a29-936f-32064ec007c1","modified":"2026-04-29T14:23:05.923Z","references":[{"source_name":"Check Point Blind Eagle MAR 2025","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0ed0ef18-126f-4a03-ac2a-f315dfb48b7d","subject":"ATTACK:enterprise:S0456","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0ed0ef18-126f-4a03-ac2a-f315dfb48b7d","modified":"2026-04-29T14:23:05.924Z","references":[{"source_name":"CheckPoint Naikon May 2020","url":"https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0ffa13fd-ca80-4541-a166-9c297145180d","subject":"ATTACK:enterprise:G1017","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0ffa13fd-ca80-4541-a166-9c297145180d","modified":"2026-07-31T18:47:39.614Z","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source_name":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source_name":"Microsoft Volt Typhoon May 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1035fe41-56b9-4966-bf3b-109ae950c908","subject":"ATTACK:enterprise:S0149","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1035fe41-56b9-4966-bf3b-109ae950c908","modified":"2026-04-29T14:23:05.926Z","references":[{"source_name":"Palo Alto MoonWind March 2017","url":"http://researchcenter.paloaltonetworks.com/2017/03/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1051f320-91fa-4f89-8abe-a851a56e18a7","subject":"ATTACK:enterprise:S0251","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1051f320-91fa-4f89-8abe-a851a56e18a7","modified":"2026-04-29T14:23:05.926Z","references":[{"source_name":"Unit42 Cannon Nov 2018","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"},{"source_name":"ESET Zebrocy Nov 2018","url":"https://www.welivesecurity.com/2018/11/20/sednit-whats-going-zebrocy/"},{"source_name":"Unit42 Sofacy Dec 2018","url":"https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/"},{"source_name":"ESET Zebrocy May 2019","url":"https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/"},{"source_name":"Accenture SNAKEMACKEREL Nov 2018","url":"https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--10b4ef89-5f69-4809-a410-37256407b5fa","subject":"ATTACK:enterprise:S0581","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--10b4ef89-5f69-4809-a410-37256407b5fa","modified":"2026-04-29T14:23:05.926Z","references":[{"source_name":"Unit 42 IronNetInjector February 2021 ","url":"https://unit42.paloaltonetworks.com/ironnetinjector/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--112fec98-96be-4843-a56e-90d6b3fc02b2","subject":"ATTACK:enterprise:S0277","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--112fec98-96be-4843-a56e-90d6b3fc02b2","modified":"2026-04-29T14:23:05.927Z","references":[{"source_name":"objsee mac malware 2017","url":"https://objective-see.com/blog/blog_0x25.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--11870221-f730-4844-a441-ac1e8d21bc4b","subject":"ATTACK:enterprise:S0351","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--11870221-f730-4844-a441-ac1e8d21bc4b","modified":"2026-04-29T14:23:05.928Z","references":[{"source_name":"Unit42 Cannon Nov 2018","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"},{"source_name":"Unit42 Sofacy Dec 2018","url":"https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1232c797-ebf4-4036-9ebb-a65fbe8b1443","subject":"ATTACK:enterprise:S0451","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1232c797-ebf4-4036-9ebb-a65fbe8b1443","modified":"2026-04-29T14:23:05.929Z","references":[{"source_name":"ESET LoudMiner June 2019","url":"https://www.welivesecurity.com/2019/06/20/loudminer-mining-cracked-vst-software/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--13204383-a747-4f7f-a75c-858ddc76beab","subject":"ATTACK:enterprise:S0059","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--13204383-a747-4f7f-a75c-858ddc76beab","modified":"2026-04-29T14:23:05.930Z","references":[{"source_name":"Baumgartner Naikon 2015","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--13a3b832-a680-4c50-b413-c8137a6a89b5","subject":"ATTACK:enterprise:S1013","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--13a3b832-a680-4c50-b413-c8137a6a89b5","modified":"2026-04-29T14:23:05.931Z","references":[{"source_name":"Cisco Talos Bitter Bangladesh May 2022","url":"https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--13ab9b58-b18a-437f-898e-fc598e8d0939","subject":"ATTACK:enterprise:S0531","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--13ab9b58-b18a-437f-898e-fc598e8d0939","modified":"2026-04-29T14:23:05.931Z","references":[{"source_name":"ESET Grandoreiro April 2020","url":"https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--14639d10-6371-4e84-a637-a0e5846cb053","subject":"ATTACK:enterprise:S0271","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--14639d10-6371-4e84-a637-a0e5846cb053","modified":"2026-04-29T14:23:05.932Z","references":[{"source_name":"US-CERT KEYMARBLE Aug 2018","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-221A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--149a056e-9061-4345-a46a-c1f73653d16a","subject":"ATTACK:enterprise:S0219","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--149a056e-9061-4345-a46a-c1f73653d16a","modified":"2026-04-29T14:23:05.932Z","references":[{"source_name":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--16043223-3846-4138-93d0-671339ba3646","subject":"ATTACK:enterprise:S0034","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--16043223-3846-4138-93d0-671339ba3646","modified":"2026-04-29T14:23:05.934Z","references":[{"source_name":"FireEye APT30","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--17cafa26-57f1-4efb-9d23-1399cd2de4cd","subject":"ATTACK:enterprise:G0081","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--17cafa26-57f1-4efb-9d23-1399cd2de4cd","modified":"2026-07-31T18:47:56.967Z","references":[{"source_name":"Unit 42 Tropic Trooper Nov 2016","url":"https://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/"},{"source_name":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--18c07e03-0456-4854-bf63-07eb6d6bd868","subject":"ATTACK:enterprise:S0615","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--18c07e03-0456-4854-bf63-07eb6d6bd868","modified":"2026-04-29T14:23:05.938Z","references":[{"source_name":"BlackBerry CostaRicto November 2020","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"},{"source_name":"FireEye FiveHands April 2021","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"},{"source_name":"CISA AR21-126A FIVEHANDS May 2021","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--18d29bb2-655b-4e3d-9759-32a74be3eb75","subject":"ATTACK:enterprise:S0446","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--18d29bb2-655b-4e3d-9759-32a74be3eb75","modified":"2026-04-29T14:23:05.938Z","references":[{"source_name":"CrowdStrike Ryuk January 2019","url":"https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1923a47b-5a48-44e6-883f-ca23a96fea46","subject":"ATTACK:enterprise:S0044","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1923a47b-5a48-44e6-883f-ca23a96fea46","modified":"2026-04-29T14:23:05.939Z","references":[{"source_name":"ESET Sednit Part 1","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part1.pdf"},{"source_name":"Unit 42 Sofacy Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--19e85b54-a6b4-4141-9284-d405af345372","subject":"ATTACK:enterprise:S1107","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--19e85b54-a6b4-4141-9284-d405af345372","modified":"2026-04-29T14:23:05.940Z","references":[{"source_name":"NKAbuse SL","url":"https://securelist.com/unveiling-nkabuse/111512/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1a1d72d9-3dd3-410d-99cc-ada6def874ff","subject":"ATTACK:enterprise:C0024","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1a1d72d9-3dd3-410d-99cc-ada6def874ff","modified":"2026-07-31T18:47:26.385Z","references":[{"source_name":"Volexity SolarWinds","url":"https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/"},{"source_name":"CrowdStrike StellarParticle January 2022","url":"https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/"},{"source_name":"Microsoft Deep Dive Solorigate January 2021","url":"https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1b03ba23-cbf3-4a77-8c8b-233a19e42a0c","subject":"ATTACK:enterprise:S0268","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1b03ba23-cbf3-4a77-8c8b-233a19e42a0c","modified":"2026-04-29T14:23:05.941Z","references":[{"source_name":"Unit 42 Bisonal July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-bisonal-malware-used-attacks-russia-south-korea/"},{"source_name":"Kaspersky CactusPete Aug 2020","url":"https://securelist.com/cactuspete-apt-groups-updated-bisonal-backdoor/97962/"},{"source_name":"Talos Bisonal Mar 2020","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1c186ff7-913a-46b3-b796-d3445ba0901c","subject":"ATTACK:enterprise:S1114","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1c186ff7-913a-46b3-b796-d3445ba0901c","modified":"2026-04-29T14:23:05.943Z","references":[{"source_name":"Mandiant Cutting Edge January 2024","url":"https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1ca28941-562d-45e4-946c-518a2015c0dd","subject":"ATTACK:enterprise:S0476","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1ca28941-562d-45e4-946c-518a2015c0dd","modified":"2026-04-29T14:23:05.944Z","references":[{"source_name":"Cybereason Valak May 2020","url":"https://www.cybereason.com/blog/valak-more-than-meets-the-eye"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1cc625dd-3079-4aa5-99f5-db1897795500","subject":"ATTACK:enterprise:S0436","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1cc625dd-3079-4aa5-99f5-db1897795500","modified":"2026-04-29T14:23:05.944Z","references":[{"source_name":"JPCert TSCookie March 2018","url":"https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1d6eb87c-6ed9-4432-a51c-b0ef70190120","subject":"ATTACK:enterprise:S1050","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1d6eb87c-6ed9-4432-a51c-b0ef70190120","modified":"2026-04-29T14:23:05.945Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1e0fdaa6-7a6f-4bd6-a1ef-3ee85d1d89b2","subject":"ATTACK:enterprise:S0015","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1e0fdaa6-7a6f-4bd6-a1ef-3ee85d1d89b2","modified":"2026-04-29T14:23:05.946Z","references":[{"source_name":"Trend Micro IXESHE 2012","url":"https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1e10af38-1695-45ab-8db2-8cd476a58a45","subject":"ATTACK:enterprise:S0482","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1e10af38-1695-45ab-8db2-8cd476a58a45","modified":"2026-04-29T14:23:05.946Z","references":[{"source_name":"MacKeeper Bundlore Apr 2019","url":"https://mackeeper.com/blog/post/610-macos-bundlore-adware-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1e9f6719-24c5-4c8b-a832-506f46bbadb6","subject":"ATTACK:enterprise:G0121","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1e9f6719-24c5-4c8b-a832-506f46bbadb6","modified":"2026-07-31T18:47:51.777Z","references":[{"source_name":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1ed17f60-d6ca-4ef7-ae52-7a573c2a7ff3","subject":"ATTACK:enterprise:S0516","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1ed17f60-d6ca-4ef7-ae52-7a573c2a7ff3","modified":"2026-04-29T14:23:05.947Z","references":[{"source_name":"CISA SoreFang July 2016","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1fbd687c-3e02-43b8-a160-4319a7d754ac","subject":"ATTACK:enterprise:S0229","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1fbd687c-3e02-43b8-a160-4319a7d754ac","modified":"2026-04-29T14:23:05.948Z","references":[{"source_name":"Proofpoint Leviathan Oct 2017","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1fbf92c8-747b-4c0f-ab33-ce63cbff8197","subject":"ATTACK:enterprise:G0009","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1fbf92c8-747b-4c0f-ab33-ce63cbff8197","modified":"2026-07-31T18:48:12.574Z","references":[{"source_name":"Alperovitch 2014","url":"https://web.archive.org/web/20200424075623/https:/www.crowdstrike.com/blog/deep-thought-chinese-targeting-national-security-think-tanks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--22926f48-80d0-4ce1-8ee0-41a8930b34ef","subject":"ATTACK:enterprise:S1160","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--22926f48-80d0-4ce1-8ee0-41a8930b34ef","modified":"2026-04-29T14:23:05.952Z","references":[{"source_name":"Bitsight Latrodectus June 2024","url":"https://www.bitsight.com/blog/latrodectus-are-you-coming-back"},{"source_name":"Latrodectus APR 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"},{"source_name":"Elastic Latrodectus May 2024","url":"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--23c028d1-6963-4033-b91f-5953413df43c","subject":"ATTACK:enterprise:S0532","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--23c028d1-6963-4033-b91f-5953413df43c","modified":"2026-04-29T14:23:05.954Z","references":[{"source_name":"Unit 42 Lucifer June 2020","url":"https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--23c76193-d7e8-4dca-a9d6-e9b6b0bacfea","subject":"ATTACK:enterprise:S1185","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--23c76193-d7e8-4dca-a9d6-e9b6b0bacfea","modified":"2026-04-29T14:23:05.954Z","references":[{"source_name":"Huntress LightSpy macOS 2024","url":"https://www.huntress.com/blog/lightspy-malware-variant-targeting-macos"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--24936948-7c46-4c12-a64f-4715ccfb6ffb","subject":"ATTACK:enterprise:S1132","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--24936948-7c46-4c12-a64f-4715ccfb6ffb","modified":"2026-04-29T14:23:05.955Z","references":[{"source_name":"SentinelOne Agrius 2021","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--268d6aed-3961-42d9-9d34-785a9903d004","subject":"ATTACK:enterprise:S0409","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--268d6aed-3961-42d9-9d34-785a9903d004","modified":"2026-04-29T14:23:05.957Z","references":[{"source_name":"ESET Machete July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2693f023-45bc-4244-acf7-a84c91bb4b0b","subject":"ATTACK:enterprise:S1133","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2693f023-45bc-4244-acf7-a84c91bb4b0b","modified":"2026-04-29T14:23:05.957Z","references":[{"source_name":"SentinelOne Agrius 2021","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2738fdf5-b448-4c28-9918-dec89c31b2fc","subject":"ATTACK:enterprise:S0201","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2738fdf5-b448-4c28-9918-dec89c31b2fc","modified":"2026-04-29T14:23:05.958Z","references":[{"source_name":"Microsoft PLATINUM April 2016","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2863b77b-a029-4c9e-a573-e5e16d979391","subject":"ATTACK:enterprise:S1081","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2863b77b-a029-4c9e-a573-e5e16d979391","modified":"2026-04-29T14:23:05.960Z","references":[{"source_name":"BitDefender BADHATCH Mar 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--297166d8-036f-4bec-a3bf-acc416427a7f","subject":"ATTACK:enterprise:S1147","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--297166d8-036f-4bec-a3bf-acc416427a7f","modified":"2026-04-29T14:23:05.961Z","references":[{"source_name":"ESET EvasivePanda 2024","url":"https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--29d1fe5a-4ea4-4fb2-8b64-afcceee45d10","subject":"ATTACK:enterprise:S0663","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--29d1fe5a-4ea4-4fb2-8b64-afcceee45d10","modified":"2026-04-29T14:23:05.962Z","references":[{"source_name":"Lunghi Iron Tiger Linux","url":"https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2a47008b-49af-4ecc-b018-ef92786ead72","subject":"ATTACK:enterprise:S0662","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2a47008b-49af-4ecc-b018-ef92786ead72","modified":"2026-04-29T14:23:05.962Z","references":[{"source_name":"Profero APT27 December 2020","url":"https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2c1758b2-6809-48f5-84f1-e82afa950a9f","subject":"ATTACK:enterprise:S0605","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2c1758b2-6809-48f5-84f1-e82afa950a9f","modified":"2026-04-29T14:23:05.964Z","references":[{"source_name":"Dragos EKANS","url":"https://www.dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/"},{"source_name":"FireEye Ransomware Feb 2020","url":"https://www.fireeye.com/blog/threat-research/2020/02/ransomware-against-machine-learning-to-disrupt-industrial-production.html"},{"source_name":"IBM Ransomware Trends September 2020","url":"https://securityintelligence.com/posts/ransomware-2020-attack-trends-new-techniques-affecting-organizations-worldwide/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2c3934ce-291a-41ab-b389-193170f40e36","subject":"ATTACK:enterprise:S1239","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2c3934ce-291a-41ab-b389-193170f40e36","modified":"2026-04-29T14:23:05.964Z","references":[{"source_name":"Trend Micro Mustang Panda Earth Preta Toneshell February 2025","url":"https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2c586158-d02b-468a-bee8-04e1bde320e1","subject":"ATTACK:enterprise:S0089","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2c586158-d02b-468a-bee8-04e1bde320e1","modified":"2026-04-29T14:23:05.965Z","references":[{"source_name":"F-Secure BlackEnergy 2014","url":"https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf"},{"source_name":"Securelist BlackEnergy Nov 2014","url":"https://securelist.com/be2-custom-plugins-router-abuse-and-target-profiles/67353/"},{"source_name":"ESET BlackEnergy Jan 2016","url":"https://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2d1beee9-0b61-4e66-9487-97f1665bbedc","subject":"ATTACK:enterprise:S0252","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2d1beee9-0b61-4e66-9487-97f1665bbedc","modified":"2026-04-29T14:23:05.966Z","references":[{"source_name":"McAfee Gold Dragon","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2f5a0454-031c-49e0-979e-c38f4cc4bbcc","subject":"ATTACK:enterprise:S9041","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2f5a0454-031c-49e0-979e-c38f4cc4bbcc","modified":"2026-07-15T17:50:50.595Z","references":[{"source_name":"Aqua Security Trivy Compromise MAR 2026","url":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23"},{"source_name":"Aqua Security Blog Trivy Compromise APR 2026","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"},{"source_name":"Wiz Trivy Compromise MAR 2026","url":"https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"},{"source_name":"Wiz TeamPCP KICS MAR 2026","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3029d06e-7a13-4d17-bad5-ce3198bce2ef","subject":"ATTACK:enterprise:S0410","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3029d06e-7a13-4d17-bad5-ce3198bce2ef","modified":"2026-04-29T14:23:05.976Z","references":[{"source_name":"Fysbis Dr Web Analysis","url":"https://vms.drweb.com/virus/?i=4276269"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3076f49e-0db2-4652-a07d-653027aeef1e","subject":"ATTACK:enterprise:S0125","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3076f49e-0db2-4652-a07d-653027aeef1e","modified":"2026-04-29T14:23:05.977Z","references":[{"source_name":"Kaspersky ProjectSauron Technical Analysis","url":"https://securelist.com/files/2016/07/The-ProjectSauron-APT_Technical_Analysis_KL.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--307ae6b5-b4ea-4ef2-bc99-544dbb31cb45","subject":"ATTACK:enterprise:S1105","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--307ae6b5-b4ea-4ef2-bc99-544dbb31cb45","modified":"2026-04-29T14:23:05.977Z","references":[{"source_name":"NCSC-NL COATHANGER Feb 2024","url":"https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear/TLP-CLEAR+MIVD+AIVD+Advisory+COATHANGER.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--31667cdd-1ac5-46f5-8dbd-9ebaf09f00a9","subject":"ATTACK:enterprise:S0659","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--31667cdd-1ac5-46f5-8dbd-9ebaf09f00a9","modified":"2026-04-29T14:23:05.981Z","references":[{"source_name":"Fortinet Diavol July 2021","url":"https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--32a470e7-4bbc-43e8-ae8e-09b382dd441f","subject":"ATTACK:enterprise:S0057","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--32a470e7-4bbc-43e8-ae8e-09b382dd441f","modified":"2026-04-29T14:23:05.985Z","references":[{"source_name":"Microsoft Tasklist","url":"https://technet.microsoft.com/en-us/library/bb491010.aspx"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--333c5688-edc4-40ba-a382-e98f4473d8c7","subject":"ATTACK:enterprise:S0572","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--333c5688-edc4-40ba-a382-e98f4473d8c7","modified":"2026-04-29T14:23:05.986Z","references":[{"source_name":"ClearSky Lebanese Cedar Jan 2021","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3363ae54-1fe3-4c9f-b074-79dc0d7fbba5","subject":"ATTACK:enterprise:S0049","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3363ae54-1fe3-4c9f-b074-79dc0d7fbba5","modified":"2026-04-29T14:23:05.986Z","references":[{"source_name":"F-Secure The Dukes","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--34c63b13-dfd5-4b44-9c74-37068cbe46da","subject":"ATTACK:enterprise:G1059","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--34c63b13-dfd5-4b44-9c74-37068cbe46da","modified":"2026-10-01T21:42:40.749Z","references":[{"source_name":"Mandiant_UNC1549TTPsTools_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3556f624-1f62-4b47-bf47-3f967a1f9eeb","subject":"ATTACK:enterprise:C0064","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3556f624-1f62-4b47-bf47-3f967a1f9eeb","modified":"2026-09-23T22:25:15.069Z","references":[{"source_name":"AI-Mexico-Govt-Breach","url":"https://cdn.prod.website-files.com/69944dd945f20ca4a27a7c47/69d8bb5aea59e31efb3b8a7f_Tech_Report_ai_breach_mex_gov.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--366bf114-ddd3-473a-9468-c82811c6ed70","subject":"ATTACK:enterprise:S0373","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--366bf114-ddd3-473a-9468-c82811c6ed70","modified":"2026-04-29T14:23:05.994Z","references":[{"source_name":"Cybereason Astaroth Feb 2019","url":"https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--368510dc-1050-45df-81f2-1fca6118c2b0","subject":"ATTACK:enterprise:S1065","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--368510dc-1050-45df-81f2-1fca6118c2b0","modified":"2026-04-29T14:23:05.994Z","references":[{"source_name":"MalwareBytes WoodyRAT Aug 2022","url":"https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--37ece881-96cf-441a-981d-ff3eeac292d7","subject":"ATTACK:enterprise:S0239","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--37ece881-96cf-441a-981d-ff3eeac292d7","modified":"2026-04-29T14:23:05.996Z","references":[{"source_name":"McAfee Bankshot","url":"https://securingtomorrow.mcafee.com/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--38215713-5226-4adf-899f-a0017fb133ed","subject":"ATTACK:enterprise:S9045","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--38215713-5226-4adf-899f-a0017fb133ed","modified":"2026-09-25T16:08:46.814Z","references":[{"source_name":"AI-Mexico-Govt-Breach","url":"https://cdn.prod.website-files.com/69944dd945f20ca4a27a7c47/69d8bb5aea59e31efb3b8a7f_Tech_Report_ai_breach_mex_gov.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--38416e2a-3590-4827-9a6f-d8f1df6568af","subject":"ATTACK:enterprise:G0006","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--38416e2a-3590-4827-9a6f-d8f1df6568af","modified":"2026-07-31T18:48:00.979Z","references":[{"source_name":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--387d5cbe-8862-45c1-9577-c1424b072283","subject":"ATTACK:enterprise:S1059","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--387d5cbe-8862-45c1-9577-c1424b072283","modified":"2026-04-29T14:23:05.997Z","references":[{"source_name":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"},{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--39f3e098-ca5d-4dc4-9cbb-bc29148def30","subject":"ATTACK:enterprise:S0330","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--39f3e098-ca5d-4dc4-9cbb-bc29148def30","modified":"2026-04-29T14:23:05.999Z","references":[{"source_name":"GDATA Zeus Panda June 2017","url":"https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3b0a7f6a-173f-41e6-8dec-2d1b4a0851d9","subject":"ATTACK:enterprise:S0038","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3b0a7f6a-173f-41e6-8dec-2d1b4a0851d9","modified":"2026-06-12T15:51:16.722Z","references":[{"source_name":"Symantec W32.Duqu","url":"https://web.archive.org/web/20111213083345/https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3c210990-7596-4773-a640-adf44490d08d","subject":"ATTACK:enterprise:S0244","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3c210990-7596-4773-a640-adf44490d08d","modified":"2026-04-29T14:23:06.004Z","references":[{"source_name":"Palo Alto Comnie","url":"https://researchcenter.paloaltonetworks.com/2018/01/unit42-comnie-continues-target-organizations-east-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4001577c-16aa-4edc-ba15-1f0f9ba35c13","subject":"ATTACK:enterprise:S0497","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4001577c-16aa-4edc-ba15-1f0f9ba35c13","modified":"2026-04-29T14:23:06.012Z","references":[{"source_name":"TrendMicro macOS Dacls May 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--408db284-4c7a-4ad4-8399-90a8102b4bfa","subject":"ATTACK:enterprise:S0184","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--408db284-4c7a-4ad4-8399-90a8102b4bfa","modified":"2026-04-29T14:23:06.013Z","references":[{"source_name":"FireEye APT34 Dec 2017","url":"https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--40ab538b-9386-4559-8861-098503d3770f","subject":"ATTACK:enterprise:S0586","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--40ab538b-9386-4559-8861-098503d3770f","modified":"2026-04-29T14:23:06.013Z","references":[{"source_name":"CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--416447f0-410b-46d6-a4f8-e67ba3c9052f","subject":"ATTACK:enterprise:S0386","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--416447f0-410b-46d6-a4f8-e67ba3c9052f","modified":"2026-04-29T14:23:06.014Z","references":[{"source_name":"TrendMicro Ursnif Mar 2015","url":"https://web.archive.org/web/20210719165945/https://www.trendmicro.com/en_us/research/15/c/ursnif-the-multifaceted-malware.html?_ga=2.165628854.808042651.1508120821-744063452.1505819992"},{"source_name":"TrendMicro BKDR_URSNIF.SM","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/BKDR_URSNIF.SM?_ga=2.129468940.1462021705.1559742358-1202584019.1549394279"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--431012d2-0ac4-49ba-b217-c118f0c1cf03","subject":"ATTACK:enterprise:S0331","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--431012d2-0ac4-49ba-b217-c118f0c1cf03","modified":"2026-04-29T14:23:06.017Z","references":[{"source_name":"Fortinet Agent Tesla June 2017","url":"https://www.fortinet.com/blog/threat-research/in-depth-analysis-of-net-malware-javaupdtr.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4322dad3-453f-4af5-bd1c-0099baaf2b61","subject":"ATTACK:enterprise:S0355","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4322dad3-453f-4af5-bd1c-0099baaf2b61","modified":"2026-04-29T14:23:06.017Z","references":[{"source_name":"Unit 42 Nokki Oct 2018","url":"https://researchcenter.paloaltonetworks.com/2018/10/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4438ba64-0cd2-46e9-8a67-c685bf9b404c","subject":"ATTACK:enterprise:S0018","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4438ba64-0cd2-46e9-8a67-c685bf9b404c","modified":"2026-04-29T14:23:06.018Z","references":[{"source_name":"AlienVault Sykipot 2011","url":"https://www.alienvault.com/open-threat-exchange/blog/another-sykipot-sample-likely-targeting-us-federal-agencies"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4458ca35-0285-408b-9059-62c36086fd0a","subject":"ATTACK:enterprise:S0434","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4458ca35-0285-408b-9059-62c36086fd0a","modified":"2026-04-29T14:23:06.018Z","references":[{"source_name":"Imminent Unit42 Dec2019","url":"https://unit42.paloaltonetworks.com/imminent-monitor-a-rat-down-under/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--45098d46-2345-4fe4-8b07-2345ffbb9e60","subject":"ATTACK:enterprise:S0441","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--45098d46-2345-4fe4-8b07-2345ffbb9e60","modified":"2026-04-29T14:23:06.020Z","references":[{"source_name":"Kaspersky Cloud Atlas August 2019","url":"https://securelist.com/recent-cloud-atlas-activity/92016/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--465d0043-32d0-4ec9-84a6-c0f455f9a33b","subject":"ATTACK:enterprise:G0125","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--465d0043-32d0-4ec9-84a6-c0f455f9a33b","modified":"2026-07-31T18:47:44.271Z","references":[{"source_name":"Rapid7 HAFNIUM Mar 2021","url":"https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--48649215-087c-4ded-925c-f2c3f57dcba1","subject":"ATTACK:enterprise:G0012","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--48649215-087c-4ded-925c-f2c3f57dcba1","modified":"2026-07-31T18:48:11.901Z","references":[{"source_name":"Securelist Darkhotel Aug 2015","url":"https://securelist.com/darkhotels-attacks-in-2015/71713/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--49333b91-3071-4d7b-8bbd-b32d2e80d05f","subject":"ATTACK:enterprise:C0035","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--49333b91-3071-4d7b-8bbd-b32d2e80d05f","modified":"2026-07-31T18:47:17.892Z","references":[{"source_name":"Lumen KVBotnet 2023","url":"https://blog.lumen.com/routers-roasting-on-an-open-firewall-the-kv-botnet-investigation/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--496378e6-ab36-4d3b-9ae3-c493a5b56877","subject":"ATTACK:enterprise:S0081","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--496378e6-ab36-4d3b-9ae3-c493a5b56877","modified":"2026-04-29T14:23:06.025Z","references":[{"source_name":"Accenture Dragonfish Jan 2018","url":"https://web.archive.org/web/20190508165226/https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--49944838-b6f8-4e1c-94d4-5b70cb436700","subject":"ATTACK:enterprise:S0622","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--49944838-b6f8-4e1c-94d4-5b70cb436700","modified":"2026-04-29T14:23:06.026Z","references":[{"source_name":"Malwarebytes Kimsuky June 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4a5d8511-633c-4429-ac64-37a4815bf545","subject":"ATTACK:enterprise:S0473","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4a5d8511-633c-4429-ac64-37a4815bf545","modified":"2026-04-29T14:23:06.027Z","references":[{"source_name":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4b7e9da5-e087-4a1d-8df0-82910bd3b1c3","subject":"ATTACK:enterprise:G1040","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4b7e9da5-e087-4a1d-8df0-82910bd3b1c3","modified":"2026-07-31T18:48:25.684Z","references":[{"source_name":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4b8ebd1a-50ba-463a-b536-3ad8cc5013f8","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4b8ebd1a-50ba-463a-b536-3ad8cc5013f8","modified":"2026-04-29T14:23:06.028Z","references":[{"source_name":"CIRCL PlugX March 2013","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4b9ee045-b369-4122-8743-a095f8a90ac5","subject":"ATTACK:enterprise:S1159","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4b9ee045-b369-4122-8743-a095f8a90ac5","modified":"2026-04-29T14:23:06.029Z","references":[{"source_name":"Google Cloud APT41 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4d36c850-0cd8-4e2a-9999-19f61eb37922","subject":"ATTACK:enterprise:S0345","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4d36c850-0cd8-4e2a-9999-19f61eb37922","modified":"2026-04-29T14:23:06.030Z","references":[{"source_name":"Mandiant APT1 Appendix","url":"https://www.mandiant.com/sites/default/files/2021-09/mandiant-apt1-report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4d90fd9d-9f9b-45f8-986d-3db43b679905","subject":"ATTACK:enterprise:S0088","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4d90fd9d-9f9b-45f8-986d-3db43b679905","modified":"2026-04-29T14:23:06.031Z","references":[{"source_name":"Zscaler Kasidet","url":"http://research.zscaler.com/2016/01/malicious-office-files-dropping-kasidet.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4de2ac9b-4e51-4d73-8fe3-d7d1659778b8","subject":"ATTACK:enterprise:G0038","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4de2ac9b-4e51-4d73-8fe3-d7d1659778b8","modified":"2026-07-31T18:48:07.231Z","references":[{"source_name":"Citizen Lab Stealth Falcon May 2016","url":"https://citizenlab.org/2016/05/stealth-falcon/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4ecfe8a9-182e-42a7-8b4f-519004185b20","subject":"ATTACK:enterprise:S1230","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4ecfe8a9-182e-42a7-8b4f-519004185b20","modified":"2026-04-29T14:23:06.032Z","references":[{"source_name":"Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024","url":"https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4f368185-2f3f-4a42-b106-707cd476b6b0","subject":"ATTACK:enterprise:S1244","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4f368185-2f3f-4a42-b106-707cd476b6b0","modified":"2026-04-29T14:23:06.033Z","references":[{"source_name":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source_name":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"},{"source_name":"Security Scorecard Medusa Ransomware January 2024","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4f85e333-375b-4a5b-8a15-a3bd061678a4","subject":"ATTACK:enterprise:G0139","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4f85e333-375b-4a5b-8a15-a3bd061678a4","modified":"2026-07-31T18:47:49.354Z","references":[{"source_name":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source_name":"Trend Micro TeamTNT","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4faef092-6721-408c-9135-70c6ad824a07","subject":"ATTACK:enterprise:S0528","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4faef092-6721-408c-9135-70c6ad824a07","modified":"2026-04-29T14:23:06.034Z","references":[{"source_name":"Securelist Brazilian Banking Malware July 2020","url":"https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5046e931-5710-45b4-b5b4-39c58e61d733","subject":"ATTACK:enterprise:S1229","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5046e931-5710-45b4-b5b4-39c58e61d733","modified":"2026-04-29T14:23:06.035Z","references":[{"source_name":"Zscaler Havoc FEB 2023","url":"https://www.zscaler.com/blogs/security-research/havoc-across-cyberspace"},{"source_name":"Havoc Framework Documentation","url":"https://havocframework.com/docs/welcome"},{"source_name":"Fortinet Havoc MAR 2025","url":"https://www.fortinet.com/blog/threat-research/havoc-sharepoint-with-microsoft-graph-api-turns-into-fud-c2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--51a03c8a-1983-4bdd-b326-78ec67f86f06","subject":"ATTACK:enterprise:S0094","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--51a03c8a-1983-4bdd-b326-78ec67f86f06","modified":"2026-04-29T14:23:06.037Z","references":[{"source_name":"Symantec Dragonfly","url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"},{"source_name":"Secureworks Karagany July 2019","url":"https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--51d06864-d5de-4286-b2bb-561a8d2c4d49","subject":"ATTACK:enterprise:G0007","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--51d06864-d5de-4286-b2bb-561a8d2c4d49","modified":"2026-07-31T20:48:44.646Z","references":[{"source_name":"Unit 42 Playbook Dec 2017","url":"https://web.archive.org/web/20230702043312/https://pan-unit42.github.io/playbook_viewer/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--536ed2f4-46c5-4485-998c-60f0480d5c21","subject":"ATTACK:enterprise:S0240","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--536ed2f4-46c5-4485-998c-60f0480d5c21","modified":"2026-04-29T14:23:06.039Z","references":[{"source_name":"Talos ROKRAT","url":"https://blog.talosintelligence.com/2017/04/introducing-rokrat.html"},{"source_name":"NCCGroup RokRat Nov 2018","url":"https://research.nccgroup.com/2018/11/08/rokrat-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--53a8ee3f-f261-46d5-a6eb-512735867ee2","subject":"ATTACK:enterprise:S0208","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--53a8ee3f-f261-46d5-a6eb-512735867ee2","modified":"2026-04-29T14:23:06.039Z","references":[{"source_name":"Symantec Pasam May 2012","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-050412-4128-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--53c60fe3-a917-461e-9baa-a268f4a922de","subject":"ATTACK:enterprise:S1247","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--53c60fe3-a917-461e-9baa-a268f4a922de","modified":"2026-04-29T14:23:06.039Z","references":[{"source_name":"Cyble Embargo Ransomware May 2024","url":"https://cyble.com/blog/the-rust-revolution-new-embargo-ransomware-steps-in/"},{"source_name":"ESET Embargo Ransomware October 2024","url":"https://www.welivesecurity.com/en/eset-research/embargo-ransomware-rocknrust/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--54a384e5-17c8-422d-b199-18e7945cb7d6","subject":"ATTACK:enterprise:S0414","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--54a384e5-17c8-422d-b199-18e7945cb7d6","modified":"2026-04-29T14:23:06.041Z","references":[{"source_name":"Unit42 BabyShark Feb 2019","url":"https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--54ea458f-665e-42a3-b181-8d783e9589ad","subject":"ATTACK:enterprise:S0237","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--54ea458f-665e-42a3-b181-8d783e9589ad","modified":"2026-04-29T14:23:06.041Z","references":[{"source_name":"Talos GravityRAT","url":"https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--563e67ee-9cc8-4f44-9d3a-3611e19a1a3c","subject":"ATTACK:enterprise:S0141","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--563e67ee-9cc8-4f44-9d3a-3611e19a1a3c","modified":"2026-04-29T14:23:06.043Z","references":[{"source_name":"Novetta Winnti April 2015","url":"https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5647be4e-ef31-4b7d-a2d1-7feefafab345","subject":"ATTACK:enterprise:S0278","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5647be4e-ef31-4b7d-a2d1-7feefafab345","modified":"2026-04-29T14:23:06.043Z","references":[{"source_name":"objsee mac malware 2017","url":"https://objective-see.com/blog/blog_0x25.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--56e2010e-20d2-4484-b8ee-742b81b8fcdb","subject":"ATTACK:enterprise:S0626","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--56e2010e-20d2-4484-b8ee-742b81b8fcdb","modified":"2026-04-29T14:23:06.044Z","references":[{"source_name":"Securelist APT10 March 2021","url":"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--56e4717c-33ac-4d7e-a737-71aa520af93e","subject":"ATTACK:enterprise:S0472","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--56e4717c-33ac-4d7e-a737-71aa520af93e","modified":"2026-04-29T14:23:06.044Z","references":[{"source_name":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--57391d02-a8bd-432e-866a-6e23e4ac8329","subject":"ATTACK:enterprise:S1228","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--57391d02-a8bd-432e-866a-6e23e4ac8329","modified":"2026-04-29T14:23:06.044Z","references":[{"source_name":"Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024","url":"https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--58207744-6e31-457e-b36e-b73d60bacd39","subject":"ATTACK:enterprise:G0114","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--58207744-6e31-457e-b36e-b73d60bacd39","modified":"2026-07-31T20:48:41.301Z","references":[{"source_name":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--58be00f9-baaf-40d7-973f-3f38bc7322b9","subject":"ATTACK:enterprise:S1063","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--58be00f9-baaf-40d7-973f-3f38bc7322b9","modified":"2026-04-29T14:23:06.046Z","references":[{"source_name":"Palo Alto Brute Ratel July 2022","url":"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--59318d61-e9d9-4edc-8965-9d6b1c2e633f","subject":"ATTACK:enterprise:S9015","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--59318d61-e9d9-4edc-8965-9d6b1c2e633f","modified":"2026-04-29T14:23:06.047Z","references":[{"source_name":"CISA BRICKSTORM UNC5221 AR25-338A February 2026","url":"https://www.cisa.gov/news-events/analysis-reports/ar25-338a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--59945377-5b77-4267-ae36-9feebccc42f3","subject":"ATTACK:enterprise:S0695","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--59945377-5b77-4267-ae36-9feebccc42f3","modified":"2026-04-29T14:23:06.047Z","references":[{"source_name":"Donut Github","url":"https://github.com/TheWover/donut"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--59984ff6-8907-4f70-b3a7-47d44541e88c","subject":"ATTACK:enterprise:S1153","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--59984ff6-8907-4f70-b3a7-47d44541e88c","modified":"2026-04-29T14:23:06.047Z","references":[{"source_name":"Kandji Cuckoo April 2024","url":"https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5a77e097-3aed-4bd3-b5fc-997746da62ad","subject":"ATTACK:enterprise:S0069","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5a77e097-3aed-4bd3-b5fc-997746da62ad","modified":"2026-04-29T14:23:06.049Z","references":[{"source_name":"FireEye APT17","url":"https://web.archive.org/web/20240119213200/https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5b0329a9-aebd-4216-94d8-a39021139b80","subject":"ATTACK:enterprise:C0015","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5b0329a9-aebd-4216-94d8-a39021139b80","modified":"2026-07-31T18:47:25.358Z","references":[{"source_name":"DFIR Conti Bazar Nov 2021","url":"https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5b37bd8c-d5a6-4564-a110-bb515ff9f78c","subject":"ATTACK:enterprise:S0640","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5b37bd8c-d5a6-4564-a110-bb515ff9f78c","modified":"2026-04-29T14:23:06.050Z","references":[{"source_name":"Arxiv Avaddon Feb 2021","url":"https://arxiv.org/pdf/2102.04796.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5bb90849-cdfe-4cc0-9ca3-128f17b2a1d1","subject":"ATTACK:enterprise:S0170","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5bb90849-cdfe-4cc0-9ca3-128f17b2a1d1","modified":"2026-06-13T12:07:50.835Z","references":[{"source_name":"Unit 42 Playbook Dec 2017","url":"https://web.archive.org/web/20230702043312/https://pan-unit42.github.io/playbook_viewer/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5caffa87-adbb-45e8-ba6b-dc61188471a7","subject":"ATTACK:enterprise:S0248","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5caffa87-adbb-45e8-ba6b-dc61188471a7","modified":"2026-04-29T14:23:06.052Z","references":[{"source_name":"ASERT Donot March 2018","url":"https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5cfa8039-2902-436f-aebe-8e085b4b49f1","subject":"ATTACK:enterprise:S1210","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5cfa8039-2902-436f-aebe-8e085b4b49f1","modified":"2026-04-29T14:23:06.052Z","references":[{"source_name":"Symantec Bilbug 2022","url":"https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5d81254d-9a66-49ea-9635-187da26d4a97","subject":"ATTACK:enterprise:S0666","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5d81254d-9a66-49ea-9635-187da26d4a97","modified":"2026-04-29T14:23:06.053Z","references":[{"source_name":"ESET Gelsemium June 2021","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5e462e1b-62ec-4b44-990d-acd3f7b0010c","subject":"ATTACK:enterprise:S0265","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5e462e1b-62ec-4b44-990d-acd3f7b0010c","modified":"2026-04-29T14:23:06.054Z","references":[{"source_name":"Unit 42 Kazuar May 2017","url":"https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5f387fdf-8d1f-4098-864c-c674277ad9da","subject":"ATTACK:enterprise:S9032","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5f387fdf-8d1f-4098-864c-c674277ad9da","modified":"2026-04-29T14:23:06.055Z","references":[{"source_name":"ESET_MuddyWater_Dec2025","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5f7c7285-daa4-499d-b9d6-c1028e5148d4","subject":"ATTACK:enterprise:S1044","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5f7c7285-daa4-499d-b9d6-c1028e5148d4","modified":"2026-04-29T14:23:06.055Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6118a138-c13c-4117-97dd-c3e7ec3e1021","subject":"ATTACK:enterprise:S0460","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6118a138-c13c-4117-97dd-c3e7ec3e1021","modified":"2026-04-29T14:23:06.057Z","references":[{"source_name":"Proofpoint TA505 October 2019","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--61fa303b-a9ff-419f-b3ac-96e43e37b6e5","subject":"ATTACK:enterprise:S0151","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--61fa303b-a9ff-419f-b3ac-96e43e37b6e5","modified":"2026-04-29T14:23:06.058Z","references":[{"source_name":"FireEye FIN7 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--624ea031-fa6f-42f6-a3e8-c6ee0063be20","subject":"ATTACK:enterprise:S1245","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--624ea031-fa6f-42f6-a3e8-c6ee0063be20","modified":"2026-04-29T14:23:06.059Z","references":[{"source_name":"Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--62f9aa2c-b0c1-4028-a2b8-c436e30ace4b","subject":"ATTACK:enterprise:S0139","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--62f9aa2c-b0c1-4028-a2b8-c436e30ace4b","modified":"2026-04-29T14:23:06.060Z","references":[{"source_name":"Volexity PowerDuke November 2016","url":"https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--63cefb36-bc55-4536-b7f9-c80f9e3f69b3","subject":"ATTACK:enterprise:S1075","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--63cefb36-bc55-4536-b7f9-c80f9e3f69b3","modified":"2026-04-29T14:23:06.061Z","references":[{"source_name":"Mandiant Suspected Turla Campaign February 2023","url":"https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--63f08c72-9be6-45d5-9c60-2a4794795760","subject":"ATTACK:enterprise:G0138","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--63f08c72-9be6-45d5-9c60-2a4794795760","modified":"2026-07-31T18:47:50.778Z","references":[{"source_name":"Kaspersky Andariel Ransomware June 2021","url":"https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--64cb753d-eb72-4dce-a417-7df747334347","subject":"ATTACK:enterprise:S0031","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--64cb753d-eb72-4dce-a417-7df747334347","modified":"2026-04-29T14:23:06.062Z","references":[{"source_name":"FireEye APT30","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--65f12d79-f04e-441d-8068-1962963c4965","subject":"ATTACK:enterprise:S0582","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--65f12d79-f04e-441d-8068-1962963c4965","modified":"2026-04-29T14:23:06.064Z","references":[{"source_name":"Proofpoint LookBack Malware Aug 2019","url":"https://www.proofpoint.com/us/threat-insight/post/lookback-malware-targets-united-states-utilities-sector-phishing-attacks"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--66819f02-7a22-4f21-8e4f-df24969e5567","subject":"ATTACK:enterprise:S0045","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--66819f02-7a22-4f21-8e4f-df24969e5567","modified":"2026-04-29T14:23:06.064Z","references":[{"source_name":"ESET Sednit Part 2","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--66addef3-8b7a-4571-b919-2b70f5991990","subject":"ATTACK:enterprise:S0629","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--66addef3-8b7a-4571-b919-2b70f5991990","modified":"2026-04-29T14:23:06.065Z","references":[{"source_name":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--68d151ea-6dd8-4e6b-acd5-c998ebffc357","subject":"ATTACK:enterprise:S0412","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--68d151ea-6dd8-4e6b-acd5-c998ebffc357","modified":"2026-04-29T14:23:06.068Z","references":[{"source_name":"Talos ZxShell Oct 2014","url":"https://blogs.cisco.com/security/talos/opening-zxshell"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--699ddfef-6e95-42cf-b212-dc661f790adc","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--699ddfef-6e95-42cf-b212-dc661f790adc","modified":"2026-07-31T20:48:46.810Z","references":[{"source_name":"TrendMicro macOS Dacls May 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/"},{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source_name":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--69a36e50-f8a7-4604-8610-d080f8e469d4","subject":"ATTACK:enterprise:S1242","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--69a36e50-f8a7-4604-8610-d080f8e469d4","modified":"2026-04-29T14:23:06.069Z","references":[{"source_name":"Halcyon Qilin.B OCT 2024","url":"https://www.halcyon.ai/blog/new-qilin-b-ransomware-variant-boasts-enhanced-encryption-and-defense-evasion"},{"source_name":"HC3 Qilin Threat Profile JUN 2024","url":"https://www.aha.org/system/files/media/file/2024/06/tlp-clear-hc3-threat-profile-qilin-aka-agenda-ransomware-6-18-2024.pdf"},{"source_name":"Trend Micro Agenda Ransomware AUG 2022","url":"https://www.trendmicro.com/en_us/research/22/h/new-golang-ransomware-agenda-customizes-attacks.html"},{"source_name":"SentinelOne Qilin NOV 2022","url":"https://www.sentinelone.com/anthology/agenda-qilin/"},{"source_name":"Cisco Talos Qilin Ransomware OCT 2025","url":"https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/"},{"source_name":"Trend Micro Agenda Ransomware OCT 2025","url":"https://www.trendmicro.com/en_us/research/25/j/agenda-ransomware-deploys-linux-variant-on-windows-systems.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--69b6cf6f-f018-4999-b640-fc5a3cb2aa2d","subject":"ATTACK:enterprise:S1060","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--69b6cf6f-f018-4999-b640-fc5a3cb2aa2d","modified":"2026-04-29T14:23:06.069Z","references":[{"source_name":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6a09f442-6a2a-455a-ad8d-6aa192995de3","subject":"ATTACK:enterprise:S0030","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6a09f442-6a2a-455a-ad8d-6aa192995de3","modified":"2026-04-29T14:23:06.069Z","references":[{"source_name":"FireEye CARBANAK June 2017","url":"https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6a1828c6-bba9-4285-a8af-5017b096252a","subject":"ATTACK:enterprise:S0650","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6a1828c6-bba9-4285-a8af-5017b096252a","modified":"2026-04-29T14:23:06.069Z","references":[{"source_name":"ATT QakBot April 2021","url":"https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6b2d240a-66f6-484c-a6f6-04661860ae0e","subject":"ATTACK:enterprise:G1053","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6b2d240a-66f6-484c-a6f6-04661860ae0e","modified":"2026-07-31T18:48:03.730Z","references":[{"source_name":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6d91c756-df9c-4fbe-9489-2cf6cf7ba206","subject":"ATTACK:enterprise:S0661","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6d91c756-df9c-4fbe-9489-2cf6cf7ba206","modified":"2026-04-29T14:23:06.074Z","references":[{"source_name":"MSTIC FoggyWeb September 2021","url":"https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6e6f67c0-ba84-48f2-a322-2a7cb7a5cd02","subject":"ATTACK:enterprise:S0534","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6e6f67c0-ba84-48f2-a322-2a7cb7a5cd02","modified":"2026-04-29T14:23:06.075Z","references":[{"source_name":"Cybereason Bazar July 2020","url":"https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6e757efa-8231-4674-a1ea-e234e2dfb838","subject":"ATTACK:enterprise:G0021","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6e757efa-8231-4674-a1ea-e234e2dfb838","modified":"2026-07-31T18:48:23.715Z","references":[{"source_name":"DustySky","url":"https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6e9ca726-0934-4181-a4e6-51ad9d110318","subject":"ATTACK:enterprise:S0630","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6e9ca726-0934-4181-a4e6-51ad9d110318","modified":"2026-04-29T14:23:06.076Z","references":[{"source_name":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6ef89fa5-cd74-499b-bbc0-3b0d83baeba1","subject":"ATTACK:enterprise:G1006","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6ef89fa5-cd74-499b-bbc0-3b0d83baeba1","modified":"2026-07-31T20:48:48.247Z","references":[{"source_name":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6fdaef62-c4da-488a-a07d-c8fca2c98d85","subject":"ATTACK:enterprise:S0079","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6fdaef62-c4da-488a-a07d-c8fca2c98d85","modified":"2026-04-29T14:23:06.078Z","references":[{"source_name":"Scarlet Mimic Jan 2016","url":"http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--70346bf0-ce5e-46a0-8e0f-dd757afec050","subject":"ATTACK:enterprise:S0198","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--70346bf0-ce5e-46a0-8e0f-dd757afec050","modified":"2026-04-29T14:23:06.078Z","references":[{"source_name":"FireEye NETWIRE March 2019","url":"https://www.mandiant.com/resources/blog/dissecting-netwire-phishing-campaigns-usage-process-hollowing"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--70b27780-b19a-4313-88ea-1038ce0fc386","subject":"ATTACK:enterprise:S0606","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--70b27780-b19a-4313-88ea-1038ce0fc386","modified":"2026-04-29T14:23:06.079Z","references":[{"source_name":"Secure List Bad Rabbit","url":"https://securelist.com/bad-rabbit-ransomware/82851/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--71ee5336-929a-41c7-bfbd-42a7208ca29d","subject":"ATTACK:enterprise:S0065","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--71ee5336-929a-41c7-bfbd-42a7208ca29d","modified":"2026-04-29T14:23:06.081Z","references":[{"source_name":"CrowdStrike Putter Panda","url":"http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--726cd7e2-d545-4ddf-8f86-fe1cab083dae","subject":"ATTACK:enterprise:S0356","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--726cd7e2-d545-4ddf-8f86-fe1cab083dae","modified":"2026-04-29T14:23:06.082Z","references":[{"source_name":"Medium KONNI Jan 2020","url":"https://medium.com/d-hunter/a-look-into-konni-2019-campaign-b45a0f321e9b"},{"source_name":"Malwarebytes Konni Aug 2021","url":"https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7380936d-51af-4ee3-b729-9c56a203bdee","subject":"ATTACK:enterprise:S0512","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7380936d-51af-4ee3-b729-9c56a203bdee","modified":"2026-04-29T14:23:06.083Z","references":[{"source_name":"ESET Dukes October 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--753c921d-31ab-4a92-8ff9-c1f0b04a13d5","subject":"ATTACK:enterprise:S9001","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--753c921d-31ab-4a92-8ff9-c1f0b04a13d5","modified":"2026-04-29T14:23:06.085Z","references":[{"source_name":"SophosGnGal_SystemBC_Dec2020","url":"https://news.sophos.com/en-us/2020/12/16/systembc/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--753edd67-e4bb-4c1c-96bf-4de16c270d8c","subject":"ATTACK:enterprise:S1027","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--753edd67-e4bb-4c1c-96bf-4de16c270d8c","modified":"2026-04-29T14:23:06.085Z","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--75c7794b-e8e1-4fcb-b59a-14eb710c47f7","subject":"ATTACK:enterprise:S0607","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--75c7794b-e8e1-4fcb-b59a-14eb710c47f7","modified":"2026-04-29T14:23:06.086Z","references":[{"source_name":"Trend Micro KillDisk 2","url":"https://www.trendmicro.com/en_us/research/18/a/new-killdisk-variant-hits-financial-organizations-in-latin-america.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--767f436a-6979-456b-8d2d-b8c8a6b86446","subject":"ATTACK:enterprise:S1199","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--767f436a-6979-456b-8d2d-b8c8a6b86446","modified":"2026-04-29T14:23:06.087Z","references":[{"source_name":"FBI Lockbit 2.0 FEB 2022","url":"https://www.ic3.gov/CSA/2022/220204.pdf"},{"source_name":"SentinelOne LockBit 2.0","url":"https://www.sentinelone.com/anthology/lockbit-2-0/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--771c349e-1b23-41ea-bcab-59bdbd6c935f","subject":"ATTACK:enterprise:S0064","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--771c349e-1b23-41ea-bcab-59bdbd6c935f","modified":"2026-04-29T14:23:06.088Z","references":[{"source_name":"FireEye EPS Awakens Part 2","url":"https://web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--772089d3-b06e-4e5e-993b-1351f71484e7","subject":"ATTACK:enterprise:S0393","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--772089d3-b06e-4e5e-993b-1351f71484e7","modified":"2026-04-29T14:23:06.088Z","references":[{"source_name":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--778ab7aa-b85b-4d60-b203-00eff3f4b120","subject":"ATTACK:enterprise:S1130","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--778ab7aa-b85b-4d60-b203-00eff3f4b120","modified":"2026-04-29T14:23:06.089Z","references":[{"source_name":"TrendMicro RaspberryRobin 2022","url":"https://www.trendmicro.com/en_us/research/22/l/raspberry-robin-malware-targets-telecom-governments.html"},{"source_name":"HP RaspberryRobin 2024","url":"https://threatresearch.ext.hp.com/raspberry-robin-now-spreading-through-windows-script-files/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7a78758b-9dce-4d13-9b8a-ddc9b31d4ff7","subject":"ATTACK:enterprise:S0664","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7a78758b-9dce-4d13-9b8a-ddc9b31d4ff7","modified":"2026-04-29T14:23:06.093Z","references":[{"source_name":"Trend Micro Iron Tiger April 2021","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7c1e2638-ca07-4825-b7e8-43690912ce74","subject":"ATTACK:enterprise:S0283","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7c1e2638-ca07-4825-b7e8-43690912ce74","modified":"2026-04-29T14:23:06.095Z","references":[{"source_name":"Symantec Frutas Feb 2013","url":"https://www.symantec.com/connect/blogs/cross-platform-frutas-rat-builder-and-back-door"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7c60bccc-f485-403d-ab3b-db861a3a4429","subject":"ATTACK:enterprise:S0334","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7c60bccc-f485-403d-ab3b-db861a3a4429","modified":"2026-04-29T14:23:06.095Z","references":[{"source_name":"Malwarebytes DarkComet March 2018","url":"https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7f31ac80-5e21-4449-8bb3-9c2ad943dc08","subject":"ATTACK:enterprise:S0467","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7f31ac80-5e21-4449-8bb3-9c2ad943dc08","modified":"2026-04-29T14:23:06.099Z","references":[{"source_name":"Kaspersky TajMahal April 2019","url":"https://securelist.com/project-tajmahal/90240/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--80f8b06e-a4a5-41d0-8828-1c77f796a39a","subject":"ATTACK:enterprise:G1051","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--80f8b06e-a4a5-41d0-8828-1c77f796a39a","modified":"2026-07-31T18:48:10.663Z","references":[{"source_name":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--83089e74-f35d-4b1d-9036-4e49edd82bd0","subject":"ATTACK:enterprise:S0611","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--83089e74-f35d-4b1d-9036-4e49edd82bd0","modified":"2026-04-29T14:23:06.104Z","references":[{"source_name":"Mcafee Clop Aug 2019","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--834c3c4d-b282-47e3-bca9-77f3b17f2f11","subject":"ATTACK:enterprise:S1066","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--834c3c4d-b282-47e3-bca9-77f3b17f2f11","modified":"2026-04-29T14:23:06.105Z","references":[{"source_name":"Secureworks DarkTortilla Aug 2022","url":"https://www.secureworks.com/research/darktortilla-malware-analysis"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--83ea0666-2b0d-4db8-821c-e51c15335bd1","subject":"ATTACK:enterprise:S0180","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--83ea0666-2b0d-4db8-821c-e51c15335bd1","modified":"2026-04-29T14:23:06.105Z","references":[{"source_name":"Symantec Volgmer Aug 2014","url":"https://web.archive.org/web/20181126143456/https://www.symantec.com/security-center/writeup/2014-081811-3237-99?tabid=2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8481804a-2dc2-4e58-8515-1f3d1323f33e","subject":"ATTACK:enterprise:S0249","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8481804a-2dc2-4e58-8515-1f3d1323f33e","modified":"2026-04-29T14:23:06.106Z","references":[{"source_name":"McAfee Gold Dragon","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--849c40ae-9dc7-4861-9a6c-8c03b4ffb7b5","subject":"ATTACK:enterprise:S1072","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--849c40ae-9dc7-4861-9a6c-8c03b4ffb7b5","modified":"2026-04-29T14:23:06.106Z","references":[{"source_name":"Industroyer2 Mandiant April 2022","url":"https://www.mandiant.com/resources/blog/industroyer-v2-old-malware-new-tricks"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--84f40044-00a2-4015-be0d-1bb0107ef42b","subject":"ATTACK:enterprise:S0115","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--84f40044-00a2-4015-be0d-1bb0107ef42b","modified":"2026-04-29T14:23:06.107Z","references":[{"source_name":"Kaspersky Transparent Tribe August 2020","url":"https://securelist.com/transparent-tribe-part-1/98127/"},{"source_name":"Proofpoint Operation Transparent Tribe March 2016","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"},{"source_name":"Cisco Talos Transparent Tribe Education Campaign July 2022","url":"https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--872394be-9a8e-4888-8c7b-24b8b84f24c6","subject":"ATTACK:enterprise:S9060","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--872394be-9a8e-4888-8c7b-24b8b84f24c6","modified":"2026-10-01T15:21:13.211Z","references":[{"source_name":"Mandiant_UNC1549_Feb2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--87e7c117-bf53-432e-9ff3-2aeb2e522231","subject":"ATTACK:enterprise:S0241","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--87e7c117-bf53-432e-9ff3-2aeb2e522231","modified":"2026-04-29T14:23:06.111Z","references":[{"source_name":"Lazarus RATANKBA","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-campaign-targeting-cryptocurrencies-reveals-remote-controller-tool-evolved-ratankba/"},{"source_name":"RATANKBA","url":"https://www.trendmicro.com/en_us/research/17/b/ratankba-watering-holes-against-enterprises.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--881641a8-77d9-4dce-9d4b-2388c9b11612","subject":"ATTACK:enterprise:G0129","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--881641a8-77d9-4dce-9d4b-2388c9b11612","modified":"2026-07-31T18:47:52.780Z","references":[{"source_name":"Avira Mustang Panda January 2020","url":"https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--884e2dbe-6641-400b-93db-2df91ffe5a33","subject":"ATTACK:enterprise:S1149","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--884e2dbe-6641-400b-93db-2df91ffe5a33","modified":"2026-04-29T14:23:06.111Z","references":[{"source_name":"Mandiant ROADSWEEP August 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8895b1a0-d48f-4869-9f3a-19255c3bc490","subject":"ATTACK:enterprise:S9052","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8895b1a0-d48f-4869-9f3a-19255c3bc490","modified":"2026-09-24T18:49:46.008Z","references":[{"source_name":"CheckPoint_NimbusManticore_May2026","url":"https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8977c8db-64e4-44b5-bee9-362779624a42","subject":"ATTACK:enterprise:S0517","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8977c8db-64e4-44b5-bee9-362779624a42","modified":"2026-04-29T14:23:06.113Z","references":[{"source_name":"Trustwave Pillowmint June 2020","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8a7317fd-fa8f-4c32-8aa5-4ff225116f7e","subject":"ATTACK:enterprise:S0448","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8a7317fd-fa8f-4c32-8aa5-4ff225116f7e","modified":"2026-04-29T14:23:06.114Z","references":[{"source_name":"McAfee Sharpshooter December 2018","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8aec04e5-87ee-4f12-a14b-97cb5fc9b0a9","subject":"ATTACK:enterprise:C0063","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8aec04e5-87ee-4f12-a14b-97cb5fc9b0a9","modified":"2026-07-31T20:48:19.805Z","references":[{"source_name":"CERT Polska","url":"https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8b3cb69c-7b85-4d52-8cab-867ea1126fc7","subject":"ATTACK:enterprise:S0687","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8b3cb69c-7b85-4d52-8cab-867ea1126fc7","modified":"2026-04-29T14:23:06.115Z","references":[{"source_name":"NCSC Cyclops Blink February 2022","url":"https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8b6dec67-2a33-4da7-a2d4-a36ce28cabe8","subject":"ATTACK:enterprise:S1111","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8b6dec67-2a33-4da7-a2d4-a36ce28cabe8","modified":"2026-04-29T14:23:06.115Z","references":[{"source_name":"Ensilo Darkgate 2018","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"},{"source_name":"Rapid7 BlackBasta 2024","url":"https://www.rapid7.com/blog/post/2024/12/04/black-basta-ransomware-campaign-drops-zbot-darkgate-and-custom-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8ca0a20d-2c12-4b68-a2a9-ebd95c05ee68","subject":"ATTACK:enterprise:S0468","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8ca0a20d-2c12-4b68-a2a9-ebd95c05ee68","modified":"2026-04-29T14:23:06.117Z","references":[{"source_name":"Trend Micro Skidmap","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8d5a8f57-0d67-462f-a4f5-7fc4268e4ab2","subject":"ATTACK:enterprise:S0458","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8d5a8f57-0d67-462f-a4f5-7fc4268e4ab2","modified":"2026-04-29T14:23:06.118Z","references":[{"source_name":"Antiy CERT Ramsay April 2020","url":"https://www.programmersought.com/article/62493896999/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8d5b3c01-b260-4212-a4f0-f061c3c701cf","subject":"ATTACK:enterprise:G1022","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8d5b3c01-b260-4212-a4f0-f061c3c701cf","modified":"2026-07-31T18:48:14.215Z","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8dc84a69-e2d5-4796-a898-0c41202a273f","subject":"ATTACK:enterprise:S1141","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8dc84a69-e2d5-4796-a898-0c41202a273f","modified":"2026-04-29T14:23:06.118Z","references":[{"source_name":"ESET Turla Lunar toolset May 2024","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8ead6aa1-dbbe-4e8f-b542-66af9b5f2c33","subject":"ATTACK:enterprise:S0501","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8ead6aa1-dbbe-4e8f-b542-66af9b5f2c33","modified":"2026-04-29T14:23:06.119Z","references":[{"source_name":"ESET PipeMon May 2020","url":"https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8fbbe6cb-5b2b-433a-9193-7a3890fa3e95","subject":"ATTACK:enterprise:S1016","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8fbbe6cb-5b2b-433a-9193-7a3890fa3e95","modified":"2026-04-29T14:23:06.121Z","references":[{"source_name":"ESET DazzleSpy Jan 2022","url":"https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--903b7f1b-48e2-4f01-a9e5-454cb2c8ccb7","subject":"ATTACK:enterprise:S9035","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--903b7f1b-48e2-4f01-a9e5-454cb2c8ccb7","modified":"2026-04-29T14:23:06.122Z","references":[{"source_name":"Nov AI Threat Tracker","url":"https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools"},{"source_name":"Cato LAMEHUG JUL 2025","url":"https://www.catonetworks.com/blog/cato-ctrl-threat-research-analyzing-lamehug/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--91b6a6e1-c0eb-4bd8-84d4-4c31caf2ba6a","subject":"ATTACK:enterprise:S0254","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--91b6a6e1-c0eb-4bd8-84d4-4c31caf2ba6a","modified":"2026-04-29T14:23:06.124Z","references":[{"source_name":"Rancor Unit42 June 2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--92e35558-f915-4357-b397-3cc7a0412b92","subject":"ATTACK:enterprise:S0211","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--92e35558-f915-4357-b397-3cc7a0412b92","modified":"2026-04-29T14:23:06.125Z","references":[{"source_name":"Symantec Linfo May 2012","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-051605-2535-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--931a5425-011a-42b5-ae49-fba9c70572b6","subject":"ATTACK:enterprise:S0596","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--931a5425-011a-42b5-ae49-fba9c70572b6","modified":"2026-04-29T14:23:06.125Z","references":[{"source_name":"Kaspersky ShadowPad Aug 2017","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--93fe5493-d3c1-4db2-8228-61da951c660e","subject":"ATTACK:enterprise:S0017","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--93fe5493-d3c1-4db2-8228-61da951c660e","modified":"2026-04-29T14:23:06.127Z","references":[{"source_name":"Mandiant APT1 Appendix","url":"https://www.mandiant.com/sites/default/files/2021-09/mandiant-apt1-report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9701df31-e2f4-487b-a204-26c4347ef32d","subject":"ATTACK:enterprise:S0256","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9701df31-e2f4-487b-a204-26c4347ef32d","modified":"2026-04-29T14:23:06.131Z","references":[{"source_name":"ESET Turla Mosquito Jan 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--988f5b4b-bfc7-4714-b6f0-f753c0472cab","subject":"ATTACK:enterprise:S0559","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--988f5b4b-bfc7-4714-b6f0-f753c0472cab","modified":"2026-04-29T14:23:06.133Z","references":[{"source_name":"FireEye SUNBURST Backdoor December 2020","url":"https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9a62c02a-e373-494e-af73-f8b3274e8c9b","subject":"ATTACK:enterprise:S0162","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9a62c02a-e373-494e-af73-f8b3274e8c9b","modified":"2026-04-29T14:23:06.136Z","references":[{"source_name":"Sofacy Komplex Trojan","url":"https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9af0d85e-688a-4dd7-a04e-a175e268855c","subject":"ATTACK:enterprise:S0266","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9af0d85e-688a-4dd7-a04e-a175e268855c","modified":"2026-04-29T14:23:06.136Z","references":[{"source_name":"ESET Trickbot Oct 2020","url":"https://www.welivesecurity.com/2020/10/12/eset-takes-part-global-operation-disrupt-trickbot/"},{"source_name":"Bitdefender Trickbot March 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/316/Bitdefender-Whitepaper-TrickBot-en-EN-interactive.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9b5abfd2-7c22-48df-bda3-62648c6cac8c","subject":"ATTACK:enterprise:G1023","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9b5abfd2-7c22-48df-bda3-62648c6cac8c","modified":"2026-07-31T18:48:17.244Z","references":[{"source_name":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9ba9eff2-1471-4395-a2ed-2187aabd893b","subject":"ATTACK:enterprise:G0046","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9ba9eff2-1471-4395-a2ed-2187aabd893b","modified":"2026-07-31T20:48:32.089Z","references":[{"source_name":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9bfcb6e6-6e49-4b58-b09b-8502d27a93ec","subject":"ATTACK:enterprise:C0007","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9bfcb6e6-6e49-4b58-b09b-8502d27a93ec","modified":"2026-07-31T18:47:27.416Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9d1a9a04-6174-4aaa-8fac-43c965f0bd38","subject":"ATTACK:enterprise:S0657","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9d1a9a04-6174-4aaa-8fac-43c965f0bd38","modified":"2026-04-29T14:23:06.139Z","references":[{"source_name":"Volexity InkySquid BLUELIGHT August 2021","url":"https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9dfb7899-20af-4eea-bfca-f608d885cb00","subject":"ATTACK:enterprise:G0010","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9dfb7899-20af-4eea-bfca-f608d885cb00","modified":"2026-07-31T18:48:04.163Z","references":[{"source_name":"Kaspersky Turla","url":"https://securelist.com/the-epic-turla-operation/65545/"},{"source_name":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9f81120a-adde-47cc-95bc-cd8201eb0a11","subject":"ATTACK:enterprise:G0069","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9f81120a-adde-47cc-95bc-cd8201eb0a11","modified":"2026-07-31T20:48:30.076Z","references":[{"source_name":"Securelist MuddyWater Oct 2018","url":"https://securelist.com/muddywater/88059/"},{"source_name":"ClearSky MuddyWater June 2019","url":"https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a0595621-4352-48e6-8ac2-6a7b87b254ac","subject":"ATTACK:enterprise:G1048","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a0595621-4352-48e6-8ac2-6a7b87b254ac","modified":"2026-07-31T18:47:53.971Z","references":[{"source_name":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a3138e56-a496-486d-b11e-5e1c39a9c15d","subject":"ATTACK:enterprise:S0346","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a3138e56-a496-486d-b11e-5e1c39a9c15d","modified":"2026-04-29T14:23:06.147Z","references":[{"source_name":"McAfee Oceansalt Oct 2018","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-oceansalt.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a3d2ef4a-2bca-482d-897b-99da14b16b52","subject":"ATTACK:enterprise:G0106","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a3d2ef4a-2bca-482d-897b-99da14b16b52","modified":"2026-07-31T18:47:52.539Z","references":[{"source_name":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a4c59c09-2abd-4c49-8156-0ccc9214b66e","subject":"ATTACK:enterprise:G0059","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a4c59c09-2abd-4c49-8156-0ccc9214b66e","modified":"2026-07-31T18:48:29.105Z","references":[{"source_name":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a564f3da-349a-4e65-826c-8ca60bc920bf","subject":"ATTACK:enterprise:S0032","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a564f3da-349a-4e65-826c-8ca60bc920bf","modified":"2026-04-29T14:23:06.150Z","references":[{"source_name":"FireEye Hacking Team","url":"https://www.fireeye.com/blog/threat-research/2015/07/demonstrating_hustle.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a570d430-29ea-4c89-b25d-1370b44b0e5a","subject":"ATTACK:enterprise:S1085","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a570d430-29ea-4c89-b25d-1370b44b0e5a","modified":"2026-04-29T14:23:06.150Z","references":[{"source_name":"Bitdefender Sardonic Aug 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a5720510-fadb-496d-97b5-99cdabb051ab","subject":"ATTACK:enterprise:S0431","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a5720510-fadb-496d-97b5-99cdabb051ab","modified":"2026-04-29T14:23:06.150Z","references":[{"source_name":"Carbon Black HotCroissant April 2020","url":"https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a6175b80-3f45-4d17-9e00-67f32b973ea4","subject":"ATTACK:enterprise:S0674","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a6175b80-3f45-4d17-9e00-67f32b973ea4","modified":"2026-04-29T14:23:06.151Z","references":[{"source_name":"Check Point APT35 CharmPower January 2022","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a69bd4c0-ddaa-4dec-a35d-b067ae1d95fc","subject":"ATTACK:enterprise:S0203","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a69bd4c0-ddaa-4dec-a35d-b067ae1d95fc","modified":"2026-04-29T14:23:06.152Z","references":[{"source_name":"Symantec Trojan.Hydraq Jan 2010","url":"https://www.symantec.com/connect/blogs/trojanhydraq-incident"},{"source_name":"Symantec Hydraq Jan 2010","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2010-011114-1830-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a8ef854e-4c3a-4adc-9022-d8d12adc00bb","subject":"ATTACK:enterprise:S1212","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a8ef854e-4c3a-4adc-9022-d8d12adc00bb","modified":"2026-04-29T14:23:06.155Z","references":[{"source_name":"CISA RansomHub AUG 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-242a-stopransomware-ransomhub-ransomware_1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a969a06c-523f-4cde-a92c-539dd1c003f9","subject":"ATTACK:enterprise:S0617","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a969a06c-523f-4cde-a92c-539dd1c003f9","modified":"2026-04-29T14:23:06.156Z","references":[{"source_name":"FireEye FiveHands April 2021","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a9b92f28-c273-48cf-8ee6-dfa6c240cda9","subject":"ATTACK:enterprise:G0067","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a9b92f28-c273-48cf-8ee6-dfa6c240cda9","modified":"2026-07-31T18:47:55.607Z","references":[{"source_name":"Talos Group123","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ab2602d5-a3f5-45d2-a522-9b4f87bc7a24","subject":"ATTACK:enterprise:S0428","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ab2602d5-a3f5-45d2-a522-9b4f87bc7a24","modified":"2026-04-29T14:23:06.158Z","references":[{"source_name":"Talos PoetRAT April 2020","url":"https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aca452f1-d08e-4975-81b2-e93b56910d67","subject":"ATTACK:enterprise:S0694","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aca452f1-d08e-4975-81b2-e93b56910d67","modified":"2026-04-29T14:23:06.160Z","references":[{"source_name":"ClearSky Lazarus Aug 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ae05ae0a-7806-491a-8350-33600df44d2a","subject":"ATTACK:enterprise:S0672","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ae05ae0a-7806-491a-8350-33600df44d2a","modified":"2026-04-29T14:23:06.162Z","references":[{"source_name":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--af340193-ba4f-47bf-a610-54235946ee1c","subject":"ATTACK:enterprise:S1122","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--af340193-ba4f-47bf-a610-54235946ee1c","modified":"2026-04-29T14:23:06.164Z","references":[{"source_name":"ESET Security Mispadu Facebook Ads 2019","url":"https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--af766021-c066-416c-80ba-9687f5641457","subject":"ATTACK:enterprise:S0652","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--af766021-c066-416c-80ba-9687f5641457","modified":"2026-04-29T14:23:06.164Z","references":[{"source_name":"Kaspersky Ferocious Kitten Jun 2021","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--afffac16-cc57-4b01-8325-d88ab73454e1","subject":"ATTACK:enterprise:S0477","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--afffac16-cc57-4b01-8325-d88ab73454e1","modified":"2026-04-29T14:23:06.165Z","references":[{"source_name":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b0147ed6-a725-4899-82dd-4675aeecbd72","subject":"ATTACK:enterprise:S0660","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b0147ed6-a725-4899-82dd-4675aeecbd72","modified":"2026-04-29T14:23:06.165Z","references":[{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b1931423-21a7-441b-b0c4-5db519b302ad","subject":"ATTACK:enterprise:S1146","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b1931423-21a7-441b-b0c4-5db519b302ad","modified":"2026-04-29T14:23:06.168Z","references":[{"source_name":"Symantec Daggerfly 2023","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b3b7d3f8-a161-4e47-98d6-090bf128c5a1","subject":"ATTACK:enterprise:S9023","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b3b7d3f8-a161-4e47-98d6-090bf128c5a1","modified":"2026-04-29T14:23:06.171Z","references":[{"source_name":"ESET HiddenFace 2024","url":"https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_2_8_Breitenbacher_en.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b418e034-9fdd-4238-8c6a-3ad7bf249ead","subject":"ATTACK:enterprise:S1191","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b418e034-9fdd-4238-8c6a-3ad7bf249ead","modified":"2026-04-29T14:23:06.171Z","references":[{"source_name":"Palo Alto Howling Scorpius DEC 2024","url":"https://unit42.paloaltonetworks.com/threat-assessment-howling-scorpius-akira-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b5744487-e865-4ff2-9d69-e98c1148aade","subject":"ATTACK:enterprise:S0464","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b5744487-e865-4ff2-9d69-e98c1148aade","modified":"2026-04-29T14:23:06.173Z","references":[{"source_name":"Unit 42 CARROTBAT January 2020","url":"https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b6ae274b-f0b3-4694-ab8d-37e0c62cff35","subject":"ATTACK:enterprise:S0093","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b6ae274b-f0b3-4694-ab8d-37e0c62cff35","modified":"2026-04-29T14:23:06.175Z","references":[{"source_name":"Symantec Dragonfly","url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b72be1af-b4d0-4607-8f97-377d23ddbb36","subject":"ATTACK:enterprise:S0503","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b72be1af-b4d0-4607-8f97-377d23ddbb36","modified":"2026-04-29T14:23:06.175Z","references":[{"source_name":"SentinelOne FrameworkPOS September 2019","url":"https://labs.sentinelone.com/fin6-frameworkpos-point-of-sale-malware-analysis-internals-2/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b82f51f9-74a0-43e1-b3c6-63df3a90c9eb","subject":"ATTACK:enterprise:S0127","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b82f51f9-74a0-43e1-b3c6-63df3a90c9eb","modified":"2026-04-29T14:23:06.177Z","references":[{"source_name":"Palo Alto Networks BBSRAT","url":"http://researchcenter.paloaltonetworks.com/2015/12/bbsrat-attacks-targeting-russian-organizations-linked-to-roaming-tiger/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b9e42e0a-e779-4491-b107-a064254a7da3","subject":"ATTACK:enterprise:S0247","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b9e42e0a-e779-4491-b107-a064254a7da3","modified":"2026-04-29T14:23:06.179Z","references":[{"source_name":"Talos NavRAT May 2018","url":"https://blog.talosintelligence.com/2018/05/navrat.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ba7a0a7d-3a54-480f-86ce-f92d29dbabe1","subject":"ATTACK:enterprise:G0094","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ba7a0a7d-3a54-480f-86ce-f92d29dbabe1","modified":"2026-07-31T20:48:25.395Z","references":[{"source_name":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source_name":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bb005145-438c-4fd8-9cac-a636df7465da","subject":"ATTACK:enterprise:S0161","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bb005145-438c-4fd8-9cac-a636df7465da","modified":"2026-04-29T14:23:06.181Z","references":[{"source_name":"XAgentOSX 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bb54d492-228c-4bfe-8e50-9a919067e976","subject":"ATTACK:enterprise:S1018","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bb54d492-228c-4bfe-8e50-9a919067e976","modified":"2026-04-29T14:23:06.181Z","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--be366a5f-308d-42aa-ae76-f14dbbb8b136","subject":"ATTACK:enterprise:S0567","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--be366a5f-308d-42aa-ae76-f14dbbb8b136","modified":"2026-04-29T14:23:06.185Z","references":[{"source_name":"Securelist Dtrack","url":"https://securelist.com/my-name-is-dtrack/93338/"},{"source_name":"CyberBit Dtrack","url":"https://www.cyberbit.com/blog/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bfa1942d-31b1-454f-b1db-be67550f82ee","subject":"ATTACK:enterprise:S1100","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bfa1942d-31b1-454f-b1db-be67550f82ee","modified":"2026-04-29T14:23:06.187Z","references":[{"source_name":"Kaspersky ToddyCat June 2022","url":"https://securelist.com/toddycat/106799/"},{"source_name":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bfad86a1-f8bb-45eb-b7b9-5919ca4ef886","subject":"ATTACK:enterprise:S0452","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bfad86a1-f8bb-45eb-b7b9-5919ca4ef886","modified":"2026-04-29T14:23:06.187Z","references":[{"source_name":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c052113d-2552-48fc-8deb-d6965d85f547","subject":"ATTACK:enterprise:S1124","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c052113d-2552-48fc-8deb-d6965d85f547","modified":"2026-04-29T14:23:06.188Z","references":[{"source_name":"Secureworks Gold Prelude Profile","url":"https://www.secureworks.com/research/threat-profiles/gold-prelude"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c0f3f4f3-e435-443f-aa89-18afb0115055","subject":"ATTACK:enterprise:S0236","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c0f3f4f3-e435-443f-aa89-18afb0115055","modified":"2026-04-29T14:23:06.189Z","references":[{"source_name":"Symantec Orangeworm April 2018","url":"https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c0fc62bc-ac39-4840-968d-8a3f8f3ce6a0","subject":"ATTACK:enterprise:S1039","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c0fc62bc-ac39-4840-968d-8a3f8f3ce6a0","modified":"2026-04-29T14:23:06.189Z","references":[{"source_name":"Symantec Bumblebee June 2022","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime"},{"source_name":"Proofpoint Bumblebee April 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"},{"source_name":"Medium Ali Salem Bumblebee April 2022","url":"https://elis531989.medium.com/the-chronicles-of-bumblebee-the-hook-the-bee-and-the-trickbot-connection-686379311056"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c1cbaa0f-59d2-4b49-a91f-c21bff7ca009","subject":"ATTACK:enterprise:S0194","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c1cbaa0f-59d2-4b49-a91f-c21bff7ca009","modified":"2026-04-29T14:23:06.190Z","references":[{"source_name":"GitHub PowerSploit May 2012","url":"https://github.com/PowerShellMafia/PowerSploit"},{"source_name":"PowerSploit Documentation","url":"http://powersploit.readthedocs.io"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c253f0c5-1802-4853-b93f-c426d2a48fae","subject":"ATTACK:enterprise:S0625","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c253f0c5-1802-4853-b93f-c426d2a48fae","modified":"2026-04-29T14:23:06.191Z","references":[{"source_name":"McAfee Cuba April 2021","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c29136ea-6925-4fc5-a281-b5351cef050d","subject":"ATTACK:enterprise:S0270","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c29136ea-6925-4fc5-a281-b5351cef050d","modified":"2026-04-29T14:23:06.191Z","references":[{"source_name":"Unit 42 DarkHydrus July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c32cb7ce-20a0-43d9-b600-d44ef0254aa8","subject":"ATTACK:enterprise:S1202","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c32cb7ce-20a0-43d9-b600-d44ef0254aa8","modified":"2026-04-29T14:23:06.192Z","references":[{"source_name":"Joint Cybersecurity Advisory LockBit JUN 2023","url":"https://www.cisa.gov/sites/default/files/2023-06/aa23-165a_understanding_TA_LockBit_0.pdf"},{"source_name":"Sentinel Labs LockBit 3.0 JUL 2022","url":"https://www.sentinelone.com/labs/lockbit-3-0-update-unpicking-the-ransomwares-latest-anti-analysis-and-evasion-techniques"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c407e138-4e68-46e9-b41d-4447a282a1fd","subject":"ATTACK:enterprise:S0238","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c407e138-4e68-46e9-b41d-4447a282a1fd","modified":"2026-04-29T14:23:06.193Z","references":[{"source_name":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c434aa66-8fd2-47f0-8ec4-88a866d99e88","subject":"ATTACK:enterprise:S1090","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c434aa66-8fd2-47f0-8ec4-88a866d99e88","modified":"2026-04-29T14:23:06.193Z","references":[{"source_name":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c54e60c1-728d-4211-b309-89f928ae7f0a","subject":"ATTACK:enterprise:S0449","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c54e60c1-728d-4211-b309-89f928ae7f0a","modified":"2026-04-29T14:23:06.195Z","references":[{"source_name":"McAfee Maze March 2020","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-maze/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c5dffed7-7e56-4cee-8f96-065b4718000d","subject":"ATTACK:enterprise:S0644","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c5dffed7-7e56-4cee-8f96-065b4718000d","modified":"2026-04-29T14:23:06.196Z","references":[{"source_name":"Talos Oblique RAT March 2021","url":"https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c60fb662-befd-459b-906b-b816b76a727a","subject":"ATTACK:enterprise:S1064","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c60fb662-befd-459b-906b-b816b76a727a","modified":"2026-04-29T14:23:06.196Z","references":[{"source_name":"HP SVCReady Jun 2022","url":"https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c6c5a455-14da-4d6f-8149-c0dc3bbd6f56","subject":"ATTACK:enterprise:G0126","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c6c5a455-14da-4d6f-8149-c0dc3bbd6f56","modified":"2026-07-31T18:47:56.836Z","references":[{"source_name":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c6f81350-a410-4ac7-a4b0-58bd4a9c1d9e","subject":"ATTACK:enterprise:G0033","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c6f81350-a410-4ac7-a4b0-58bd4a9c1d9e","modified":"2026-07-31T18:48:05.267Z","references":[{"source_name":"Kaspersky Poseidon Group","url":"https://securelist.com/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/73673/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c722836d-2518-4ecb-a0ff-af36e1195d33","subject":"ATTACK:enterprise:S1164","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c722836d-2518-4ecb-a0ff-af36e1195d33","modified":"2026-04-29T14:23:06.197Z","references":[{"source_name":"Palo Alto MidnightEclipse APR 2024","url":"https://unit42.paloaltonetworks.com/cve-2024-3400/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c7e6d4a6-8d99-4134-848a-f4f712eb4316","subject":"ATTACK:enterprise:G0004","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c7e6d4a6-8d99-4134-848a-f4f712eb4316","modified":"2026-07-31T18:48:01.686Z","references":[{"source_name":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"},{"source_name":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c85af3d4-ab10-4c49-91c4-bff9054096b8","subject":"ATTACK:enterprise:S0595","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c85af3d4-ab10-4c49-91c4-bff9054096b8","modified":"2026-04-29T14:23:06.199Z","references":[{"source_name":"wardle evilquest parti","url":"https://objective-see.com/blog/blog_0x59.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c8ce3bcd-b74f-497d-8f76-cc8c7333ab49","subject":"ATTACK:enterprise:S0063","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c8ce3bcd-b74f-497d-8f76-cc8c7333ab49","modified":"2026-04-29T14:23:06.200Z","references":[{"source_name":"Palo Alto CVE-2015-3113 July 2015","url":"http://researchcenter.paloaltonetworks.com/2015/07/ups-observations-on-cve-2015-3113-prior-zero-days-and-the-pirpi-payload/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c9fa803b-3d37-49bc-b0b3-ec409ad372fa","subject":"ATTACK:enterprise:S0627","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c9fa803b-3d37-49bc-b0b3-ec409ad372fa","modified":"2026-04-29T14:23:06.201Z","references":[{"source_name":"Securelist APT10 March 2021","url":"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cca0aac6-bdc2-48da-9b95-c24e41f5a116","subject":"ATTACK:enterprise:G1001","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cca0aac6-bdc2-48da-9b95-c24e41f5a116","modified":"2026-07-31T20:48:51.903Z","references":[{"source_name":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cd68ff0c-88c9-4a71-82ff-f16da53ed8ed","subject":"ATTACK:enterprise:S0533","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cd68ff0c-88c9-4a71-82ff-f16da53ed8ed","modified":"2026-04-29T14:23:06.206Z","references":[{"source_name":"CISA MAR SLOTHFULMEDIA October 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cd91751c-a2a2-4626-bb31-b95fd0040818","subject":"ATTACK:enterprise:S0638","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cd91751c-a2a2-4626-bb31-b95fd0040818","modified":"2026-04-29T14:23:06.206Z","references":[{"source_name":"Sogeti CERT ESEC Babuk March 2021","url":"https://www.sogeti.com/globalassets/reports/cybersecchronicles_-_babuk.pdf"},{"source_name":"McAfee Babuk February 2021","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-babuk-ransomware.pdf"},{"source_name":"Trend Micro Ransomware February 2021","url":"https://www.trendmicro.com/en_us/research/21/b/new-in-ransomware.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cece5cb5-3837-4551-be22-5c27b63eae63","subject":"ATTACK:enterprise:G0100","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cece5cb5-3837-4551-be22-5c27b63eae63","modified":"2026-07-31T18:48:25.419Z","references":[{"source_name":"Symantec Inception Framework March 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ced0348f-1bc8-461b-8123-a1b3aeb38e94","subject":"ATTACK:enterprise:S0011","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ced0348f-1bc8-461b-8123-a1b3aeb38e94","modified":"2026-04-29T14:23:06.208Z","references":[{"source_name":"CISA MAR-10292089-1.v2 TAIDOOR August 2021","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d0a7119c-b59c-491a-bd02-f8f8733e0302","subject":"ATTACK:enterprise:S9036","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d0a7119c-b59c-491a-bd02-f8f8733e0302","modified":"2026-04-29T14:23:06.211Z","references":[{"source_name":"ESET_MuddyWater_Dec2025","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d0c15113-67a0-4f02-8a92-d22165642d40","subject":"ATTACK:enterprise:S0461","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d0c15113-67a0-4f02-8a92-d22165642d40","modified":"2026-04-29T14:23:06.211Z","references":[{"source_name":"Korean FSI TA505 2020","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d2638428-d31e-4ea4-80e1-26c9c25472d6","subject":"ATTACK:enterprise:S0216","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d2638428-d31e-4ea4-80e1-26c9c25472d6","modified":"2026-04-29T14:23:06.213Z","references":[{"source_name":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d33b14b1-7501-4bb3-af8c-3e2202fa572f","subject":"ATTACK:enterprise:S1129","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d33b14b1-7501-4bb3-af8c-3e2202fa572f","modified":"2026-04-29T14:23:06.214Z","references":[{"source_name":"Kersten Akira 2023","url":"https://www.trellix.com/blogs/research/akira-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d45006be-8b4d-4eab-a76a-f940fecf83f9","subject":"ATTACK:enterprise:S0332","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d45006be-8b4d-4eab-a76a-f940fecf83f9","modified":"2026-04-29T14:23:06.215Z","references":[{"source_name":"Fortinet Remcos Campaign NOV 2024","url":"https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d46078a7-420b-4074-8ecb-3440737c12e4","subject":"ATTACK:enterprise:S0385","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d46078a7-420b-4074-8ecb-3440737c12e4","modified":"2026-04-29T14:23:06.216Z","references":[{"source_name":"Trend Micro njRAT 2018","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/autoit-compiled-worm-affecting-removable-media-delivers-fileless-version-of-bladabindi-njrat-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d531b421-7347-4dd6-9a98-0b05e6421b40","subject":"ATTACK:enterprise:S1087","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d531b421-7347-4dd6-9a98-0b05e6421b40","modified":"2026-04-29T14:23:06.217Z","references":[{"source_name":"Telefonica Snip3 December 2021","url":"https://telefonicatech.com/blog/snip3-investigacion-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d878a055-0053-45a9-a724-52f59e0486c7","subject":"ATTACK:enterprise:S0182","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d878a055-0053-45a9-a724-52f59e0486c7","modified":"2026-04-29T14:23:06.221Z","references":[{"source_name":"Microsoft FinFisher March 2018","url":"https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/"},{"source_name":"FinFisher Citation","url":"https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d8e375a3-f455-4c66-bc63-251f320ec8b1","subject":"ATTACK:enterprise:G0049","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d8e375a3-f455-4c66-bc63-251f320ec8b1","modified":"2026-07-31T20:48:35.900Z","references":[{"source_name":"Palo Alto OilRig May 2016","url":"http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"},{"source_name":"Symantec Crambus OCT 2023","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d9b4c254-8e05-4410-ae4d-a47f55e6bf51","subject":"ATTACK:enterprise:S0579","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d9b4c254-8e05-4410-ae4d-a47f55e6bf51","modified":"2026-04-29T14:23:06.222Z","references":[{"source_name":"Trend Micro Waterbear December 2019","url":"https://www.trendmicro.com/en_us/research/19/l/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--da7fb67f-3cb2-498d-a832-f98622bc9ee2","subject":"ATTACK:enterprise:S0242","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--da7fb67f-3cb2-498d-a832-f98622bc9ee2","modified":"2026-04-29T14:23:06.223Z","references":[{"source_name":"SecureList SynAck Doppelgänging May 2018","url":"https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/"},{"source_name":"Kaspersky Lab SynAck May 2018","url":"https://usa.kaspersky.com/about/press-releases/2018_synack-doppelganging"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--daf56e8e-ea82-4ef2-bb03-78dd7e6ef3c0","subject":"ATTACK:enterprise:G0022","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--daf56e8e-ea82-4ef2-bb03-78dd7e6ef3c0","modified":"2026-07-31T18:47:38.227Z","references":[{"source_name":"FireEye Clandestine Fox","url":"https://www.fireeye.com/blog/threat-research/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html"},{"source_name":"evolution of pirpi","url":"https://recon.cx/2017/montreal/resources/slides/RECON-MTL-2017-evolution_of_pirpi.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--db219581-f2fc-45f9-846d-c7e6f6d238ce","subject":"ATTACK:enterprise:S1078","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--db219581-f2fc-45f9-846d-c7e6f6d238ce","modified":"2026-04-29T14:23:06.224Z","references":[{"source_name":"RotaJakiro 2021 netlab360 analysis","url":"https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--db75183b-9ad3-41e4-9730-f0bba5ef55c1","subject":"ATTACK:enterprise:S0022","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--db75183b-9ad3-41e4-9730-f0bba5ef55c1","modified":"2026-04-29T14:23:06.225Z","references":[{"source_name":"Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023","url":"https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dd4da2e6-a54b-4420-9ed6-ebb3080bd2f8","subject":"ATTACK:enterprise:S0435","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dd4da2e6-a54b-4420-9ed6-ebb3080bd2f8","modified":"2026-04-29T14:23:06.227Z","references":[{"source_name":"TrendMicro BlackTech June 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dd78a0f9-98c4-4074-8fce-4bef68d53f14","subject":"ATTACK:enterprise:S9031","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dd78a0f9-98c4-4074-8fce-4bef68d53f14","modified":"2026-04-29T14:23:06.227Z","references":[{"source_name":"Palo Alto Ashen Lepus DEC 2025","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--de0ee6e1-6b97-40be-b036-5339db13e6e4","subject":"ATTACK:enterprise:S0491","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--de0ee6e1-6b97-40be-b036-5339db13e6e4","modified":"2026-09-03T14:50:24.133Z","references":[{"source_name":"Talos Promethium June 2020","url":"https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--df0d2dad-d384-4501-b2bc-659a7877489b","subject":"ATTACK:enterprise:S0599","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--df0d2dad-d384-4501-b2bc-659a7877489b","modified":"2026-04-29T14:23:06.229Z","references":[{"source_name":"Aqua Kinsing April 2020","url":"https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--df83b388-66bd-4504-a051-7a7800a8e5cb","subject":"ATTACK:enterprise:S9053","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--df83b388-66bd-4504-a051-7a7800a8e5cb","modified":"2026-09-24T22:23:26.734Z","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dfe4c167-8e69-4b15-912f-ccd437674423","subject":"ATTACK:enterprise:G0047","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dfe4c167-8e69-4b15-912f-ccd437674423","modified":"2026-07-31T18:47:48.127Z","references":[{"source_name":"Symantec Shuckworm January 2022","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine"},{"source_name":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"},{"source_name":"Unit 42 Gamaredon February 2022","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e0495ed2-62d6-4fd7-9c9b-e57d3c99fd9a","subject":"ATTACK:enterprise:S0692","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e0495ed2-62d6-4fd7-9c9b-e57d3c99fd9a","modified":"2026-04-29T14:23:06.231Z","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e169d920-59ab-4a07-928e-858b878fd7bc","subject":"ATTACK:enterprise:C0006","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e169d920-59ab-4a07-928e-858b878fd7bc","modified":"2026-07-31T18:47:21.211Z","references":[{"source_name":"McAfee Honeybee","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e2753d61-40d9-45b3-884a-a4c63b1da476","subject":"ATTACK:enterprise:S0396","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e2753d61-40d9-45b3-884a-a4c63b1da476","modified":"2026-04-29T14:23:06.234Z","references":[{"source_name":"Cyphort EvilBunny Dec 2014","url":"https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e29fa4df-f835-48e1-a83b-279818993793","subject":"ATTACK:enterprise:S0333","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e29fa4df-f835-48e1-a83b-279818993793","modified":"2026-04-29T14:23:06.234Z","references":[{"source_name":"PaloAlto UBoatRAT Nov 2017","url":"https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e39eb7ad-f233-4c22-8707-aaf600f42100","subject":"ATTACK:enterprise:S0367","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e39eb7ad-f233-4c22-8707-aaf600f42100","modified":"2026-04-29T14:23:06.235Z","references":[{"source_name":"ASEC Emotet 2017","url":"https://global.ahnlab.com/global/upload/download/asecreport/ASEC%20REPORT_vol.88_ENG.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e53818ed-808a-46f6-a266-098f19895379","subject":"ATTACK:enterprise:C0012","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e53818ed-808a-46f6-a266-098f19895379","modified":"2026-07-31T18:47:28.675Z","references":[{"source_name":"Cybereason OperationCuckooBees May 2022","url":"https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-winnti-techniques"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e6f2f304-e637-4636-a238-b30904ce11fc","subject":"ATTACK:enterprise:S0335","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e6f2f304-e637-4636-a238-b30904ce11fc","modified":"2026-04-29T14:23:06.239Z","references":[{"source_name":"ESET Carbon Mar 2017","url":"https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e6f69552-fe0e-4b40-ad20-4410048277e6","subject":"ATTACK:enterprise:S0144","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e6f69552-fe0e-4b40-ad20-4410048277e6","modified":"2026-04-29T14:23:06.239Z","references":[{"source_name":"Palo Alto menuPass Feb 2017","url":"http://researchcenter.paloaltonetworks.com/2017/02/unit42-menupass-returns-new-malware-new-attacks-japanese-academics-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e7cd2966-db55-4214-abcc-78b5bc1e00cd","subject":"ATTACK:enterprise:S1017","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e7cd2966-db55-4214-abcc-78b5bc1e00cd","modified":"2026-04-29T14:23:06.240Z","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e8cb4430-db05-4029-b011-926a2ba17a4c","subject":"ATTACK:enterprise:G0044","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e8cb4430-db05-4029-b011-926a2ba17a4c","modified":"2026-07-31T18:48:18.827Z","references":[{"source_name":"Kaspersky Winnti April 2013","url":"https://securelist.com/winnti-more-than-just-a-game/37029/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e9a96b5e-5d6c-46c7-85df-ff16d1efeb4d","subject":"ATTACK:enterprise:S0681","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e9a96b5e-5d6c-46c7-85df-ff16d1efeb4d","modified":"2026-04-29T14:23:06.243Z","references":[{"source_name":"BiZone Lizar May 2021","url":"https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"},{"source_name":"Threatpost Lizar May 2021","url":"https://threatpost.com/fin7-backdoor-ethical-hacking-tool/166194/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eac61f60-a87d-4f83-b5e0-64542efeca6b","subject":"ATTACK:enterprise:S0455","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eac61f60-a87d-4f83-b5e0-64542efeca6b","modified":"2026-04-29T14:23:06.245Z","references":[{"source_name":"Medium Metamorfo Apr 2020","url":"https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eacc205b-b8f9-4427-b8bd-3eba5a5a6179","subject":"ATTACK:enterprise:S0575","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eacc205b-b8f9-4427-b8bd-3eba5a5a6179","modified":"2026-04-29T14:23:06.245Z","references":[{"source_name":"CarbonBlack Conti July 2020","url":"https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eb1c808f-5806-4169-bd41-6ea7c7f17ffb","subject":"ATTACK:enterprise:S0260","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eb1c808f-5806-4169-bd41-6ea7c7f17ffb","modified":"2026-04-29T14:23:06.245Z","references":[{"source_name":"ESET InvisiMole June 2018","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"},{"source_name":"ESET InvisiMole June 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eb6ecbe4-07fc-4c45-9da8-fab737e300c3","subject":"ATTACK:enterprise:S0273","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eb6ecbe4-07fc-4c45-9da8-fab737e300c3","modified":"2026-04-29T14:23:06.246Z","references":[{"source_name":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ecf30cb0-3183-4ed4-bb33-da604ea6a65e","subject":"ATTACK:enterprise:S0154","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ecf30cb0-3183-4ed4-bb33-da604ea6a65e","modified":"2026-04-29T14:23:06.247Z","references":[{"source_name":"Talos Cobalt Strike September 2020","url":"https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf"},{"source_name":"cobaltstrike manual","url":"https://web.archive.org/web/20210825130434/https://cobaltstrike.com/downloads/csmanual38.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ed51de86-8e28-4436-a663-94b66f22a7df","subject":"ATTACK:enterprise:S0348","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ed51de86-8e28-4436-a663-94b66f22a7df","modified":"2026-04-29T14:23:06.248Z","references":[{"source_name":"PaloAlto CardinalRat Apr 2017","url":"https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--edb14d5c-992a-4cd0-a0f3-b2db3f6b813c","subject":"ATTACK:enterprise:S1233","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--edb14d5c-992a-4cd0-a0f3-b2db3f6b813c","modified":"2026-04-29T14:23:06.249Z","references":[{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ee565652-51c8-4fe8-bb05-682c6942485a","subject":"ATTACK:enterprise:S0363","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ee565652-51c8-4fe8-bb05-682c6942485a","modified":"2026-04-29T14:23:06.249Z","references":[{"source_name":"Talos Frankenstein June 2019","url":"https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html"},{"source_name":"Github PowerShell Empire","url":"https://github.com/PowerShellEmpire/Empire"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ef8d7ed3-805a-4edd-a4e9-74c6520594de","subject":"ATTACK:enterprise:S0693","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ef8d7ed3-805a-4edd-a4e9-74c6520594de","modified":"2026-04-29T14:23:06.251Z","references":[{"source_name":"Malwarebytes IssacWiper CaddyWiper March 2022 ","url":"https://blog.malwarebytes.com/threat-intelligence/2022/03/double-header-isaacwiper-and-caddywiper/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f017f6c0-96f4-46f1-905f-44e9950effbc","subject":"ATTACK:enterprise:S0021","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f017f6c0-96f4-46f1-905f-44e9950effbc","modified":"2026-04-29T14:23:06.252Z","references":[{"source_name":"Fidelis Turbo","url":"https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2016/2016.02.29.Turbo_Campaign_Derusbi/TA_Fidelis_Turbo_1602_0.pdf"},{"source_name":"FireEye Periscope March 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f07c1f84-a2c0-4c47-904d-ce96b36307f0","subject":"ATTACK:enterprise:S0688","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f07c1f84-a2c0-4c47-904d-ce96b36307f0","modified":"2026-04-29T14:23:06.252Z","references":[{"source_name":"Check Point Meteor Aug 2021","url":"https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f0a36615-b3eb-47d5-8a2a-9d7429643a0a","subject":"ATTACK:enterprise:S1073","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f0a36615-b3eb-47d5-8a2a-9d7429643a0a","modified":"2026-04-29T14:23:06.252Z","references":[{"source_name":"Cybereason Royal December 2022","url":"https://www.cybereason.com/blog/royal-ransomware-analysis"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f0cf3ea2-5345-48d7-9685-be0180eb0e4a","subject":"ATTACK:enterprise:S0148","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f0cf3ea2-5345-48d7-9685-be0180eb0e4a","modified":"2026-04-29T14:23:06.252Z","references":[{"source_name":"ESET RTM Feb 2017","url":"https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f14f7949-81d3-4730-91cf-263ef8487708","subject":"ATTACK:enterprise:S0696","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f14f7949-81d3-4730-91cf-263ef8487708","modified":"2026-04-29T14:23:06.253Z","references":[{"source_name":"NTT Security Flagpro new December 2021","url":"https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f1b29d7e-eba7-460a-bcec-33caf6a4fe15","subject":"ATTACK:enterprise:S1048","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f1b29d7e-eba7-460a-bcec-33caf6a4fe15","modified":"2026-04-29T14:23:06.254Z","references":[{"source_name":"SentinelLabs reversing run-only applescripts 2021","url":"https://www.sentinelone.com/labs/fade-dead-adventures-in-reversing-malicious-run-only-applescripts/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f2a696d7-b929-4307-9f2b-df558a7762cb","subject":"ATTACK:enterprise:S1139","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f2a696d7-b929-4307-9f2b-df558a7762cb","modified":"2026-06-12T19:52:54.217Z","references":[{"source_name":"Cybereason INC Ransomware November 2023","url":"https://web.archive.org/web/20231202022946/https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f33725f4-cce5-4868-b494-d73419c76bdf","subject":"ATTACK:enterprise:S0062","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f33725f4-cce5-4868-b494-d73419c76bdf","modified":"2026-04-29T14:23:06.256Z","references":[{"source_name":"DustySky","url":"https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"},{"source_name":"Kaspersky MoleRATs April 2019","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f4d825cd-08d4-47ad-975c-37b886192e7c","subject":"ATTACK:enterprise:G0082","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f4d825cd-08d4-47ad-975c-37b886192e7c","modified":"2026-09-30T19:00:15.551Z","references":[{"source_name":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"},{"source_name":"Microsoft Axios Compromise APR 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/"},{"source_name":"Microsoft Sapphire Sleet APR 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"},{"source_name":"MIcrosoft Mastra npm Compromise JUN 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f503ea13-d045-4246-9674-a73f7e52ea85","subject":"ATTACK:enterprise:S0344","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f503ea13-d045-4246-9674-a73f7e52ea85","modified":"2026-04-29T14:23:06.258Z","references":[{"source_name":"Unit42 Azorult Nov 2018","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-new-wine-old-bottle-new-azorult-variant-found-findmyname-campaign-using-fallout-exploit-kit/"},{"source_name":"Proofpoint Azorult July 2018","url":"https://www.proofpoint.com/us/threat-insight/post/new-version-azorult-stealer-improves-loading-features-spreads-alongside"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f6030347-c316-4c5c-b7ce-84c39aa09f85","subject":"ATTACK:enterprise:S0486","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f6030347-c316-4c5c-b7ce-84c39aa09f85","modified":"2026-04-29T14:23:06.259Z","references":[{"source_name":"ESET ForSSHe December 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f6247612-3255-44eb-860f-e882ee1f36f6","subject":"ATTACK:enterprise:S0257","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f6247612-3255-44eb-860f-e882ee1f36f6","modified":"2026-04-29T14:23:06.260Z","references":[{"source_name":"Unit 42 VERMIN Jan 2018","url":"https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f636aad5-3d15-4e0a-b932-8ff77aab0404","subject":"ATTACK:enterprise:S1178","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f636aad5-3d15-4e0a-b932-8ff77aab0404","modified":"2026-04-29T14:23:06.260Z","references":[{"source_name":"Splunk ShrinkLocker 2024","url":"https://www.splunk.com/en_us/blog/security/shrinklocker-malware-abusing-bitlocker-to-lock-your-data.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f6ac9b3a-9a1f-40be-b541-bcdb8aac6845","subject":"ATTACK:enterprise:S0445","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f6ac9b3a-9a1f-40be-b541-bcdb8aac6845","modified":"2026-04-29T14:23:06.260Z","references":[{"source_name":"FOX-IT May 2016 Mofang","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f83167c8-b964-44d2-b370-5f5e86460568","subject":"ATTACK:enterprise:S0484","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f83167c8-b964-44d2-b370-5f5e86460568","modified":"2026-04-29T14:23:06.262Z","references":[{"source_name":"Trusteer Carberp October 2010","url":"https://web.archive.org/web/20111004014029/http://www.trusteer.com/sites/default/files/Carberp_Analysis.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f83fb52a-03f5-4e70-9e08-3365c85c84ba","subject":"ATTACK:enterprise:S1053","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f83fb52a-03f5-4e70-9e08-3365c85c84ba","modified":"2026-04-29T14:23:06.262Z","references":[{"source_name":"Malwarebytes AvosLocker Jul 2021","url":"https://www.malwarebytes.com/blog/threat-intelligence/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fa2a7222-e9b1-4e97-82da-42a9c4014bdd","subject":"ATTACK:enterprise:S0192","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fa2a7222-e9b1-4e97-82da-42a9c4014bdd","modified":"2026-04-29T14:23:06.265Z","references":[{"source_name":"GitHub Pupy","url":"https://github.com/n1nj4sec/pupy"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fbfb4e97-11d5-497a-8d57-a9ebe5254f56","subject":"ATTACK:enterprise:S0600","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fbfb4e97-11d5-497a-8d57-a9ebe5254f56","modified":"2026-04-29T14:23:06.267Z","references":[{"source_name":"Intezer Doki July 20","url":"https://www.intezer.com/blog/cloud-security/watch-your-containers-doki-infecting-docker-servers-in-the-cloud/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fe7c5c1c-b5b2-4770-911c-415839d5ede4","subject":"ATTACK:enterprise:C0014","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fe7c5c1c-b5b2-4770-911c-415839d5ede4","modified":"2026-07-31T18:47:31.980Z","references":[{"source_name":"FoxIT Wocao December 2019","url":"https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ff3b4b17-7d3f-43a9-8e9a-ce56909da725","subject":"ATTACK:enterprise:S0223","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ff3b4b17-7d3f-43a9-8e9a-ce56909da725","modified":"2026-04-29T14:23:06.271Z","references":[{"source_name":"TrendMicro POWERSTATS V3 June 2019","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ff9ae60d-7d27-4fa9-9019-3f906307ec1d","subject":"ATTACK:enterprise:S9050","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ff9ae60d-7d27-4fa9-9019-3f906307ec1d","modified":"2026-09-11T19:40:12.531Z","references":[{"source_name":"Cyfirma_Vidar_June2024","url":"https://www.cyfirma.com/research/vidar-stealer-an-in-depth-analysis-of-an-information-stealing-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}