{"record":{"id":"ATTACK:enterprise:T1071.004","title":"DNS","type":"Subtechnique","source_url":"https://attack.mitre.org/techniques/T1071/004","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--1996eef1-ced3-4d7f-bf94-33298cabbf72","external_id":"T1071.004","domain":"enterprise","created":"2020-03-15T16:27:31.768Z","modified":"2026-09-03T19:46:40.083Z","version":"1.4","aliases":[],"tactics":["command-and-control"],"source_references":[{"source_name":"Medium DnsTunneling","url":"https://medium.com/@galolbardes/learn-how-easy-is-to-bypass-firewalls-using-dns-tunneling-and-also-how-to-block-it-3ed652f4a000"},{"source_name":"University of Birmingham C2","url":"https://arxiv.org/pdf/1408.1136"},{"source_name":"OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government","url":"https://unit42.paloaltonetworks.com/unit42-oilrig-uses-updated-bondupdater-target-middle-eastern-government/"},{"source_name":"PAN DNS Tunneling","url":"https://www.paloaltonetworks.com/cyberpedia/what-is-dns-tunneling"},{"source_name":"DNS Beacons","url":"https://vercara.digicert.com/resources/dns-beacons#page_top"}]},"assertions":[{"id":"enterprise:relationship--00aa618f-bcfa-4649-8436-134f9d01e43c","subject":"ATTACK:enterprise:S0477","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--00aa618f-bcfa-4649-8436-134f9d01e43c","modified":"2026-09-03T19:46:46.470Z","references":[{"source_name":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--01292102-1f89-4358-b62c-bc0afd49fc52","subject":"ATTACK:enterprise:S0269","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--01292102-1f89-4358-b62c-bc0afd49fc52","modified":"2026-09-03T19:46:46.549Z","references":[{"source_name":"Unit 42 QUADAGENT July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--01eb6d18-bb7b-4e4a-b133-60407f40773b","subject":"ATTACK:enterprise:S0354","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--01eb6d18-bb7b-4e4a-b133-60407f40773b","modified":"2026-09-03T19:46:46.706Z","references":[{"source_name":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source_name":"Securelist Denis April 2017","url":"https://securelist.com/use-of-dns-tunneling-for-cc-communications/78203/"},{"source_name":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--04ff77bc-6232-4950-8e9c-6f4dcc83ca9d","subject":"ATTACK:enterprise:S0663","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--04ff77bc-6232-4950-8e9c-6f4dcc83ca9d","modified":"2026-09-03T19:46:46.824Z","references":[{"source_name":"Lunghi Iron Tiger Linux","url":"https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0b13006f-3662-4175-86b1-607f20895863","subject":"ATTACK:enterprise:S1111","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0b13006f-3662-4175-86b1-607f20895863","modified":"2026-09-03T19:46:47.000Z","references":[{"source_name":"Ensilo Darkgate 2018","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0d9114a6-6452-4668-95eb-f91bcb300d2d","subject":"ATTACK:enterprise:S0146","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0d9114a6-6452-4668-95eb-f91bcb300d2d","modified":"2026-09-03T19:46:47.267Z","references":[{"source_name":"FireEye FIN7 March 2017","url":"https://web.archive.org/web/20180808125108/https:/www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--11c19a8d-fd24-4c59-9a5f-4910f5471e71","subject":"ATTACK:enterprise:S1020","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--11c19a8d-fd24-4c59-9a5f-4910f5471e71","modified":"2026-09-03T19:46:47.643Z","references":[{"source_name":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1a2a6b85-7e72-409a-80bd-13a3f726de5a","subject":"ATTACK:enterprise:S1015","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1a2a6b85-7e72-409a-80bd-13a3f726de5a","modified":"2026-09-03T19:46:47.896Z","references":[{"source_name":"Accenture Lyceum Targets November 2021","url":"https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns"},{"source_name":"ClearSky Siamesekitten August 2021","url":"https://www.clearskysec.com/siamesekitten/"},{"source_name":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1b27a43c-3508-4f21-9f39-c05b2be84cb6","subject":"ATTACK:enterprise:S0377","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1b27a43c-3508-4f21-9f39-c05b2be84cb6","modified":"2026-09-03T19:46:48.024Z","references":[{"source_name":"ESET Ebury Feb 2014","url":"https://www.welivesecurity.com/2014/02/21/an-in-depth-analysis-of-linuxebury/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--39689be2-bc35-4d89-9233-08bda52a4229","subject":"ATTACK:enterprise:S0170","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--39689be2-bc35-4d89-9233-08bda52a4229","modified":"2026-09-03T19:46:48.125Z","references":[{"source_name":"Palo Alto OilRig May 2016","url":"http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3a8ce0e1-0c2e-4ce5-bd21-8d51b3027376","subject":"ATTACK:enterprise:S0699","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3a8ce0e1-0c2e-4ce5-bd21-8d51b3027376","modified":"2026-09-03T19:46:48.203Z","references":[{"source_name":"Mythc Documentation","url":"https://docs.mythic-c2.net/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3d70f1d9-366a-4510-91f6-fe15ca06d7a8","subject":"ATTACK:enterprise:S0495","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3d70f1d9-366a-4510-91f6-fe15ca06d7a8","modified":"2026-09-03T19:46:48.432Z","references":[{"source_name":"Unit42 RDAT July 2020","url":"https://unit42.paloaltonetworks.com/oilrig-novel-c2-channel-steganography/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3d719505-cb0d-4dc4-8f23-fee0577a6359","subject":"ATTACK:enterprise:S9050","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3d719505-cb0d-4dc4-8f23-fee0577a6359","modified":"2026-09-25T16:41:57.553Z","references":[{"source_name":"LevelBlue_Vidar_May2026","url":"https://www.levelblue.com/blogs/spiderlabs-blog/unmasking-a-multi-stage-loader-autoit-abuse-leading-to-vidar-stealer-command-and-control-communication"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--444dc2e9-3f54-4ab9-b004-363ae1221373","subject":"ATTACK:enterprise:M1037","predicate":"mitigates","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--444dc2e9-3f54-4ab9-b004-363ae1221373","modified":"2026-09-03T19:46:48.530Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--46d350be-fcde-4c7a-ac75-d86c8f5ccd5f","subject":"ATTACK:enterprise:G0114","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--46d350be-fcde-4c7a-ac75-d86c8f5ccd5f","modified":"2026-09-03T19:46:48.708Z","references":[{"source_name":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--49363ea2-b33e-4cc4-a283-ab7d30530c27","subject":"ATTACK:enterprise:S0184","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--49363ea2-b33e-4cc4-a283-ab7d30530c27","modified":"2026-09-03T19:46:48.765Z","references":[{"source_name":"FireEye APT34 Dec 2017","url":"https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"},{"source_name":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4ebeacbf-4f30-4f32-86dc-54d932ea7c46","subject":"ATTACK:enterprise:T1071.004","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1071","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4ebeacbf-4f30-4f32-86dc-54d932ea7c46","modified":"2026-09-03T19:46:51.856Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4f27c041-e965-4ee3-b47c-6681e7fc1ace","subject":"ATTACK:enterprise:C0029","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4f27c041-e965-4ee3-b47c-6681e7fc1ace","modified":"2026-09-03T19:46:49.062Z","references":[{"source_name":"Mandiant Cutting Edge Part 2 January 2024","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4f7ce20c-fab3-4dbd-be9f-c023d7b0bd90","subject":"ATTACK:enterprise:S0514","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4f7ce20c-fab3-4dbd-be9f-c023d7b0bd90","modified":"2026-09-03T19:46:49.118Z","references":[{"source_name":"PWC WellMess July 2020","url":"https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html"},{"source_name":"NCSC APT29 July 2020","url":"https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--50c1c2f4-be50-49dc-bac6-dce8e80436ae","subject":"ATTACK:enterprise:S1090","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--50c1c2f4-be50-49dc-bac6-dce8e80436ae","modified":"2026-09-03T19:46:49.154Z","references":[{"source_name":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--59d4e54d-66b8-4603-b189-ba67160da44d","subject":"ATTACK:enterprise:S0124","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--59d4e54d-66b8-4603-b189-ba67160da44d","modified":"2026-09-03T19:46:49.366Z","references":[{"source_name":"Palo Alto DNS Requests","url":"http://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5c45d533-4299-47a0-9a3b-7085c219ba6a","subject":"ATTACK:enterprise:S1014","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5c45d533-4299-47a0-9a3b-7085c219ba6a","modified":"2026-09-03T19:46:49.520Z","references":[{"source_name":"SecureWorks August 2019","url":"https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5fac7323-462e-4ef5-848b-5ff54833a67e","subject":"ATTACK:enterprise:S9001","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5fac7323-462e-4ef5-848b-5ff54833a67e","modified":"2026-09-03T19:46:49.607Z","references":[{"source_name":"HarmonProofpoint_SystemBC_Aug2019","url":"https://www.proofpoint.com/us/threat-insight/post/systembc-christmas-july-socks5-malware-and-exploit-kits"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--66bac3e2-3a04-4ad0-8f38-fa952e7289c6","subject":"ATTACK:enterprise:S1027","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--66bac3e2-3a04-4ad0-8f38-fa952e7289c6","modified":"2026-09-03T19:46:49.675Z","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--68ddf3bf-bf01-4de5-8b0e-e00db5a8ee7e","subject":"ATTACK:enterprise:S1021","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--68ddf3bf-bf01-4de5-8b0e-e00db5a8ee7e","modified":"2026-09-03T19:46:49.864Z","references":[{"source_name":"Zscaler Lyceum DnsSystem June 2022","url":"https://www.zscaler.com/blogs/security-research/lyceum-net-dns-backdoor"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6a4ee5a3-9bc2-4352-856a-ae078ddc6cf2","subject":"ATTACK:enterprise:S0154","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6a4ee5a3-9bc2-4352-856a-ae078ddc6cf2","modified":"2026-09-03T19:46:50.228Z","references":[{"source_name":"Talos Cobalt Strike September 2020","url":"https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf"},{"source_name":"cobaltstrike manual","url":"https://web.archive.org/web/20210825130434/https://cobaltstrike.com/downloads/csmanual38.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--70c0fd33-8091-4e58-896b-0be55429ee91","subject":"ATTACK:enterprise:S0666","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--70c0fd33-8091-4e58-896b-0be55429ee91","modified":"2026-09-03T19:46:50.319Z","references":[{"source_name":"ESET Gelsemium June 2021","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--730a2fb5-2f51-4db1-b4f1-2112d64df4bf","subject":"ATTACK:enterprise:S0360","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--730a2fb5-2f51-4db1-b4f1-2112d64df4bf","modified":"2026-09-03T19:46:50.391Z","references":[{"source_name":"Palo Alto OilRig Sep 2018","url":"https://unit42.paloaltonetworks.com/unit42-oilrig-uses-updated-bondupdater-target-middle-eastern-government/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--73ddd025-b313-49cc-8a28-4c3869eb5a16","subject":"ATTACK:enterprise:S0633","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--73ddd025-b313-49cc-8a28-4c3869eb5a16","modified":"2026-09-03T19:46:50.435Z","references":[{"source_name":"GitHub Sliver C2 DNS","url":"https://github.com/BishopFox/sliver/wiki/DNS-C2"},{"source_name":"Cybereason Sliver Undated","url":"https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors"},{"source_name":"Bishop Fox Sliver Framework August 2019","url":"https://labs.bishopfox.com/tech-blog/sliver"},{"source_name":"Microsoft Sliver 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/"},{"source_name":"Cybersecurity Advisory SVR TTP May 2021","url":"https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7ce75658-c5ea-484d-ab1d-2dca045a244b","subject":"ATTACK:enterprise:S0690","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7ce75658-c5ea-484d-ab1d-2dca045a244b","modified":"2026-09-03T19:46:50.516Z","references":[{"source_name":"Objective See Green Lambert for OSX Oct 2021","url":"https://objective-see.com/blog/blog_0x68.html"},{"source_name":"Glitch-Cat Green Lambert ATTCK Oct 2021","url":"https://web.archive.org/web/20211018145402/https://www.glitch-cat.com/blog/green-lambert-and-attack"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7eb3d9b7-8058-4d26-9196-b9a79716c5f9","subject":"ATTACK:enterprise:S0070","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7eb3d9b7-8058-4d26-9196-b9a79716c5f9","modified":"2026-09-03T19:46:50.582Z","references":[{"source_name":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source_name":"ThreatStream Evasion Analysis","url":"https://www.threatstream.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7fb6c376-1d2b-4dfa-98cc-623b7567f3cf","subject":"ATTACK:enterprise:S1047","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7fb6c376-1d2b-4dfa-98cc-623b7567f3cf","modified":"2026-09-03T19:46:50.649Z","references":[{"source_name":"CYBERCOM Iranian Intel Cyber January 2022","url":"https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/"},{"source_name":"DHS CISA AA22-055A MuddyWater February 2022","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--86e0245b-787c-4cf8-9399-531d64529d4d","subject":"ATTACK:enterprise:G0140","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--86e0245b-787c-4cf8-9399-531d64529d4d","modified":"2026-09-03T19:46:50.744Z","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--873faf92-be75-47e5-bf3e-b389a5bdc020","subject":"ATTACK:enterprise:G0096","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--873faf92-be75-47e5-bf3e-b389a5bdc020","modified":"2026-09-03T19:46:50.939Z","references":[{"source_name":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"},{"source_name":"Group IB APT 41 June 2021","url":"https://www.group-ib.com/blog/colunmtk-apt41/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8bb2744c-3ea2-418b-818d-aaabe0c7746f","subject":"ATTACK:enterprise:S0504","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8bb2744c-3ea2-418b-818d-aaabe0c7746f","modified":"2026-09-03T19:46:51.040Z","references":[{"source_name":"Cyberreason Anchor December 2019","url":"https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"},{"source_name":"Medium Anchor DNS July 2020","url":"https://medium.com/stage-2-security/anchor-dns-malware-family-goes-cross-platform-d807ba13ca30"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8de247e5-8d6b-4a07-bd65-ba3c3ca57923","subject":"ATTACK:enterprise:G0080","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8de247e5-8d6b-4a07-bd65-ba3c3ca57923","modified":"2026-09-03T19:46:51.131Z","references":[{"source_name":"Talos Cobalt Group July 2018","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"},{"source_name":"PTSecurity Cobalt Dec 2016","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf"},{"source_name":"Group IB Cobalt Aug 2017","url":"https://www.group-ib.com/blog/cobalt"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8dfb6f79-5a9a-4eb8-9b25-40d82ff0f668","subject":"ATTACK:enterprise:G0049","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8dfb6f79-5a9a-4eb8-9b25-40d82ff0f668","modified":"2026-09-03T19:46:51.308Z","references":[{"source_name":"FireEye APT34 July 2019","url":"https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"},{"source_name":"Check Point APT34 April 2021","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"},{"source_name":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"},{"source_name":"Unit42 OilRig Playbook 2023","url":"https://web.archive.org/web/20230610050742/https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--936ff38b-73f6-48fe-876f-8ebd3b60df1f","subject":"ATTACK:enterprise:S0596","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--936ff38b-73f6-48fe-876f-8ebd3b60df1f","modified":"2026-09-03T19:46:51.418Z","references":[{"source_name":"Kaspersky ShadowPad Aug 2017","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--94c08652-89f8-406d-b0c0-aeb35da36d99","subject":"ATTACK:enterprise:S0338","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--94c08652-89f8-406d-b0c0-aeb35da36d99","modified":"2026-09-03T19:46:51.529Z","references":[{"source_name":"Zscaler Cobian Aug 2017","url":"https://www.zscaler.com/blogs/research/cobian-rat-backdoored-rat"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--96a7d789-70a9-42d8-a78e-b7ffd6c9dc69","subject":"ATTACK:enterprise:G0004","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--96a7d789-70a9-42d8-a78e-b7ffd6c9dc69","modified":"2026-09-03T19:46:51.727Z","references":[{"source_name":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9a66e38c-ea79-4b7b-bf74-555da87d58c3","subject":"ATTACK:enterprise:G0087","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9a66e38c-ea79-4b7b-bf74-555da87d58c3","modified":"2026-09-03T19:46:51.755Z","references":[{"source_name":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9bca83aa-4200-45a4-a978-1ccc75561d5e","subject":"ATTACK:enterprise:S0615","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9bca83aa-4200-45a4-a978-1ccc75561d5e","modified":"2026-09-03T19:46:51.830Z","references":[{"source_name":"BlackBerry CostaRicto November 2020","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"},{"source_name":"FireEye FiveHands April 2021","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9c6804dc-e1d5-43f5-97ee-7d827c9d308d","subject":"ATTACK:enterprise:S0260","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9c6804dc-e1d5-43f5-97ee-7d827c9d308d","modified":"2026-09-03T19:46:51.907Z","references":[{"source_name":"ESET InvisiMole June 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a01fe77e-2091-4938-b639-21d21704c7a2","subject":"ATTACK:enterprise:G1003","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a01fe77e-2091-4938-b639-21d21704c7a2","modified":"2026-09-03T19:46:51.961Z","references":[{"source_name":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a403648d-4c23-46bd-9688-1face1407b42","subject":"ATTACK:enterprise:S0157","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a403648d-4c23-46bd-9688-1face1407b42","modified":"2026-09-03T19:46:52.034Z","references":[{"source_name":"FireEye APT32 May 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aae339ae-44bb-48d3-b62e-7f35376bb974","subject":"ATTACK:enterprise:S0228","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aae339ae-44bb-48d3-b62e-7f35376bb974","modified":"2026-09-03T19:46:52.251Z","references":[{"source_name":"fsecure NanHaiShu July 2016","url":"https://www.f-secure.com/documents/996508/1030745/nanhaishu_whitepaper.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--af9e92df-d4d0-437a-9114-823b6a2a14a6","subject":"ATTACK:enterprise:G0081","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--af9e92df-d4d0-437a-9114-823b6a2a14a6","modified":"2026-09-03T19:46:52.342Z","references":[{"source_name":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b4947254-3a74-4708-a45c-65eff5bd9a2c","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b4947254-3a74-4708-a45c-65eff5bd9a2c","modified":"2026-09-03T19:46:52.444Z","references":[{"source_name":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b6a60179-abb0-41ec-96cc-112abe232509","subject":"ATTACK:enterprise:S0559","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b6a60179-abb0-41ec-96cc-112abe232509","modified":"2026-09-03T19:46:52.504Z","references":[{"source_name":"FireEye SUNBURST Backdoor December 2020","url":"https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c1cf88bc-6229-4d62-86f5-36aa0e7bd21a","subject":"ATTACK:enterprise:G0026","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c1cf88bc-6229-4d62-86f5-36aa0e7bd21a","modified":"2026-09-03T19:46:52.570Z","references":[{"source_name":"PaloAlto DNS Requests May 2016","url":"https://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c4014fde-9d6e-4605-a143-36556a280249","subject":"ATTACK:enterprise:S1063","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c4014fde-9d6e-4605-a143-36556a280249","modified":"2026-09-03T19:46:52.756Z","references":[{"source_name":"Palo Alto Brute Ratel July 2022","url":"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"},{"source_name":"Trend Micro Black Basta October 2022","url":"https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c476a0da-44fd-4492-86ae-407aabab3735","subject":"ATTACK:enterprise:S0167","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c476a0da-44fd-4492-86ae-407aabab3735","modified":"2026-09-03T19:46:52.872Z","references":[{"source_name":"ClearSky Wilted Tulip July 2017","url":"http://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf"},{"source_name":"CopyKittens Nov 2015","url":"https://cdn2.hubspot.net/hubfs/1903456/Whitepapers/CopyKittens.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c560f682-0d21-4c9b-b35d-33aec2287117","subject":"ATTACK:enterprise:S0145","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c560f682-0d21-4c9b-b35d-33aec2287117","modified":"2026-09-03T19:46:52.990Z","references":[{"source_name":"Cisco DNSMessenger March 2017","url":"http://blog.talosintelligence.com/2017/03/dnsmessenger.html"},{"source_name":"FireEye FIN7 March 2017","url":"https://web.archive.org/web/20180808125108/https:/www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c9f53392-065d-4573-a08a-37bc3d24d3e5","subject":"ATTACK:enterprise:M1031","predicate":"mitigates","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c9f53392-065d-4573-a08a-37bc3d24d3e5","modified":"2026-09-03T19:46:53.197Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ca2a22df-7f99-497a-8f51-cf0180308305","subject":"ATTACK:enterprise:G0046","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ca2a22df-7f99-497a-8f51-cf0180308305","modified":"2026-09-03T19:46:53.312Z","references":[{"source_name":"FireEye FIN7 Aug 2018","url":"https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e9113d90-4c55-465a-88c6-b58c40b46f96","subject":"ATTACK:enterprise:S1019","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e9113d90-4c55-465a-88c6-b58c40b46f96","modified":"2026-09-03T19:46:53.638Z","references":[{"source_name":"Accenture Lyceum Targets November 2021","url":"https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns"},{"source_name":"ClearSky Siamesekitten August 2021","url":"https://www.clearskysec.com/siamesekitten/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ec439835-0ccb-477e-8c58-1d8c4e8ed6ab","subject":"ATTACK:enterprise:S0125","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ec439835-0ccb-477e-8c58-1d8c4e8ed6ab","modified":"2026-09-03T19:46:53.769Z","references":[{"source_name":"Symantec Remsec IOCs","url":"http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/Symantec_Remsec_IOCs.pdf"},{"source_name":"Kaspersky ProjectSauron Full Report","url":"https://securelist.com/files/2016/07/The-ProjectSauron-APT_research_KL.pdf"},{"source_name":"Kaspersky ProjectSauron Technical Analysis","url":"https://securelist.com/files/2016/07/The-ProjectSauron-APT_Technical_Analysis_KL.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eecaf2ba-9971-4657-9a55-5df1bfba6a1b","subject":"ATTACK:enterprise:S9015","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eecaf2ba-9971-4657-9a55-5df1bfba6a1b","modified":"2026-09-03T19:46:53.888Z","references":[{"source_name":"CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025","url":"https://www.crowdstrike.com/en-us/blog/warp-panda-cloud-threats/"},{"source_name":"CISA BRICKSTORM UNC5221 AR25-338A February 2026","url":"https://www.cisa.gov/news-events/analysis-reports/ar25-338a"},{"source_name":"Picus Security BRICKSTORM UNC5221 October 2025","url":"https://www.picussecurity.com/resource/blog/brickstorm-malware-unc5221-targets-tech-and-legal-sectors-in-the-united-states"},{"source_name":"Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement"},{"source_name":"NVISO BRICKSTORM April 2025","url":"https://blog.nviso.eu/wp-content/uploads/2025/04/NVISO-BRICKSTORM-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f2ae5e48-aded-40ba-8991-68b79638d6b0","subject":"ATTACK:enterprise:S0022","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f2ae5e48-aded-40ba-8991-68b79638d6b0","modified":"2026-09-03T19:46:54.105Z","references":[{"source_name":"Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023","url":"https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}