Source assertions are not new attribution claims. No sole inventor or transitive actor-CVE inference.
{
  "record": {
    "id": "ATTACK:enterprise:T1082",
    "title": "System Information Discovery",
    "type": "Technique",
    "source_url": "https://attack.mitre.org/techniques/T1082",
    "snapshot": "enterprise-attack-20.0.json",
    "status": "active",
    "rights": "Source metadata only; source notices retained; no operational prose or payloads",
    "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
    "stix_id": "attack-pattern--354a7f88-63fb-41b5-a801-ce3b377b36f1",
    "external_id": "T1082",
    "domain": "enterprise",
    "created": "2017-05-31T21:31:04.307Z",
    "modified": "2026-09-11T19:56:24.154Z",
    "version": "3.0",
    "aliases": [

    ],
    "tactics": [
      "discovery"
    ],
    "source_references": [
      {
        "source_name": "Amazon Describe Instance",
        "url": "https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-information.html"
      },
      {
        "source_name": "Google Instances Resource",
        "url": "https://cloud.google.com/compute/docs/reference/rest/v1/instances"
      },
      {
        "source_name": "Varonis",
        "url": "https://www.varonis.com/blog/vmware-esxi-in-the-line-of-ransomware-fire"
      },
      {
        "source_name": "Crowdstrike Hypervisor Jackpotting Pt 2 2021",
        "url": "https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/"
      },
      {
        "source_name": "Microsoft Virutal Machine API",
        "url": "https://docs.microsoft.com/en-us/rest/api/compute/virtualmachines/get"
      },
      {
        "source_name": "20 macOS Common Tools and Techniques",
        "url": "https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/"
      },
      {
        "source_name": "OSX.FairyTale",
        "url": "https://www.sentinelone.com/blog/trail-osx-fairytale-adware-playing-malware/"
      },
      {
        "source_name": "US-CERT-TA18-106A",
        "url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
      }
    ]
  },
  "assertions": [
    {
      "id": "enterprise:relationship--002c9202-d7a0-4181-b912-42f7d6d38339",
      "subject": "ATTACK:enterprise:S0339",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--002c9202-d7a0-4181-b912-42f7d6d38339",
      "modified": "2026-04-29T14:23:05.903Z",
      "references": [
        {
          "source_name": "Talos Micropsia June 2017",
          "url": "https://blog.talosintelligence.com/2017/06/palestine-delphi.html"
        },
        {
          "source_name": "Radware Micropsia July 2018",
          "url": "https://www.radware.com/blog/security/2018/07/micropsia-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--005cbf7d-9d0b-443b-91db-7b148a1eb55b",
      "subject": "ATTACK:enterprise:S0385",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--005cbf7d-9d0b-443b-91db-7b148a1eb55b",
      "modified": "2026-04-29T14:23:05.903Z",
      "references": [
        {
          "source_name": "Fidelis njRAT June 2013",
          "url": "https://www.threatminer.org/_reports/2013/fta-1009---njrat-uncovered-1.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--011286cc-53bc-4910-bf38-79f1d79fc707",
      "subject": "ATTACK:enterprise:S1111",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--011286cc-53bc-4910-bf38-79f1d79fc707",
      "modified": "2026-04-29T14:23:05.904Z",
      "references": [
        {
          "source_name": "Ensilo Darkgate 2018",
          "url": "https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"
        },
        {
          "source_name": "Rapid7 BlackBasta 2024",
          "url": "https://www.rapid7.com/blog/post/2024/12/04/black-basta-ransomware-campaign-drops-zbot-darkgate-and-custom-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--014d0996-93ef-4435-aac2-f73dbd4a9d60",
      "subject": "ATTACK:enterprise:S1242",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--014d0996-93ef-4435-aac2-f73dbd4a9d60",
      "modified": "2026-04-29T14:23:05.904Z",
      "references": [
        {
          "source_name": "Trend Micro Agenda Ransomware OCT 2025",
          "url": "https://www.trendmicro.com/en_us/research/25/j/agenda-ransomware-deploys-linux-variant-on-windows-systems.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--01933b06-956c-4f09-9dcc-e7c6b672dc94",
      "subject": "ATTACK:enterprise:S1249",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--01933b06-956c-4f09-9dcc-e7c6b672dc94",
      "modified": "2026-04-29T14:23:05.905Z",
      "references": [
        {
          "source_name": "Socket HexEval BeaverTail Contagious Interview June 2025",
          "url": "https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--01a2dceb-e7bf-414b-9919-6c9724cfb404",
      "subject": "ATTACK:enterprise:S1245",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--01a2dceb-e7bf-414b-9919-6c9724cfb404",
      "modified": "2026-04-29T14:23:05.905Z",
      "references": [
        {
          "source_name": "Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024",
          "url": "https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"
        },
        {
          "source_name": "Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025",
          "url": "https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat"
        },
        {
          "source_name": "ESET Contagious Interview BeaverTail InvisibleFerret February 2025",
          "url": "https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"
        },
        {
          "source_name": "PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023",
          "url": "https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--01aac35b-55e1-40d6-962f-5b5a6efdb2be",
      "subject": "ATTACK:enterprise:S0266",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--01aac35b-55e1-40d6-962f-5b5a6efdb2be",
      "modified": "2026-04-29T14:23:05.905Z",
      "references": [
        {
          "source_name": "S2 Grupo TrickBot June 2017",
          "url": "https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf"
        },
        {
          "source_name": "Fidelis TrickBot Oct 2016",
          "url": "https://www.fidelissecurity.com/threatgeek/2016/10/trickbot-we-missed-you-dyre"
        },
        {
          "source_name": "Cyberreason Anchor December 2019",
          "url": "https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"
        },
        {
          "source_name": "Eclypsium Trickboot December 2020",
          "url": "https://eclypsium.com/wp-content/uploads/2020/12/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--01b542b1-3222-459b-9cdf-b91dcd29c749",
      "subject": "ATTACK:enterprise:S0553",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--01b542b1-3222-459b-9cdf-b91dcd29c749",
      "modified": "2026-04-29T14:23:05.905Z",
      "references": [
        {
          "source_name": "Cybereason Molerats Dec 2020",
          "url": "https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--01c60a20-2eff-4b4e-a15a-24e56a487b4e",
      "subject": "ATTACK:enterprise:S0388",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--01c60a20-2eff-4b4e-a15a-24e56a487b4e",
      "modified": "2026-04-29T14:23:05.905Z",
      "references": [
        {
          "source_name": "TrendMicro TropicTrooper 2015",
          "url": "https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--01ebd689-8233-409a-a12d-eafb2546f665",
      "subject": "ATTACK:enterprise:S0464",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--01ebd689-8233-409a-a12d-eafb2546f665",
      "modified": "2026-04-29T14:23:05.905Z",
      "references": [
        {
          "source_name": "Unit 42 CARROTBAT January 2020",
          "url": "https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--02206f22-80e9-4f87-9e4b-5c1df1eb737e",
      "subject": "ATTACK:enterprise:S0130",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--02206f22-80e9-4f87-9e4b-5c1df1eb737e",
      "modified": "2026-04-29T14:23:05.906Z",
      "references": [
        {
          "source_name": "Forcepoint Monsoon",
          "url": "https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--02a1f8ce-390e-46e4-b945-9cd61c593f9f",
      "subject": "ATTACK:enterprise:S1039",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--02a1f8ce-390e-46e4-b945-9cd61c593f9f",
      "modified": "2026-04-29T14:23:05.906Z",
      "references": [
        {
          "source_name": "Symantec Bumblebee June 2022",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime"
        },
        {
          "source_name": "Proofpoint Bumblebee April 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"
        },
        {
          "source_name": "Google EXOTIC LILY March 2022",
          "url": "https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--041e8f9b-6cdb-44b3-aa37-a274a4de9a0b",
      "subject": "ATTACK:enterprise:S0237",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--041e8f9b-6cdb-44b3-aa37-a274a4de9a0b",
      "modified": "2026-04-29T14:23:05.909Z",
      "references": [
        {
          "source_name": "Talos GravityRAT",
          "url": "https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--05104256-7e9a-457b-8e9f-86976992f3c7",
      "subject": "ATTACK:enterprise:S0211",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--05104256-7e9a-457b-8e9f-86976992f3c7",
      "modified": "2026-04-29T14:23:05.910Z",
      "references": [
        {
          "source_name": "Symantec Linfo May 2012",
          "url": "https://www.symantec.com/security_response/writeup.jsp?docid=2012-051605-2535-99"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--055261fd-70cd-49c6-b9e6-2641bae4dda7",
      "subject": "ATTACK:enterprise:S0250",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--055261fd-70cd-49c6-b9e6-2641bae4dda7",
      "modified": "2026-04-29T14:23:05.910Z",
      "references": [
        {
          "source_name": "MalwareBytes LazyScripter Feb 2021",
          "url": "https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--055a15db-2f5b-4c61-821e-36de6f83a90b",
      "subject": "ATTACK:enterprise:S0634",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--055a15db-2f5b-4c61-821e-36de6f83a90b",
      "modified": "2026-04-29T14:23:05.910Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Toolset May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0586324a-680a-46a4-917b-8c00c7211065",
      "subject": "ATTACK:enterprise:S0674",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0586324a-680a-46a4-917b-8c00c7211065",
      "modified": "2026-04-29T14:23:05.911Z",
      "references": [
        {
          "source_name": "Check Point APT35 CharmPower January 2022",
          "url": "https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--061cfa7a-df09-40cc-bed5-35407b425cb8",
      "subject": "ATTACK:enterprise:S0603",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--061cfa7a-df09-40cc-bed5-35407b425cb8",
      "modified": "2026-04-29T14:23:05.911Z",
      "references": [
        {
          "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
          "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--06ae1d46-2349-457e-817b-e9fdca2f7768",
      "subject": "ATTACK:enterprise:G0124",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--06ae1d46-2349-457e-817b-e9fdca2f7768",
      "modified": "2026-07-31T18:47:56.337Z",
      "references": [
        {
          "source_name": "ESET ForSSHe December 2018",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--072af62a-85d5-4803-aa05-d7c6efa9ec2a",
      "subject": "ATTACK:enterprise:S0254",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--072af62a-85d5-4803-aa05-d7c6efa9ec2a",
      "modified": "2026-04-29T14:23:05.913Z",
      "references": [
        {
          "source_name": "Rancor Unit42 June 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--08b94d01-f4c1-4692-aa39-a203fd97d581",
      "subject": "ATTACK:enterprise:S1234",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--08b94d01-f4c1-4692-aa39-a203fd97d581",
      "modified": "2026-04-29T14:23:05.915Z",
      "references": [
        {
          "source_name": "Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--090a553a-b863-4214-aa3b-cf8ea7ba2d68",
      "subject": "ATTACK:enterprise:S0045",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--090a553a-b863-4214-aa3b-cf8ea7ba2d68",
      "modified": "2026-04-29T14:23:05.916Z",
      "references": [
        {
          "source_name": "ESET Sednit Part 2",
          "url": "http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"
        },
        {
          "source_name": "Bitdefender APT28 Dec 2015",
          "url": "https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--093c0ace-8e89-4948-8aab-f7b484347f6a",
      "subject": "ATTACK:enterprise:G1043",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--093c0ace-8e89-4948-8aab-f7b484347f6a",
      "modified": "2026-07-31T18:47:35.456Z",
      "references": [
        {
          "source_name": "Microsoft BlackByte 2023",
          "url": "https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"
        },
        {
          "source_name": "Symantec BlackByte 2022",
          "url": "https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"
        },
        {
          "source_name": "FBI BlackByte 2022",
          "url": "https://www.ic3.gov/CSA/2022/220211.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--09a27a67-29f5-4ecf-ac38-b0acd0041105",
      "subject": "ATTACK:enterprise:S9067",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--09a27a67-29f5-4ecf-ac38-b0acd0041105",
      "modified": "2026-10-01T21:53:17.547Z",
      "references": [
        {
          "source_name": "Mandiant_UNC1549_Nov2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0a8c04f1-c724-4215-92f0-3863b2a3d96d",
      "subject": "ATTACK:enterprise:S0374",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0a8c04f1-c724-4215-92f0-3863b2a3d96d",
      "modified": "2026-04-29T14:23:05.918Z",
      "references": [
        {
          "source_name": "CheckPoint SpeakUp Feb 2019",
          "url": "https://research.checkpoint.com/speakup-a-new-undetected-backdoor-linux-trojan/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0b37289c-b118-45f7-98b2-5efe06cbf0b2",
      "subject": "ATTACK:enterprise:S0462",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0b37289c-b118-45f7-98b2-5efe06cbf0b2",
      "modified": "2026-04-29T14:23:05.918Z",
      "references": [
        {
          "source_name": "Unit 42 CARROTBAT November 2018",
          "url": "https://unit42.paloaltonetworks.com/unit42-the-fractured-block-campaign-carrotbat-malware-used-to-deliver-malware-targeting-southeast-asia/"
        },
        {
          "source_name": "Unit 42 CARROTBAT January 2020",
          "url": "https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0bc7c262-604c-42af-8829-ce9f579436d4",
      "subject": "ATTACK:enterprise:S0387",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0bc7c262-604c-42af-8829-ce9f579436d4",
      "modified": "2026-04-29T14:23:05.919Z",
      "references": [
        {
          "source_name": "Rapid7 KeyBoy Jun 2013",
          "url": "https://blog.rapid7.com/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india/"
        },
        {
          "source_name": "PWC KeyBoys Feb 2017",
          "url": "https://web.archive.org/web/20211129064701/https://www.pwc.co.uk/issues/cyber-security-services/research/the-keyboys-are-back-in-town.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0c03f2b4-a752-4d74-9c26-5306132a3329",
      "subject": "ATTACK:enterprise:G0049",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0c03f2b4-a752-4d74-9c26-5306132a3329",
      "modified": "2026-07-31T20:48:35.180Z",
      "references": [
        {
          "source_name": "FireEye APT34 July 2019",
          "url": "https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"
        },
        {
          "source_name": "Check Point APT34 April 2021",
          "url": "https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"
        },
        {
          "source_name": "Palo Alto OilRig May 2016",
          "url": "http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"
        },
        {
          "source_name": "Palo Alto OilRig Oct 2016",
          "url": "http://researchcenter.paloaltonetworks.com/2016/10/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/"
        },
        {
          "source_name": "Symantec Crambus OCT 2023",
          "url": "https://www.security.com/threat-intelligence/crambus-middle-east-government"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0d3f773c-ed0e-4db4-8457-204a7a33eb58",
      "subject": "ATTACK:enterprise:S0449",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0d3f773c-ed0e-4db4-8457-204a7a33eb58",
      "modified": "2026-04-29T14:23:05.921Z",
      "references": [
        {
          "source_name": "McAfee Maze March 2020",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-maze/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0d557837-8936-43e7-95fd-2c30938d34d3",
      "subject": "ATTACK:enterprise:S0433",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0d557837-8936-43e7-95fd-2c30938d34d3",
      "modified": "2026-04-29T14:23:05.921Z",
      "references": [
        {
          "source_name": "Carbon Black HotCroissant April 2020",
          "url": "https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0d853746-8d17-4d1a-be4a-6133e39a6c84",
      "subject": "ATTACK:enterprise:S1129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0d853746-8d17-4d1a-be4a-6133e39a6c84",
      "modified": "2026-04-29T14:23:05.922Z",
      "references": [
        {
          "source_name": "Kersten Akira 2023",
          "url": "https://www.trellix.com/blogs/research/akira-ransomware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0d95b411-1192-42d0-96b1-98fe18742a04",
      "subject": "ATTACK:enterprise:S0381",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0d95b411-1192-42d0-96b1-98fe18742a04",
      "modified": "2026-04-29T14:23:05.922Z",
      "references": [
        {
          "source_name": "Proofpoint TA505 Mar 2018",
          "url": "https://www.proofpoint.com/us/threat-insight/post/leaked-ammyy-admin-source-code-turned-malware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0e07a552-cea0-47f0-b96b-009a19c3e09a",
      "subject": "ATTACK:enterprise:G0128",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0e07a552-cea0-47f0-b96b-009a19c3e09a",
      "modified": "2026-07-31T18:47:51.974Z",
      "references": [
        {
          "source_name": "Zscaler APT31 Covid-19 October 2020",
          "url": "https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0e714323-a3b6-4848-852c-5e35608d0970",
      "subject": "ATTACK:enterprise:S1070",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0e714323-a3b6-4848-852c-5e35608d0970",
      "modified": "2026-04-29T14:23:05.923Z",
      "references": [
        {
          "source_name": "Cyble Black Basta May 2022",
          "url": "https://web.archive.org/web/20220506143054/https://blog.cyble.com/2022/05/06/black-basta-ransomware/"
        },
        {
          "source_name": "Minerva Labs Black Basta May 2022",
          "url": "https://minerva-labs.com/blog/new-black-basta-ransomware-hijacks-windows-fax-service/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0e770d53-2dea-4d8d-8bbf-a2290d4a78a7",
      "subject": "ATTACK:enterprise:S9019",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0e770d53-2dea-4d8d-8bbf-a2290d4a78a7",
      "modified": "2026-04-29T14:23:05.923Z",
      "references": [
        {
          "source_name": "Check Point Blind Eagle MAR 2025",
          "url": "https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"
        },
        {
          "source_name": "Zscaler PureCrypter JUN 2022",
          "url": "https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0e79e44d-036a-478f-a6f5-1acc420095bf",
      "subject": "ATTACK:enterprise:G1045",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0e79e44d-036a-478f-a6f5-1acc420095bf",
      "modified": "2026-09-22T22:23:13.760Z",
      "references": [
        {
          "source_name": "CISA_AA25-239ASaltTyphoon_Sept2025",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0ed59ea2-85bb-4633-9b55-9e322dcbbd83",
      "subject": "ATTACK:enterprise:S1141",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0ed59ea2-85bb-4633-9b55-9e322dcbbd83",
      "modified": "2026-04-29T14:23:05.924Z",
      "references": [
        {
          "source_name": "ESET Turla Lunar toolset May 2024",
          "url": "https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0f66681a-7daf-4cd7-99af-3005b6586306",
      "subject": "ATTACK:enterprise:S0252",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0f66681a-7daf-4cd7-99af-3005b6586306",
      "modified": "2026-04-29T14:23:05.925Z",
      "references": [
        {
          "source_name": "McAfee Gold Dragon",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0f688474-53c2-4ad5-8998-bd8c39a79f04",
      "subject": "ATTACK:enterprise:S1030",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0f688474-53c2-4ad5-8998-bd8c39a79f04",
      "modified": "2026-04-29T14:23:05.925Z",
      "references": [
        {
          "source_name": "ZScaler Squirrelwaffle Sep 2021",
          "url": "https://www.zscaler.com/blogs/security-research/squirrelwaffle-new-loader-delivering-cobalt-strike"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0f9f9bd3-ccea-4369-b8e7-371d1aad5ff8",
      "subject": "ATTACK:enterprise:G0096",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0f9f9bd3-ccea-4369-b8e7-371d1aad5ff8",
      "modified": "2026-07-31T20:48:26.787Z",
      "references": [
        {
          "source_name": "Rostovcev APT41 2021",
          "url": "https://www.group-ib.com/blog/apt41-world-tour-2021/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0fa5e3ed-8b00-4f03-9adf-caf5d0e0bd2c",
      "subject": "ATTACK:enterprise:S1156",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0fa5e3ed-8b00-4f03-9adf-caf5d0e0bd2c",
      "modified": "2026-04-29T14:23:05.925Z",
      "references": [
        {
          "source_name": "Talos Manjusaka 2022",
          "url": "https://blog.talosintelligence.com/manjusaka-offensive-framework/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--100f4917-1702-4707-bd9f-58d471e77018",
      "subject": "ATTACK:enterprise:S0284",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--100f4917-1702-4707-bd9f-58d471e77018",
      "modified": "2026-04-29T14:23:05.926Z",
      "references": [
        {
          "source_name": "Talos Cobalt Group July 2018",
          "url": "https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"
        },
        {
          "source_name": "Security Intelligence More Eggs Aug 2019",
          "url": "https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--108fe161-3cea-4517-bd7c-4c623de4094f",
      "subject": "ATTACK:enterprise:C0060",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--108fe161-3cea-4517-bd7c-4c623de4094f",
      "modified": "2026-07-31T18:47:26.819Z",
      "references": [
        {
          "source_name": "Trend Micro Earth Kasha Anel NOV 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--11764f59-a7b9-4dff-8e37-471d739f5343",
      "subject": "ATTACK:enterprise:S1130",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--11764f59-a7b9-4dff-8e37-471d739f5343",
      "modified": "2026-04-29T14:23:05.928Z",
      "references": [
        {
          "source_name": "HP RaspberryRobin 2024",
          "url": "https://threatresearch.ext.hp.com/raspberry-robin-now-spreading-through-windows-script-files/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--11ed4654-a7bf-4063-9452-6d6174b9f8bc",
      "subject": "ATTACK:enterprise:S0520",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--11ed4654-a7bf-4063-9452-6d6174b9f8bc",
      "modified": "2026-04-29T14:23:05.928Z",
      "references": [
        {
          "source_name": "US-CERT BLINDINGCAN Aug 2020",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--12168524-c6cf-4b8f-b114-7b10b06b8f32",
      "subject": "ATTACK:enterprise:S1037",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--12168524-c6cf-4b8f-b114-7b10b06b8f32",
      "modified": "2026-04-29T14:23:05.929Z",
      "references": [
        {
          "source_name": "DHS CISA AA22-055A MuddyWater February 2022",
          "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"
        },
        {
          "source_name": "Mandiant UNC3313 Feb 2022",
          "url": "https://www.mandiant.com/resources/telegram-malware-iranian-espionage"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--128eb6e8-d1a7-4ff6-85e6-a68cfea3298e",
      "subject": "ATTACK:enterprise:S0218",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--128eb6e8-d1a7-4ff6-85e6-a68cfea3298e",
      "modified": "2026-04-29T14:23:05.929Z",
      "references": [
        {
          "source_name": "FireEye APT37 Feb 2018",
          "url": "https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--12a69be7-09b4-4188-9b78-a035d0b622ee",
      "subject": "ATTACK:enterprise:S9045",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--12a69be7-09b4-4188-9b78-a035d0b622ee",
      "modified": "2026-10-01T17:34:02.266Z",
      "references": [
        {
          "source_name": "AI-Mexico-Govt-Breach",
          "url": "https://cdn.prod.website-files.com/69944dd945f20ca4a27a7c47/69d8bb5aea59e31efb3b8a7f_Tech_Report_ai_breach_mex_gov.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--12ecc5cc-dad6-4532-9945-df575b008c2a",
      "subject": "ATTACK:enterprise:S1085",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--12ecc5cc-dad6-4532-9945-df575b008c2a",
      "modified": "2026-04-29T14:23:05.930Z",
      "references": [
        {
          "source_name": "Bitdefender Sardonic Aug 2021",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--132c7780-3fa4-478b-b037-f2c1ad99d98f",
      "subject": "ATTACK:enterprise:S0482",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--132c7780-3fa4-478b-b037-f2c1ad99d98f",
      "modified": "2026-04-29T14:23:05.930Z",
      "references": [
        {
          "source_name": "MacKeeper Bundlore Apr 2019",
          "url": "https://mackeeper.com/blog/post/610-macos-bundlore-adware-analysis/"
        },
        {
          "source_name": "20 macOS Common Tools and Techniques",
          "url": "https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--137ce702-f0e6-4dfa-8ca5-439155d91af9",
      "subject": "ATTACK:enterprise:S0513",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--137ce702-f0e6-4dfa-8ca5-439155d91af9",
      "modified": "2026-04-29T14:23:05.930Z",
      "references": [
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--14135aaa-6080-48c1-8a08-d6ee9bb15c3d",
      "subject": "ATTACK:enterprise:S0081",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--14135aaa-6080-48c1-8a08-d6ee9bb15c3d",
      "modified": "2026-04-29T14:23:05.931Z",
      "references": [
        {
          "source_name": "Lotus Blossom Jun 2015",
          "url": "https://www.paloaltonetworks.com/resources/research/unit42-operation-lotus-blossom.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--142afe71-581e-415e-9867-97ac0aaded65",
      "subject": "ATTACK:enterprise:S0559",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--142afe71-581e-415e-9867-97ac0aaded65",
      "modified": "2026-04-29T14:23:05.931Z",
      "references": [
        {
          "source_name": "FireEye SUNBURST Backdoor December 2020",
          "url": "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
        },
        {
          "source_name": "Microsoft Analyzing Solorigate Dec 2020",
          "url": "https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1489f01c-fe49-4332-99e2-d72c487403b6",
      "subject": "ATTACK:enterprise:S0493",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1489f01c-fe49-4332-99e2-d72c487403b6",
      "modified": "2026-04-29T14:23:05.932Z",
      "references": [
        {
          "source_name": "Trustwave GoldenSpy June 2020",
          "url": "https://www.trustwave.com/en-us/resources/library/documents/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1501c966-8f40-4093-b0d1-b3d572b3a1ee",
      "subject": "ATTACK:enterprise:S1016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1501c966-8f40-4093-b0d1-b3d572b3a1ee",
      "modified": "2026-04-29T14:23:05.933Z",
      "references": [
        {
          "source_name": "ESET DazzleSpy Jan 2022",
          "url": "https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--166c430d-0272-4dca-8d30-318cda0a0a63",
      "subject": "ATTACK:enterprise:S0046",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--166c430d-0272-4dca-8d30-318cda0a0a63",
      "modified": "2026-04-29T14:23:05.935Z",
      "references": [
        {
          "source_name": "F-Secure CozyDuke",
          "url": "https://www.f-secure.com/documents/996508/1030745/CozyDuke"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--16cb7ede-b431-4711-bcb1-91bc925663e5",
      "subject": "ATTACK:enterprise:S0031",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--16cb7ede-b431-4711-bcb1-91bc925663e5",
      "modified": "2026-04-29T14:23:05.935Z",
      "references": [
        {
          "source_name": "FireEye APT30",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--16e1777b-af28-412b-bcc3-469aba0f8a87",
      "subject": "ATTACK:enterprise:S1013",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--16e1777b-af28-412b-bcc3-469aba0f8a87",
      "modified": "2026-04-29T14:23:05.935Z",
      "references": [
        {
          "source_name": "Cisco Talos Bitter Bangladesh May 2022",
          "url": "https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--170e1e46-f3ea-4edb-a115-dde5a7c13e0f",
      "subject": "ATTACK:enterprise:S9035",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--170e1e46-f3ea-4edb-a115-dde5a7c13e0f",
      "modified": "2026-04-29T14:23:05.936Z",
      "references": [
        {
          "source_name": "Splunk LAMEHUG SEP 2025",
          "url": "https://www.splunk.com/en_us/blog/security/lamehug-ai-driven-malware-llm-cyber-intrusion-analysis.html"
        },
        {
          "source_name": "Nov AI Threat Tracker",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--172da5b1-cf68-468a-8208-b15ea5c813dc",
      "subject": "ATTACK:enterprise:S0356",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--172da5b1-cf68-468a-8208-b15ea5c813dc",
      "modified": "2026-04-29T14:23:05.936Z",
      "references": [
        {
          "source_name": "Medium KONNI Jan 2020",
          "url": "https://medium.com/d-hunter/a-look-into-konni-2019-campaign-b45a0f321e9b"
        },
        {
          "source_name": "Talos Konni May 2017",
          "url": "https://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html"
        },
        {
          "source_name": "Malwarebytes Konni Aug 2021",
          "url": "https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--175199ba-b8b8-467b-9010-a2f549abd957",
      "subject": "ATTACK:enterprise:S0441",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--175199ba-b8b8-467b-9010-a2f549abd957",
      "modified": "2026-04-29T14:23:05.936Z",
      "references": [
        {
          "source_name": "Unit 42 Inception November 2018",
          "url": "https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--179538d1-5770-42ef-976f-c0fd65faa1ea",
      "subject": "ATTACK:enterprise:S0467",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--179538d1-5770-42ef-976f-c0fd65faa1ea",
      "modified": "2026-04-29T14:23:05.936Z",
      "references": [
        {
          "source_name": "Kaspersky TajMahal April 2019",
          "url": "https://securelist.com/project-tajmahal/90240/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--191aac5f-38bc-429b-8343-32eb17fa4919",
      "subject": "ATTACK:enterprise:C0001",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--191aac5f-38bc-429b-8343-32eb17fa4919",
      "modified": "2026-07-31T18:47:18.629Z",
      "references": [
        {
          "source_name": "Talos Frankenstein June 2019",
          "url": "https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--196fcf2a-e520-4fab-baa2-68af3cb0e57c",
      "subject": "ATTACK:enterprise:S1248",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--196fcf2a-e520-4fab-baa2-68af3cb0e57c",
      "modified": "2026-04-29T14:23:05.939Z",
      "references": [
        {
          "source_name": "Socket BeaverTail XORIndex HexEval Contagious Interview July 2025",
          "url": "https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1a28d78a-d11b-466a-977f-19d2e88c1952",
      "subject": "ATTACK:enterprise:S1124",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1a28d78a-d11b-466a-977f-19d2e88c1952",
      "modified": "2026-04-29T14:23:05.940Z",
      "references": [
        {
          "source_name": "SocGholish-update",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"
        },
        {
          "source_name": "Red Canary SocGholish March 2024",
          "url": "https://redcanary.com/threat-detection-report/threats/socgholish/"
        },
        {
          "source_name": "Secureworks Gold Prelude Profile",
          "url": "https://www.secureworks.com/research/threat-profiles/gold-prelude"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1b265c93-7331-41b7-9cf2-c8c21a0969e7",
      "subject": "ATTACK:enterprise:S1178",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1b265c93-7331-41b7-9cf2-c8c21a0969e7",
      "modified": "2026-04-29T14:23:05.942Z",
      "references": [
        {
          "source_name": "Kaspersky ShrinkLocker 2024",
          "url": "https://securelist.com/ransomware-abuses-bitlocker/112643/"
        },
        {
          "source_name": "Splunk ShrinkLocker 2024",
          "url": "https://www.splunk.com/en_us/blog/security/shrinklocker-malware-abusing-bitlocker-to-lock-your-data.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1b47deed-a8b9-4e0f-a47e-9570ecccaa90",
      "subject": "ATTACK:enterprise:S0567",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1b47deed-a8b9-4e0f-a47e-9570ecccaa90",
      "modified": "2026-04-29T14:23:05.942Z",
      "references": [
        {
          "source_name": "Securelist Dtrack",
          "url": "https://securelist.com/my-name-is-dtrack/93338/"
        },
        {
          "source_name": "CyberBit Dtrack",
          "url": "https://www.cyberbit.com/blog/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1b9b84cc-f9c7-48c5-8e23-ac00a7a4691a",
      "subject": "ATTACK:enterprise:G0108",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1b9b84cc-f9c7-48c5-8e23-ac00a7a4691a",
      "modified": "2026-07-31T18:48:02.660Z",
      "references": [
        {
          "source_name": "RedCanary Mockingbird May 2020",
          "url": "https://redcanary.com/blog/blue-mockingbird-cryptominer/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1c3bc7ec-cabe-4c8f-9d6e-99afd877e845",
      "subject": "ATTACK:enterprise:S0457",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1c3bc7ec-cabe-4c8f-9d6e-99afd877e845",
      "modified": "2026-04-29T14:23:05.943Z",
      "references": [
        {
          "source_name": "TrendMicro Netwalker May 2020",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1da27474-f902-419e-97a9-1fba8743cce8",
      "subject": "ATTACK:enterprise:S0657",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1da27474-f902-419e-97a9-1fba8743cce8",
      "modified": "2026-04-29T14:23:05.945Z",
      "references": [
        {
          "source_name": "Volexity InkySquid BLUELIGHT August 2021",
          "url": "https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1daf23d1-fdf0-4858-8509-836efb883f18",
      "subject": "ATTACK:enterprise:S1015",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1daf23d1-fdf0-4858-8509-836efb883f18",
      "modified": "2026-04-29T14:23:05.945Z",
      "references": [
        {
          "source_name": "Accenture Lyceum Targets November 2021",
          "url": "https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns"
        },
        {
          "source_name": "ClearSky Siamesekitten August 2021",
          "url": "https://www.clearskysec.com/siamesekitten/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1f238bb1-62c0-409b-ac79-38b38f54497d",
      "subject": "ATTACK:enterprise:G1001",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1f238bb1-62c0-409b-ac79-38b38f54497d",
      "modified": "2026-07-31T20:48:51.680Z",
      "references": [
        {
          "source_name": "Kaspersky Lyceum October 2021",
          "url": "https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1fda6ff7-a344-4bc3-b545-4083cc15290d",
      "subject": "ATTACK:enterprise:S0139",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1fda6ff7-a344-4bc3-b545-4083cc15290d",
      "modified": "2026-04-29T14:23:05.948Z",
      "references": [
        {
          "source_name": "Volexity PowerDuke November 2016",
          "url": "https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2026783b-b6c7-432f-9c28-72090cb5539a",
      "subject": "ATTACK:enterprise:C0012",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2026783b-b6c7-432f-9c28-72090cb5539a",
      "modified": "2026-07-31T18:47:28.175Z",
      "references": [
        {
          "source_name": "Cybereason OperationCuckooBees May 2022",
          "url": "https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-winnti-techniques"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--20f422e8-6244-46e3-8842-f5dc3e37568c",
      "subject": "ATTACK:enterprise:S0412",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--20f422e8-6244-46e3-8842-f5dc3e37568c",
      "modified": "2026-04-29T14:23:05.950Z",
      "references": [
        {
          "source_name": "Talos ZxShell Oct 2014",
          "url": "https://blogs.cisco.com/security/talos/opening-zxshell"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--20f43b8b-55c7-4710-8813-6512c3b11c1a",
      "subject": "ATTACK:enterprise:S1073",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--20f43b8b-55c7-4710-8813-6512c3b11c1a",
      "modified": "2026-04-29T14:23:05.950Z",
      "references": [
        {
          "source_name": "Cybereason Royal December 2022",
          "url": "https://www.cybereason.com/blog/royal-ransomware-analysis"
        },
        {
          "source_name": "Trend Micro Royal Linux ESXi February 2023",
          "url": "https://www.trendmicro.com/en_us/research/23/b/royal-ransomware-expands-attacks-by-targeting-linux-esxi-servers.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2147037d-4af2-4492-9c86-c85dfc6965af",
      "subject": "ATTACK:enterprise:S0332",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2147037d-4af2-4492-9c86-c85dfc6965af",
      "modified": "2026-04-29T14:23:05.950Z",
      "references": [
        {
          "source_name": "Fortinet Remcos Campaign NOV 2024",
          "url": "https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--21f5a441-fe32-430e-935c-0929f4101b6e",
      "subject": "ATTACK:enterprise:S1019",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--21f5a441-fe32-430e-935c-0929f4101b6e",
      "modified": "2026-04-29T14:23:05.951Z",
      "references": [
        {
          "source_name": "Accenture Lyceum Targets November 2021",
          "url": "https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns"
        },
        {
          "source_name": "ClearSky Siamesekitten August 2021",
          "url": "https://www.clearskysec.com/siamesekitten/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--231dc643-8b22-4a24-83f2-7327a1c5bd13",
      "subject": "ATTACK:enterprise:S0233",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--231dc643-8b22-4a24-83f2-7327a1c5bd13",
      "modified": "2026-04-29T14:23:05.953Z",
      "references": [
        {
          "source_name": "FireEye Periscope March 2018",
          "url": "https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--23c89ec7-3407-4f6d-8b4b-0ab16fbf356c",
      "subject": "ATTACK:enterprise:S0504",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--23c89ec7-3407-4f6d-8b4b-0ab16fbf356c",
      "modified": "2026-04-29T14:23:05.954Z",
      "references": [
        {
          "source_name": "Medium Anchor DNS July 2020",
          "url": "https://medium.com/stage-2-security/anchor-dns-malware-family-goes-cross-platform-d807ba13ca30"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--23d16034-a2eb-40ef-857b-63708e63bf9a",
      "subject": "ATTACK:enterprise:S0229",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--23d16034-a2eb-40ef-857b-63708e63bf9a",
      "modified": "2026-04-29T14:23:05.954Z",
      "references": [
        {
          "source_name": "Proofpoint Leviathan Oct 2017",
          "url": "https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--24edc813-1a52-47ae-9068-7423c0052a43",
      "subject": "ATTACK:enterprise:S9031",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--24edc813-1a52-47ae-9068-7423c0052a43",
      "modified": "2026-04-29T14:23:05.956Z",
      "references": [
        {
          "source_name": "Palo Alto Ashen Lepus DEC 2025",
          "url": "https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--270c93ba-a3d4-4ace-8fad-691c64c13e2f",
      "subject": "ATTACK:enterprise:S0501",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--270c93ba-a3d4-4ace-8fad-691c64c13e2f",
      "modified": "2026-04-29T14:23:05.958Z",
      "references": [
        {
          "source_name": "ESET PipeMon May 2020",
          "url": "https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--272068a3-47e3-42d6-8772-71d39c1976c3",
      "subject": "ATTACK:enterprise:S0140",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--272068a3-47e3-42d6-8772-71d39c1976c3",
      "modified": "2026-04-29T14:23:05.958Z",
      "references": [
        {
          "source_name": "Palo Alto Shamoon Nov 2016",
          "url": "http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/"
        },
        {
          "source_name": "Unit 42 Shamoon3 2018",
          "url": "https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--272163a2-0b55-4d7a-b955-b7fa1022a7e2",
      "subject": "ATTACK:enterprise:G1057",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--272163a2-0b55-4d7a-b955-b7fa1022a7e2",
      "modified": "2026-07-31T18:47:58.660Z",
      "references": [
        {
          "source_name": "Google_SHOracle_Jun2026",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--27375058-3002-4fc2-a964-a1e336a10a2a",
      "subject": "ATTACK:enterprise:S0065",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--27375058-3002-4fc2-a964-a1e336a10a2a",
      "modified": "2026-04-29T14:23:05.958Z",
      "references": [
        {
          "source_name": "CrowdStrike Putter Panda",
          "url": "http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2854c1cb-d7e6-484a-afff-4a1e3a43df64",
      "subject": "ATTACK:enterprise:S9037",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2854c1cb-d7e6-484a-afff-4a1e3a43df64",
      "modified": "2026-04-29T14:23:05.960Z",
      "references": [
        {
          "source_name": "CloudSEK_RustyWater_Jan2026",
          "url": "https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2910f5f5-38d6-418a-8566-23d31b93b124",
      "subject": "ATTACK:enterprise:S0354",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2910f5f5-38d6-418a-8566-23d31b93b124",
      "modified": "2026-04-29T14:23:05.961Z",
      "references": [
        {
          "source_name": "Securelist Denis April 2017",
          "url": "https://securelist.com/use-of-dns-tunneling-for-cc-communications/78203/"
        },
        {
          "source_name": "Cybereason Cobalt Kitty 2017",
          "url": "https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--29d3798c-dc27-4950-abc4-30b48608a746",
      "subject": "ATTACK:enterprise:S0373",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--29d3798c-dc27-4950-abc4-30b48608a746",
      "modified": "2026-04-29T14:23:05.962Z",
      "references": [
        {
          "source_name": "Cofense Astaroth Sept 2018",
          "url": "https://web.archive.org/web/20200302071436/https://cofense.com/seeing-resurgence-demonic-astaroth-wmic-trojan/"
        },
        {
          "source_name": "Cybereason Astaroth Feb 2019",
          "url": "https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2b9ce635-3ce2-4145-864e-70b0b09438b8",
      "subject": "ATTACK:enterprise:S1020",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2b9ce635-3ce2-4145-864e-70b0b09438b8",
      "modified": "2026-04-29T14:23:05.964Z",
      "references": [
        {
          "source_name": "Kaspersky Lyceum October 2021",
          "url": "https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2c351c25-fc11-4168-9ad5-6a5aab84634c",
      "subject": "ATTACK:enterprise:S1172",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2c351c25-fc11-4168-9ad5-6a5aab84634c",
      "modified": "2026-04-29T14:23:05.964Z",
      "references": [
        {
          "source_name": "ESET OilRig Downloaders DEC 2023",
          "url": "https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2c44970b-616d-401e-b9ed-72ac39ca5709",
      "subject": "ATTACK:enterprise:G0012",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2c44970b-616d-401e-b9ed-72ac39ca5709",
      "modified": "2026-07-31T18:48:11.865Z",
      "references": [
        {
          "source_name": "Securelist Darkhotel Aug 2015",
          "url": "https://securelist.com/darkhotels-attacks-in-2015/71713/"
        },
        {
          "source_name": "Microsoft DUBNIUM July 2016",
          "url": "https://www.microsoft.com/security/blog/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2c88062e-f63f-4313-85ef-3d68a9d3fde5",
      "subject": "ATTACK:enterprise:S1081",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2c88062e-f63f-4313-85ef-3d68a9d3fde5",
      "modified": "2026-04-29T14:23:05.965Z",
      "references": [
        {
          "source_name": "Gigamon BADHATCH Jul 2019",
          "url": "https://blog.gigamon.com/2019/07/23/abadbabe-8badf00d-discovering-badhatch-and-a-detailed-look-at-fin8s-tooling/"
        },
        {
          "source_name": "BitDefender BADHATCH Mar 2021",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2cc929d2-469a-4c71-ba4e-bc3dec29da5c",
      "subject": "ATTACK:enterprise:S1190",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2cc929d2-469a-4c71-ba4e-bc3dec29da5c",
      "modified": "2026-04-29T14:23:05.965Z",
      "references": [
        {
          "source_name": "WithSecure Kapeka 2024",
          "url": "https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Research-Kapeka.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2dfd1cd3-c2da-4c65-9699-54b943b8c08d",
      "subject": "ATTACK:enterprise:S9029",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2dfd1cd3-c2da-4c65-9699-54b943b8c08d",
      "modified": "2026-04-29T14:23:05.967Z",
      "references": [
        {
          "source_name": "Check Point Wirte NOV 2024",
          "url": "https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2e367a09-1d94-4ea4-984c-a592b769fffa",
      "subject": "ATTACK:enterprise:S0059",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2e367a09-1d94-4ea4-984c-a592b769fffa",
      "modified": "2026-04-29T14:23:05.967Z",
      "references": [
        {
          "source_name": "Baumgartner Naikon 2015",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2eb32b46-9833-4391-b282-c7ee10bbfc62",
      "subject": "ATTACK:enterprise:S1052",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2eb32b46-9833-4391-b282-c7ee10bbfc62",
      "modified": "2026-04-29T14:23:05.968Z",
      "references": [
        {
          "source_name": "Mandiant APT41",
          "url": "https://www.mandiant.com/resources/apt41-us-state-governments"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2f2a1144-7a4c-4a9e-9446-627ab73e08da",
      "subject": "ATTACK:enterprise:S1239",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2f2a1144-7a4c-4a9e-9446-627ab73e08da",
      "modified": "2026-04-29T14:23:05.970Z",
      "references": [
        {
          "source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA",
          "url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"
        },
        {
          "source_name": "Trend Micro Mustang Panda Earth Preta Toneshell February 2025",
          "url": "https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"
        },
        {
          "source_name": "Zscaler",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2fa01aae-a201-4daa-b0e0-2e22af5788bb",
      "subject": "ATTACK:enterprise:G1018",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2fa01aae-a201-4daa-b0e0-2e22af5788bb",
      "modified": "2026-07-31T18:47:55.128Z",
      "references": [
        {
          "source_name": "Proofpoint TA2541 February 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--303ff42e-09fa-49ab-9fa3-420aedb090dc",
      "subject": "ATTACK:enterprise:S1065",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--303ff42e-09fa-49ab-9fa3-420aedb090dc",
      "modified": "2026-04-29T14:23:05.976Z",
      "references": [
        {
          "source_name": "MalwareBytes WoodyRAT Aug 2022",
          "url": "https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--30e6bb1e-7c6a-4fff-8163-f5a065d2d960",
      "subject": "ATTACK:enterprise:S0051",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--30e6bb1e-7c6a-4fff-8163-f5a065d2d960",
      "modified": "2026-04-29T14:23:05.979Z",
      "references": [
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3114ebc8-7dc2-4ee7-8aad-5b764f27a6d8",
      "subject": "ATTACK:enterprise:G1016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3114ebc8-7dc2-4ee7-8aad-5b764f27a6d8",
      "modified": "2026-07-31T18:48:30.454Z",
      "references": [
        {
          "source_name": "Sygnia Elephant Beetle Jan 2022",
          "url": "https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"
        },
        {
          "source_name": "Mandiant FIN13 Aug 2022",
          "url": "https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3126c7fa-02eb-475f-a474-26d4d6af7a67",
      "subject": "ATTACK:enterprise:S0086",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3126c7fa-02eb-475f-a474-26d4d6af7a67",
      "modified": "2026-04-29T14:23:05.979Z",
      "references": [
        {
          "source_name": "Cylance Dust Storm",
          "url": "https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--322876d6-1b49-43d8-9e4a-590919d1f930",
      "subject": "ATTACK:enterprise:G0106",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--322876d6-1b49-43d8-9e4a-590919d1f930",
      "modified": "2026-07-31T18:47:52.196Z",
      "references": [
        {
          "source_name": "Anomali Rocke March 2019",
          "url": "https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--32e93dd8-d0df-40d8-b85f-e10e70fc0b8f",
      "subject": "ATTACK:enterprise:S0259",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--32e93dd8-d0df-40d8-b85f-e10e70fc0b8f",
      "modified": "2026-04-29T14:23:05.986Z",
      "references": [
        {
          "source_name": "ASERT InnaputRAT April 2018",
          "url": "https://asert.arbornetworks.com/innaput-actors-utilize-remote-access-trojan-since-2016-presumably-targeting-victim-files/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--34775b6e-f7dd-4b0f-bbb4-c696bfbda1c2",
      "subject": "ATTACK:enterprise:S0486",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--34775b6e-f7dd-4b0f-bbb4-c696bfbda1c2",
      "modified": "2026-04-29T14:23:05.989Z",
      "references": [
        {
          "source_name": "ESET ForSSHe December 2018",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--350776c3-9234-4c8f-adff-9b36778e90c4",
      "subject": "ATTACK:enterprise:S0687",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--350776c3-9234-4c8f-adff-9b36778e90c4",
      "modified": "2026-04-29T14:23:05.990Z",
      "references": [
        {
          "source_name": "NCSC Cyclops Blink February 2022",
          "url": "https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--35697909-4c19-4799-a5ac-3153750619f8",
      "subject": "ATTACK:enterprise:S0180",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--35697909-4c19-4799-a5ac-3153750619f8",
      "modified": "2026-04-29T14:23:05.991Z",
      "references": [
        {
          "source_name": "US-CERT Volgmer 2 Nov 2017",
          "url": "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-D_WHITE_S508C.PDF"
        },
        {
          "source_name": "US-CERT Volgmer Nov 2017",
          "url": "https://www.us-cert.gov/ncas/alerts/TA17-318B"
        },
        {
          "source_name": "Symantec Volgmer Aug 2014",
          "url": "https://web.archive.org/web/20181126143456/https://www.symantec.com/security-center/writeup/2014-081811-3237-99?tabid=2"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--36112f24-7814-4c75-b5b7-a1205bb28b68",
      "subject": "ATTACK:enterprise:G0047",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--36112f24-7814-4c75-b5b7-a1205bb28b68",
      "modified": "2026-07-31T18:47:47.525Z",
      "references": [
        {
          "source_name": "CERT-EE Gamaredon January 2021",
          "url": "https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf"
        },
        {
          "source_name": "TrendMicro Gamaredon April 2020",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/"
        },
        {
          "source_name": "Palo Alto Gamaredon Feb 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"
        },
        {
          "source_name": "ESET Gamaredon Sept2024",
          "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"
        },
        {
          "source_name": "SymantecCarbonBlack_ShuckwormUSB_Apr2025",
          "url": "https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--384b6787-f69b-4d81-bc5e-c01a5c5b026e",
      "subject": "ATTACK:enterprise:S0670",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--384b6787-f69b-4d81-bc5e-c01a5c5b026e",
      "modified": "2026-04-29T14:23:05.997Z",
      "references": [
        {
          "source_name": "Check Point Warzone Feb 2020",
          "url": "https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--396edbf6-41b5-4377-90b6-4967c24de7fb",
      "subject": "ATTACK:enterprise:S0186",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--396edbf6-41b5-4377-90b6-4967c24de7fb",
      "modified": "2026-04-29T14:23:05.999Z",
      "references": [
        {
          "source_name": "ClearSky Charming Kitten Dec 2017",
          "url": "http://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3c766e53-1372-4b94-b7de-b3f70d4d1a91",
      "subject": "ATTACK:enterprise:S0363",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3c766e53-1372-4b94-b7de-b3f70d4d1a91",
      "modified": "2026-04-29T14:23:06.006Z",
      "references": [
        {
          "source_name": "Talos Frankenstein June 2019",
          "url": "https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html"
        },
        {
          "source_name": "Github PowerShell Empire",
          "url": "https://github.com/PowerShellEmpire/Empire"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3ca38ed9-3691-461d-81a1-1ad8de5817bb",
      "subject": "ATTACK:enterprise:S1068",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3ca38ed9-3691-461d-81a1-1ad8de5817bb",
      "modified": "2026-04-29T14:23:06.007Z",
      "references": [
        {
          "source_name": "Microsoft BlackCat Jun 2022",
          "url": "https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3d2ef7e3-419b-47d6-9779-65cfd0f0b86c",
      "subject": "ATTACK:enterprise:C0049",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3d2ef7e3-419b-47d6-9779-65cfd0f0b86c",
      "modified": "2026-07-31T18:47:32.781Z",
      "references": [
        {
          "source_name": "CISA Leviathan 2024",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3dbae391-a354-488a-b0ab-426d1a055413",
      "subject": "ATTACK:enterprise:S0391",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3dbae391-a354-488a-b0ab-426d1a055413",
      "modified": "2026-04-29T14:23:06.009Z",
      "references": [
        {
          "source_name": "FireEye HAWKBALL Jun 2019",
          "url": "https://www.fireeye.com/blog/threat-research/2019/06/government-in-central-asia-targeted-with-hawkball-backdoor.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3e58118d-64b9-43ae-bfd8-cb3c8bf19556",
      "subject": "ATTACK:enterprise:S0242",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3e58118d-64b9-43ae-bfd8-cb3c8bf19556",
      "modified": "2026-04-29T14:23:06.010Z",
      "references": [
        {
          "source_name": "SecureList SynAck Doppelgänging May 2018",
          "url": "https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3ee8862f-2595-462e-8df8-aab639314b65",
      "subject": "ATTACK:enterprise:G0067",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3ee8862f-2595-462e-8df8-aab639314b65",
      "modified": "2026-07-31T18:47:55.241Z",
      "references": [
        {
          "source_name": "Talos Group123",
          "url": "https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3ff46c64-10c7-474c-86eb-c66f1f85f5ac",
      "subject": "ATTACK:enterprise:S0568",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3ff46c64-10c7-474c-86eb-c66f1f85f5ac",
      "modified": "2026-04-29T14:23:06.012Z",
      "references": [
        {
          "source_name": "Prevailion EvilNum May 2020",
          "url": "https://web.archive.org/web/20221209052853/https://www.prevailion.com/phantom-in-the-command-shell-2/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--42ce3f19-e995-4a9e-b7d6-74a5a28824f9",
      "subject": "ATTACK:enterprise:S0217",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--42ce3f19-e995-4a9e-b7d6-74a5a28824f9",
      "modified": "2026-04-29T14:23:06.016Z",
      "references": [
        {
          "source_name": "FireEye APT37 Feb 2018",
          "url": "https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--42dc03ec-03fb-4bf0-8f5f-e90d1aacd6e7",
      "subject": "ATTACK:enterprise:S0156",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--42dc03ec-03fb-4bf0-8f5f-e90d1aacd6e7",
      "modified": "2026-04-29T14:23:06.016Z",
      "references": [
        {
          "source_name": "FireEye APT32 May 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--43809fa9-dbe2-4429-875e-f0828563d6aa",
      "subject": "ATTACK:enterprise:G0050",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--43809fa9-dbe2-4429-875e-f0828563d6aa",
      "modified": "2026-07-31T18:47:44.254Z",
      "references": [
        {
          "source_name": "ESET OceanLotus",
          "url": "https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/"
        },
        {
          "source_name": "ESET OceanLotus Mar 2019",
          "url": "https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"
        },
        {
          "source_name": "ESET OceanLotus macOS April 2019",
          "url": "https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/"
        },
        {
          "source_name": "FireEye APT32 April 2020",
          "url": "https://www.fireeye.com/blog/threat-research/2020/04/apt32-targeting-chinese-government-in-covid-19-related-espionage.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--44272fb3-a31d-4cea-b11c-b65e2bdcbd68",
      "subject": "ATTACK:enterprise:S0646",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--44272fb3-a31d-4cea-b11c-b65e2bdcbd68",
      "modified": "2026-04-29T14:23:06.018Z",
      "references": [
        {
          "source_name": "Secureworks GOLD KINGSWOOD September 2018",
          "url": "https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--47b7e027-4208-4ed6-b4ae-46941fed16be",
      "subject": "ATTACK:enterprise:S0280",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--47b7e027-4208-4ed6-b4ae-46941fed16be",
      "modified": "2026-04-29T14:23:06.023Z",
      "references": [
        {
          "source_name": "APT15 Intezer June 2018",
          "url": "https://web.archive.org/web/20180615122133/https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--48281b5d-ca6f-401e-bda1-24f6537dcf1d",
      "subject": "ATTACK:enterprise:S0262",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--48281b5d-ca6f-401e-bda1-24f6537dcf1d",
      "modified": "2026-04-29T14:23:06.024Z",
      "references": [
        {
          "source_name": "GitHub QuasarRAT",
          "url": "https://github.com/quasar/QuasarRAT"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--487d67d7-b697-4de4-abde-decee8b17c44",
      "subject": "ATTACK:enterprise:S0098",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--487d67d7-b697-4de4-abde-decee8b17c44",
      "modified": "2026-04-29T14:23:06.024Z",
      "references": [
        {
          "source_name": "Palo Alto T9000 Feb 2016",
          "url": "http://researchcenter.paloaltonetworks.com/2016/02/t9000-advanced-modular-backdoor-uses-complex-anti-analysis-techniques/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--48a5b14e-81c8-4629-a846-7c8273bc3963",
      "subject": "ATTACK:enterprise:S1066",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--48a5b14e-81c8-4629-a846-7c8273bc3963",
      "modified": "2026-04-29T14:23:06.024Z",
      "references": [
        {
          "source_name": "Secureworks DarkTortilla Aug 2022",
          "url": "https://www.secureworks.com/research/darktortilla-malware-analysis"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--48ee2b91-2ce7-46c0-a27a-aea1695355b4",
      "subject": "ATTACK:enterprise:S0690",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--48ee2b91-2ce7-46c0-a27a-aea1695355b4",
      "modified": "2026-04-29T14:23:06.025Z",
      "references": [
        {
          "source_name": "Objective See Green Lambert for OSX Oct 2021",
          "url": "https://objective-see.com/blog/blog_0x68.html"
        },
        {
          "source_name": "Glitch-Cat Green Lambert ATTCK Oct 2021",
          "url": "https://web.archive.org/web/20211018145402/https://www.glitch-cat.com/blog/green-lambert-and-attack"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--49af09c8-1460-485d-9f09-dacea47fa016",
      "subject": "ATTACK:enterprise:S0088",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--49af09c8-1460-485d-9f09-dacea47fa016",
      "modified": "2026-04-29T14:23:06.026Z",
      "references": [
        {
          "source_name": "Zscaler Kasidet",
          "url": "http://research.zscaler.com/2016/01/malicious-office-files-dropping-kasidet.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4a1308c8-a392-4d89-8fb2-90692e07cadb",
      "subject": "ATTACK:enterprise:S1169",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4a1308c8-a392-4d89-8fb2-90692e07cadb",
      "modified": "2026-04-29T14:23:06.026Z",
      "references": [
        {
          "source_name": "ESET OilRig Campaigns Sep 2023",
          "url": "https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4a959425-4d43-4969-9a47-768894a3afaa",
      "subject": "ATTACK:enterprise:S0082",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4a959425-4d43-4969-9a47-768894a3afaa",
      "modified": "2026-04-29T14:23:06.027Z",
      "references": [
        {
          "source_name": "Emissary Trojan Feb 2016",
          "url": "http://researchcenter.paloaltonetworks.com/2016/02/emissary-trojan-changelog-did-operation-lotus-blossom-cause-it-to-evolve/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4ae0fc35-a321-4ffb-b7fa-b03a20230fc4",
      "subject": "ATTACK:enterprise:S0649",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4ae0fc35-a321-4ffb-b7fa-b03a20230fc4",
      "modified": "2026-04-29T14:23:06.027Z",
      "references": [
        {
          "source_name": "FireEye SMOKEDHAM June 2021",
          "url": "https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4b3f85b7-a7a4-446f-a3cb-d922268ee879",
      "subject": "ATTACK:enterprise:G0100",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4b3f85b7-a7a4-446f-a3cb-d922268ee879",
      "modified": "2026-07-31T18:48:25.104Z",
      "references": [
        {
          "source_name": "Symantec Inception Framework March 2018",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4bd74c6c-9e4f-4048-b968-13319d68ff00",
      "subject": "ATTACK:enterprise:S0267",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4bd74c6c-9e4f-4048-b968-13319d68ff00",
      "modified": "2026-04-29T14:23:06.029Z",
      "references": [
        {
          "source_name": "ESET GreyEnergy Oct 2018",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf"
        },
        {
          "source_name": "FireEye FELIXROOT July 2018",
          "url": "https://web.archive.org/web/20200607025424/https://www.fireeye.com/blog/threat-research/2018/07/microsoft-office-vulnerabilities-used-to-distribute-felixroot-backdoor.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4be87979-faf9-4a7a-998a-d1aa3fbf5a80",
      "subject": "ATTACK:enterprise:S0203",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4be87979-faf9-4a7a-998a-d1aa3fbf5a80",
      "modified": "2026-04-29T14:23:06.029Z",
      "references": [
        {
          "source_name": "Symantec Hydraq Jan 2010",
          "url": "https://www.symantec.com/security_response/writeup.jsp?docid=2010-011114-1830-99"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4c5755ef-d3fc-457d-9103-8bb9e37ae462",
      "subject": "ATTACK:enterprise:S1246",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4c5755ef-d3fc-457d-9103-8bb9e37ae462",
      "modified": "2026-04-29T14:23:06.029Z",
      "references": [
        {
          "source_name": "Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024",
          "url": "https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"
        },
        {
          "source_name": "ESET Contagious Interview BeaverTail InvisibleFerret February 2025",
          "url": "https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"
        },
        {
          "source_name": "PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023",
          "url": "https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4caf9f0d-dfe9-48ce-9b6e-812577e09711",
      "subject": "ATTACK:enterprise:S0115",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4caf9f0d-dfe9-48ce-9b6e-812577e09711",
      "modified": "2026-04-29T14:23:06.030Z",
      "references": [
        {
          "source_name": "Kaspersky Transparent Tribe August 2020",
          "url": "https://securelist.com/transparent-tribe-part-1/98127/"
        },
        {
          "source_name": "Proofpoint Operation Transparent Tribe March 2016",
          "url": "https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"
        },
        {
          "source_name": "Cisco Talos Transparent Tribe Education Campaign July 2022",
          "url": "https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4d39c319-bf5d-4129-83ba-11df82fdca17",
      "subject": "ATTACK:enterprise:S1122",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4d39c319-bf5d-4129-83ba-11df82fdca17",
      "modified": "2026-04-29T14:23:06.030Z",
      "references": [
        {
          "source_name": "ESET Security Mispadu Facebook Ads 2019",
          "url": "https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4e109125-e22b-4aaf-ac3c-9a0f5351b440",
      "subject": "ATTACK:enterprise:S1031",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4e109125-e22b-4aaf-ac3c-9a0f5351b440",
      "modified": "2026-04-29T14:23:06.031Z",
      "references": [
        {
          "source_name": "Unit 42 PingPull Jun 2022",
          "url": "https://unit42.paloaltonetworks.com/pingpull-gallium/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4e52b5b5-5f7d-4900-aae0-34b2d71b90e0",
      "subject": "ATTACK:enterprise:S1229",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4e52b5b5-5f7d-4900-aae0-34b2d71b90e0",
      "modified": "2026-04-29T14:23:06.032Z",
      "references": [
        {
          "source_name": "Fortinet Havoc MAR 2025",
          "url": "https://www.fortinet.com/blog/threat-research/havoc-sharepoint-with-microsoft-graph-api-turns-into-fud-c2"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4e6c5e8c-96a2-4da8-869a-56fe224e037e",
      "subject": "ATTACK:enterprise:S0283",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4e6c5e8c-96a2-4da8-869a-56fe224e037e",
      "modified": "2026-04-29T14:23:06.032Z",
      "references": [
        {
          "source_name": "Symantec Frutas Feb 2013",
          "url": "https://www.symantec.com/connect/blogs/cross-platform-frutas-rat-builder-and-back-door"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4e88ec20-d309-440d-a685-0d2abdc1d7ef",
      "subject": "ATTACK:enterprise:S0223",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4e88ec20-d309-440d-a685-0d2abdc1d7ef",
      "modified": "2026-04-29T14:23:06.032Z",
      "references": [
        {
          "source_name": "FireEye MuddyWater Mar 2018",
          "url": "https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"
        },
        {
          "source_name": "TrendMicro POWERSTATS V3 June 2019",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4eb0635f-1851-4516-a584-4d5ff3c2e078",
      "subject": "ATTACK:enterprise:S1018",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4eb0635f-1851-4516-a584-4d5ff3c2e078",
      "modified": "2026-04-29T14:23:06.032Z",
      "references": [
        {
          "source_name": "Malwarebytes Saint Bot April 2021",
          "url": "https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4eec017c-8bf2-4eda-8c92-15926fc7e5aa",
      "subject": "ATTACK:enterprise:G0032",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4eec017c-8bf2-4eda-8c92-15926fc7e5aa",
      "modified": "2026-07-31T20:48:46.682Z",
      "references": [
        {
          "source_name": "Novetta Blockbuster Destructive Malware",
          "url": "https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"
        },
        {
          "source_name": "Novetta Blockbuster Loaders",
          "url": "https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"
        },
        {
          "source_name": "Novetta Blockbuster",
          "url": "https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"
        },
        {
          "source_name": "Lazarus APT January 2022",
          "url": "https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"
        },
        {
          "source_name": "McAfee Lazarus Resurfaces Feb 2018",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"
        },
        {
          "source_name": "McAfee GhostSecret",
          "url": "https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4f5fd1ed-a91e-4a9e-b2e8-6c45cc31e065",
      "subject": "ATTACK:enterprise:S0512",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4f5fd1ed-a91e-4a9e-b2e8-6c45cc31e065",
      "modified": "2026-04-29T14:23:06.033Z",
      "references": [
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--50ee9427-67e7-4db4-b931-1b872cd73e86",
      "subject": "ATTACK:enterprise:C0047",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--50ee9427-67e7-4db4-b931-1b872cd73e86",
      "modified": "2026-07-31T18:47:19.408Z",
      "references": [
        {
          "source_name": "Recorded Future RedDelta 2025",
          "url": "https://go.recordedfuture.com/hubfs/reports/cta-cn-2025-0109.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--520faa7e-f529-4b54-b4dc-55d6ae094717",
      "subject": "ATTACK:enterprise:S0337",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--520faa7e-f529-4b54-b4dc-55d6ae094717",
      "modified": "2026-04-29T14:23:06.037Z",
      "references": [
        {
          "source_name": "Unit 42 BadPatch Oct 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/10/unit42-badpatch/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--52f3a62b-621b-4cef-86f6-8152fa719473",
      "subject": "ATTACK:enterprise:S0667",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--52f3a62b-621b-4cef-86f6-8152fa719473",
      "modified": "2026-04-29T14:23:06.038Z",
      "references": [
        {
          "source_name": "ESET Gelsemium June 2021",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5301c007-7c00-4b4d-b355-864db8de052f",
      "subject": "ATTACK:enterprise:S0137",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5301c007-7c00-4b4d-b355-864db8de052f",
      "modified": "2026-04-29T14:23:06.039Z",
      "references": [
        {
          "source_name": "FireEye APT28",
          "url": "https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--536e8b4c-af1b-44da-aba7-e46068ced103",
      "subject": "ATTACK:enterprise:G1009",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--536e8b4c-af1b-44da-aba7-e46068ced103",
      "modified": "2026-07-31T18:47:55.566Z",
      "references": [
        {
          "source_name": "Checkpoint MosesStaff Nov 2021",
          "url": "https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--53d7fdab-05fb-4427-b0e0-11463e05b3f3",
      "subject": "ATTACK:enterprise:S0665",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--53d7fdab-05fb-4427-b0e0-11463e05b3f3",
      "modified": "2026-04-29T14:23:06.040Z",
      "references": [
        {
          "source_name": "Kaspersky ThreatNeedle Feb 2021",
          "url": "https://securelist.com/lazarus-threatneedle/100803/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--550bf43e-53da-467e-affd-9f44ad668508",
      "subject": "ATTACK:enterprise:S0060",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--550bf43e-53da-467e-affd-9f44ad668508",
      "modified": "2026-04-29T14:23:06.041Z",
      "references": [
        {
          "source_name": "Baumgartner Naikon 2015",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--55de5c21-4cb1-4235-89b5-df77dfc7fa90",
      "subject": "ATTACK:enterprise:S0239",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--55de5c21-4cb1-4235-89b5-df77dfc7fa90",
      "modified": "2026-04-29T14:23:06.042Z",
      "references": [
        {
          "source_name": "McAfee Bankshot",
          "url": "https://securingtomorrow.mcafee.com/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/"
        },
        {
          "source_name": "US-CERT Bankshot Dec 2017",
          "url": "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-B_WHITE.PDF"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--55f54b3e-7058-4299-98e8-ab33dd42a6ef",
      "subject": "ATTACK:enterprise:S0669",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--55f54b3e-7058-4299-98e8-ab33dd42a6ef",
      "modified": "2026-04-29T14:23:06.042Z",
      "references": [
        {
          "source_name": "MalwareBytes LazyScripter Feb 2021",
          "url": "https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5619736a-4081-4fc3-93b7-cf70d01cd094",
      "subject": "ATTACK:enterprise:S9002",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5619736a-4081-4fc3-93b7-cf70d01cd094",
      "modified": "2026-04-29T14:23:06.043Z",
      "references": [
        {
          "source_name": "Microsoft_diskpart_Feb2023",
          "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskpart"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5823e4cd-e6cb-4e62-8ed2-a0f296128d34",
      "subject": "ATTACK:enterprise:S0271",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5823e4cd-e6cb-4e62-8ed2-a0f296128d34",
      "modified": "2026-04-29T14:23:06.045Z",
      "references": [
        {
          "source_name": "US-CERT KEYMARBLE Aug 2018",
          "url": "https://www.us-cert.gov/ncas/analysis-reports/AR18-221A"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--588865e4-caec-4150-9c03-df5e28eb9c79",
      "subject": "ATTACK:enterprise:S0352",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--588865e4-caec-4150-9c03-df5e28eb9c79",
      "modified": "2026-04-29T14:23:06.046Z",
      "references": [
        {
          "source_name": "TrendMicro MacOS April 2018",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/"
        },
        {
          "source_name": "Trend Micro MacOS Backdoor November 2020",
          "url": "https://www.trendmicro.com/en_us/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html"
        },
        {
          "source_name": "20 macOS Common Tools and Techniques",
          "url": "https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--598d55da-c5f9-447c-acad-0c611f1deda0",
      "subject": "ATTACK:enterprise:S0496",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--598d55da-c5f9-447c-acad-0c611f1deda0",
      "modified": "2026-04-29T14:23:06.047Z",
      "references": [
        {
          "source_name": "Secureworks REvil September 2019",
          "url": "https://www.secureworks.com/research/revil-sodinokibi-ransomware"
        },
        {
          "source_name": "Cylance Sodinokibi July 2019",
          "url": "https://threatvector.cylance.com/en_us/home/threat-spotlight-sodinokibi-ransomware.html"
        },
        {
          "source_name": "Group IB Ransomware May 2020",
          "url": "https://www.group-ib.com/whitepapers/ransomware-uncovered.html"
        },
        {
          "source_name": "Intel 471 REvil March 2020",
          "url": "https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/"
        },
        {
          "source_name": "Kaspersky Sodin July 2019",
          "url": "https://securelist.com/sodin-ransomware/91473/"
        },
        {
          "source_name": "McAfee Sodinokibi October 2019",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"
        },
        {
          "source_name": "Secureworks GandCrab and REvil September 2019",
          "url": "https://www.secureworks.com/blog/revil-the-gandcrab-connection"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--59fe8c5d-f008-4be7-a187-39d70073914d",
      "subject": "ATTACK:enterprise:S0378",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--59fe8c5d-f008-4be7-a187-39d70073914d",
      "modified": "2026-04-29T14:23:06.048Z",
      "references": [
        {
          "source_name": "GitHub PoshC2",
          "url": "https://github.com/nettitude/PoshC2_Python"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5a415555-1367-47dd-9757-88a86430cf49",
      "subject": "ATTACK:enterprise:S0094",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5a415555-1367-47dd-9757-88a86430cf49",
      "modified": "2026-04-29T14:23:06.048Z",
      "references": [
        {
          "source_name": "Secureworks Karagany July 2019",
          "url": "https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5bd827b4-cdaf-4d50-acb8-493f32d51acb",
      "subject": "ATTACK:enterprise:S0448",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5bd827b4-cdaf-4d50-acb8-493f32d51acb",
      "modified": "2026-04-29T14:23:06.051Z",
      "references": [
        {
          "source_name": "McAfee Sharpshooter December 2018",
          "url": "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5c4e0ddb-57a1-440f-82ab-146847c99be8",
      "subject": "ATTACK:enterprise:S0157",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5c4e0ddb-57a1-440f-82ab-146847c99be8",
      "modified": "2026-04-29T14:23:06.051Z",
      "references": [
        {
          "source_name": "FireEye APT32 May 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5d2ca571-9e66-4949-b3a1-978c47398b18",
      "subject": "ATTACK:enterprise:S0021",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5d2ca571-9e66-4949-b3a1-978c47398b18",
      "modified": "2026-04-29T14:23:06.052Z",
      "references": [
        {
          "source_name": "Fidelis Turbo",
          "url": "https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2016/2016.02.29.Turbo_Campaign_Derusbi/TA_Fidelis_Turbo_1602_0.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5dd257c0-c2cb-422a-9991-93ff667c5ad6",
      "subject": "ATTACK:enterprise:S0181",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5dd257c0-c2cb-422a-9991-93ff667c5ad6",
      "modified": "2026-04-29T14:23:06.053Z",
      "references": [
        {
          "source_name": "US-CERT FALLCHILL Nov 2017",
          "url": "https://www.us-cert.gov/ncas/alerts/TA17-318A"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5e967f56-9186-43d5-b748-4ee383df4174",
      "subject": "ATTACK:enterprise:S0514",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5e967f56-9186-43d5-b748-4ee383df4174",
      "modified": "2026-04-29T14:23:06.054Z",
      "references": [
        {
          "source_name": "PWC WellMess July 2020",
          "url": "https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html"
        },
        {
          "source_name": "CISA WellMess July 2020",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198b"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5eb5ee0e-d186-40d3-a433-9562f85fdf6b",
      "subject": "ATTACK:enterprise:S0015",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5eb5ee0e-d186-40d3-a433-9562f85fdf6b",
      "modified": "2026-04-29T14:23:06.054Z",
      "references": [
        {
          "source_name": "Trend Micro IXESHE 2012",
          "url": "https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5f179b5c-497f-42da-bc32-360b6113122b",
      "subject": "ATTACK:enterprise:S0350",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5f179b5c-497f-42da-bc32-360b6113122b",
      "modified": "2026-04-29T14:23:06.055Z",
      "references": [
        {
          "source_name": "McAfee Night Dragon",
          "url": "https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5faa7f83-062b-4821-ad9b-b731a41c06d9",
      "subject": "ATTACK:enterprise:S0382",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5faa7f83-062b-4821-ad9b-b731a41c06d9",
      "modified": "2026-04-29T14:23:06.055Z",
      "references": [
        {
          "source_name": "Proofpoint TA505 Jan 2019",
          "url": "https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5fdd0fba-8d1d-411a-b47b-3e5aae512892",
      "subject": "ATTACK:enterprise:S0456",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5fdd0fba-8d1d-411a-b47b-3e5aae512892",
      "modified": "2026-04-29T14:23:06.055Z",
      "references": [
        {
          "source_name": "CheckPoint Naikon May 2020",
          "url": "https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6216dadc-095e-4550-bc01-79c79fe614ba",
      "subject": "ATTACK:enterprise:S0251",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6216dadc-095e-4550-bc01-79c79fe614ba",
      "modified": "2026-04-29T14:23:06.058Z",
      "references": [
        {
          "source_name": "Accenture SNAKEMACKEREL Nov 2018",
          "url": "https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"
        },
        {
          "source_name": "CISA Zebrocy Oct 2020",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303b"
        },
        {
          "source_name": "ESET Zebrocy May 2019",
          "url": "https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/"
        },
        {
          "source_name": "ESET Zebrocy Nov 2018",
          "url": "https://www.welivesecurity.com/2018/11/20/sednit-whats-going-zebrocy/"
        },
        {
          "source_name": "Unit42 Cannon Nov 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"
        },
        {
          "source_name": "Unit42 Sofacy Dec 2018",
          "url": "https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/"
        },
        {
          "source_name": "Palo Alto Sofacy 06-2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--62442f37-7a0e-4945-b498-2d02306e53c7",
      "subject": "ATTACK:enterprise:S0334",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--62442f37-7a0e-4945-b498-2d02306e53c7",
      "modified": "2026-04-29T14:23:06.059Z",
      "references": [
        {
          "source_name": "TrendMicro DarkComet Sept 2014",
          "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/DARKCOMET"
        },
        {
          "source_name": "Malwarebytes DarkComet March 2018",
          "url": "https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--634d3199-9979-4df1-8fbe-5fc355726602",
      "subject": "ATTACK:enterprise:S0642",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--634d3199-9979-4df1-8fbe-5fc355726602",
      "modified": "2026-06-13T12:04:40.994Z",
      "references": [
        {
          "source_name": "Accenture MUDCARP March 2019",
          "url": "https://web.archive.org/web/20210722005437/https://www.accenture.com/_acnmedia/PDF-96/Accenture-Security-MUDCARP.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--63dec489-68ad-46c2-9972-55394ad7601a",
      "subject": "ATTACK:enterprise:G0126",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--63dec489-68ad-46c2-9972-55394ad7601a",
      "modified": "2026-07-31T18:47:56.555Z",
      "references": [
        {
          "source_name": "Malwarebytes Higaisa 2020",
          "url": "https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"
        },
        {
          "source_name": "PTSecurity Higaisa 2020",
          "url": "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-and-new-year-greetings-the-higaisa-group/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--65f3f758-ac69-4f7a-b56e-6bbafddae619",
      "subject": "ATTACK:enterprise:S1199",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--65f3f758-ac69-4f7a-b56e-6bbafddae619",
      "modified": "2026-04-29T14:23:06.064Z",
      "references": [
        {
          "source_name": "Palo Alto Lockbit 2.0 JUN 2022",
          "url": "https://unit42.paloaltonetworks.com/lockbit-2-ransomware/"
        },
        {
          "source_name": "FBI Lockbit 2.0 FEB 2022",
          "url": "https://www.ic3.gov/CSA/2022/220204.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6600e60d-666f-4d7a-8e30-d4361f892a9f",
      "subject": "ATTACK:enterprise:G1012",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6600e60d-666f-4d7a-8e30-d4361f892a9f",
      "modified": "2026-07-31T18:47:51.280Z",
      "references": [
        {
          "source_name": "Symantec Tortoiseshell 2019",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--66b026b6-af1e-47a6-9c3d-b853e2130b68",
      "subject": "ATTACK:enterprise:S0091",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--66b026b6-af1e-47a6-9c3d-b853e2130b68",
      "modified": "2026-04-29T14:23:06.065Z",
      "references": [
        {
          "source_name": "Kaspersky Turla Aug 2014",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08080105/KL_Epic_Turla_Technical_Appendix_20140806.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--66bd7bd5-b53f-4791-a130-7278541f3fa7",
      "subject": "ATTACK:enterprise:S0417",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--66bd7bd5-b53f-4791-a130-7278541f3fa7",
      "modified": "2026-04-29T14:23:06.065Z",
      "references": [
        {
          "source_name": "SecureList Griffon May 2019",
          "url": "https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--670b59d4-25c6-4171-a36b-efb27155cc95",
      "subject": "ATTACK:enterprise:S9001",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--670b59d4-25c6-4171-a36b-efb27155cc95",
      "modified": "2026-04-29T14:23:06.065Z",
      "references": [
        {
          "source_name": "AhnLab_SystemBC_Apr2022",
          "url": "https://asec.ahnlab.com/en/33600/"
        },
        {
          "source_name": "SophosGnGal_SystemBC_Dec2020",
          "url": "https://news.sophos.com/en-us/2020/12/16/systembc/"
        },
        {
          "source_name": "HarmonProofpoint_SystemBC_Aug2019",
          "url": "https://www.proofpoint.com/us/threat-insight/post/systembc-christmas-july-socks5-malware-and-exploit-kits"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6765828a-168f-4dd7-8c1b-00f7d98daef5",
      "subject": "ATTACK:enterprise:S0379",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6765828a-168f-4dd7-8c1b-00f7d98daef5",
      "modified": "2026-04-29T14:23:06.066Z",
      "references": [
        {
          "source_name": "Cylance Shaheen Nov 2018",
          "url": "https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--67ffaecc-e47d-47a1-93fd-82d21018ad8b",
      "subject": "ATTACK:enterprise:S0214",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--67ffaecc-e47d-47a1-93fd-82d21018ad8b",
      "modified": "2026-04-29T14:23:06.066Z",
      "references": [
        {
          "source_name": "FireEye APT37 Feb 2018",
          "url": "https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--68fc9cf1-d191-4ebd-af14-004519ab76d7",
      "subject": "ATTACK:enterprise:S0531",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--68fc9cf1-d191-4ebd-af14-004519ab76d7",
      "modified": "2026-04-29T14:23:06.068Z",
      "references": [
        {
          "source_name": "ESET Grandoreiro April 2020",
          "url": "https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--695e51bb-e410-40b1-b8fc-d40734796729",
      "subject": "ATTACK:enterprise:S0627",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--695e51bb-e410-40b1-b8fc-d40734796729",
      "modified": "2026-04-29T14:23:06.068Z",
      "references": [
        {
          "source_name": "Securelist APT10 March 2021",
          "url": "https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--698c4736-5a86-4d72-9855-4bdee856d6de",
      "subject": "ATTACK:enterprise:S1155",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--698c4736-5a86-4d72-9855-4bdee856d6de",
      "modified": "2026-04-29T14:23:06.069Z",
      "references": [
        {
          "source_name": "Github Covenant",
          "url": "https://github.com/cobbr/Covenant"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6a008820-b742-4ec0-ad56-7494ca911da7",
      "subject": "ATTACK:enterprise:S0017",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6a008820-b742-4ec0-ad56-7494ca911da7",
      "modified": "2026-04-29T14:23:06.069Z",
      "references": [
        {
          "source_name": "Mandiant APT1",
          "url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6a289837-2455-471b-81e4-b677550ab77b",
      "subject": "ATTACK:enterprise:S0264",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6a289837-2455-471b-81e4-b677550ab77b",
      "modified": "2026-04-29T14:23:06.070Z",
      "references": [
        {
          "source_name": "Unit 42 OilRig Sept 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/09/unit42-oilrig-targets-middle-eastern-government-adds-evasion-techniques-oopsie/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6b7ef377-d7c3-47ca-9707-03d4ccaf5adb",
      "subject": "ATTACK:enterprise:S0693",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6b7ef377-d7c3-47ca-9707-03d4ccaf5adb",
      "modified": "2026-04-29T14:23:06.071Z",
      "references": [
        {
          "source_name": "Cisco CaddyWiper March 2022",
          "url": "https://blog.talosintelligence.com/2022/03/threat-advisory-caddywiper.html"
        },
        {
          "source_name": "Malwarebytes IssacWiper CaddyWiper March 2022 ",
          "url": "https://blog.malwarebytes.com/threat-intelligence/2022/03/double-header-isaacwiper-and-caddywiper/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6d279a48-f529-4f5d-be3a-a53529055323",
      "subject": "ATTACK:enterprise:G1026",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6d279a48-f529-4f5d-be3a-a53529055323",
      "modified": "2026-07-31T18:48:16.016Z",
      "references": [
        {
          "source_name": "SCILabs Malteiro 2021",
          "url": "https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6d965ba4-b5f3-40ce-9153-b328e4b54429",
      "subject": "ATTACK:enterprise:S1185",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6d965ba4-b5f3-40ce-9153-b328e4b54429",
      "modified": "2026-04-29T14:23:06.074Z",
      "references": [
        {
          "source_name": "Huntress LightSpy macOS 2024",
          "url": "https://www.huntress.com/blog/lightspy-malware-variant-targeting-macos"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6ddcaca1-4fd9-4a9f-a4fe-2e5824958f8d",
      "subject": "ATTACK:enterprise:S9039",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6ddcaca1-4fd9-4a9f-a4fe-2e5824958f8d",
      "modified": "2026-04-29T14:23:06.075Z",
      "references": [
        {
          "source_name": "CERT Polska",
          "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6deb7ae9-9e35-47cb-8db2-e708ad9543b6",
      "subject": "ATTACK:enterprise:S1086",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6deb7ae9-9e35-47cb-8db2-e708ad9543b6",
      "modified": "2026-04-29T14:23:06.075Z",
      "references": [
        {
          "source_name": "Morphisec Snip3 May 2021",
          "url": "https://blog.morphisec.com/revealing-the-snip3-crypter-a-highly-evasive-rat-loader"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6e9c79b0-9b63-4785-be48-033ab5f55a18",
      "subject": "ATTACK:enterprise:S0487",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6e9c79b0-9b63-4785-be48-033ab5f55a18",
      "modified": "2026-04-29T14:23:06.076Z",
      "references": [
        {
          "source_name": "ESET ForSSHe December 2018",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6eb8329a-b0ca-4751-a014-473af182b177",
      "subject": "ATTACK:enterprise:S1107",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6eb8329a-b0ca-4751-a014-473af182b177",
      "modified": "2026-04-29T14:23:06.076Z",
      "references": [
        {
          "source_name": "NKAbuse SL",
          "url": "https://securelist.com/unveiling-nkabuse/111512/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--702ed555-03e2-4660-82d8-e85d46cbec02",
      "subject": "ATTACK:enterprise:S0439",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--702ed555-03e2-4660-82d8-e85d46cbec02",
      "modified": "2026-04-29T14:23:06.078Z",
      "references": [
        {
          "source_name": "ESET Okrum July 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--708161ff-7d5d-417a-83ad-d68ec6d4d01a",
      "subject": "ATTACK:enterprise:S1100",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--708161ff-7d5d-417a-83ad-d68ec6d4d01a",
      "modified": "2026-04-29T14:23:06.079Z",
      "references": [
        {
          "source_name": "Kaspersky ToddyCat June 2022",
          "url": "https://securelist.com/toddycat/106799/"
        },
        {
          "source_name": "Kaspersky ToddyCat Check Logs October 2023",
          "url": "https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--709d0737-e2ac-4ce3-9772-0dbc06f9667e",
      "subject": "ATTACK:enterprise:S0468",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--709d0737-e2ac-4ce3-9772-0dbc06f9667e",
      "modified": "2026-04-29T14:23:06.079Z",
      "references": [
        {
          "source_name": "Trend Micro Skidmap",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--70c29cd1-53a2-48a6-8f94-515e7812013b",
      "subject": "ATTACK:enterprise:S0584",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--70c29cd1-53a2-48a6-8f94-515e7812013b",
      "modified": "2026-04-29T14:23:06.079Z",
      "references": [
        {
          "source_name": "CISA AppleJeus Feb 2021",
          "url": "https://us-cert.cisa.gov/ncas/alerts/aa21-048a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--70e81cc7-9dd6-4349-b7ab-212a46591cff",
      "subject": "ATTACK:enterprise:S0205",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--70e81cc7-9dd6-4349-b7ab-212a46591cff",
      "modified": "2026-04-29T14:23:06.079Z",
      "references": [
        {
          "source_name": "Symantec Naid June 2012",
          "url": "https://www.symantec.com/security_response/writeup.jsp?docid=2012-061518-4639-99"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--70f5df58-30d0-4866-bfee-64dcf10edca9",
      "subject": "ATTACK:enterprise:S0395",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--70f5df58-30d0-4866-bfee-64dcf10edca9",
      "modified": "2026-04-29T14:23:06.079Z",
      "references": [
        {
          "source_name": "ESET LightNeuron May 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--713bde00-ab9d-4eaf-99b2-4d9b2b21df4c",
      "subject": "ATTACK:enterprise:S1145",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--713bde00-ab9d-4eaf-99b2-4d9b2b21df4c",
      "modified": "2026-04-29T14:23:06.080Z",
      "references": [
        {
          "source_name": "Zscaler Pikabot 2023",
          "url": "https://www.zscaler.com/blogs/security-research/technical-analysis-pikabot"
        },
        {
          "source_name": "Elastic Pikabot 2024",
          "url": "https://www.elastic.co/security-labs/pikabot-i-choose-you"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--71935bd0-44ca-4d2b-850d-707bc4db91d5",
      "subject": "ATTACK:enterprise:S1048",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--71935bd0-44ca-4d2b-850d-707bc4db91d5",
      "modified": "2026-04-29T14:23:06.080Z",
      "references": [
        {
          "source_name": "SentinelLabs reversing run-only applescripts 2021",
          "url": "https://www.sentinelone.com/labs/fade-dead-adventures-in-reversing-malicious-run-only-applescripts/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--72fe5021-bace-41e4-9cc6-73af415225ac",
      "subject": "ATTACK:enterprise:S0149",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--72fe5021-bace-41e4-9cc6-73af415225ac",
      "modified": "2026-04-29T14:23:06.082Z",
      "references": [
        {
          "source_name": "Palo Alto MoonWind March 2017",
          "url": "http://researchcenter.paloaltonetworks.com/2017/03/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--73fe447a-8d70-433f-be9a-5af74934a662",
      "subject": "ATTACK:enterprise:S0155",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--73fe447a-8d70-433f-be9a-5af74934a662",
      "modified": "2026-04-29T14:23:06.084Z",
      "references": [
        {
          "source_name": "FireEye APT32 May 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--745106bb-3641-488e-ae1c-547cd6ea9b7a",
      "subject": "ATTACK:enterprise:S0106",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--745106bb-3641-488e-ae1c-547cd6ea9b7a",
      "modified": "2026-04-29T14:23:06.084Z",
      "references": [
        {
          "source_name": "TechNet Dir",
          "url": "https://technet.microsoft.com/en-us/library/cc755121.aspx"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7507eb37-407e-4428-b29f-da0bda3f7970",
      "subject": "ATTACK:enterprise:S0165",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7507eb37-407e-4428-b29f-da0bda3f7970",
      "modified": "2026-04-29T14:23:06.085Z",
      "references": [
        {
          "source_name": "Symantec Buckeye",
          "url": "https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--75a1f636-76d3-4029-ae40-0a7a3b8d7eba",
      "subject": "ATTACK:enterprise:S0340",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--75a1f636-76d3-4029-ae40-0a7a3b8d7eba",
      "modified": "2026-04-29T14:23:06.086Z",
      "references": [
        {
          "source_name": "Securelist Octopus Oct 2018",
          "url": "https://securelist.com/octopus-infested-seas-of-central-asia/88200/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--75e01f6a-9f45-4db2-a79d-a21453b6d83f",
      "subject": "ATTACK:enterprise:S0516",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--75e01f6a-9f45-4db2-a79d-a21453b6d83f",
      "modified": "2026-04-29T14:23:06.086Z",
      "references": [
        {
          "source_name": "CISA SoreFang July 2016",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7727f1e9-4914-4512-a319-3e5758c47602",
      "subject": "ATTACK:enterprise:S0585",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7727f1e9-4914-4512-a319-3e5758c47602",
      "modified": "2026-04-29T14:23:06.088Z",
      "references": [
        {
          "source_name": "Unit 42 KerrDown February 2019",
          "url": "https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--773efcb6-760f-496f-92e9-2387d04d2c53",
      "subject": "ATTACK:enterprise:S0635",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--773efcb6-760f-496f-92e9-2387d04d2c53",
      "modified": "2026-04-29T14:23:06.088Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Toolset May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--778df1e8-d307-496d-861a-45052ee2e019",
      "subject": "ATTACK:enterprise:S1152",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--778df1e8-d307-496d-861a-45052ee2e019",
      "modified": "2026-04-29T14:23:06.089Z",
      "references": [
        {
          "source_name": "PWC Yellow Liderc 2023",
          "url": "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--77d954c5-de84-4f4b-98b6-5ad35603ae7a",
      "subject": "ATTACK:enterprise:S0428",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--77d954c5-de84-4f4b-98b6-5ad35603ae7a",
      "modified": "2026-04-29T14:23:06.089Z",
      "references": [
        {
          "source_name": "Talos PoetRAT April 2020",
          "url": "https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--788ca56e-1194-4c5f-a12b-72678390f1ef",
      "subject": "ATTACK:enterprise:S0142",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--788ca56e-1194-4c5f-a12b-72678390f1ef",
      "modified": "2026-04-29T14:23:06.090Z",
      "references": [
        {
          "source_name": "Cylance Shell Crew Feb 2017",
          "url": "https://www.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7920e962-00d7-4eb0-a94d-ed1ca196cd50",
      "subject": "ATTACK:enterprise:S0622",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7920e962-00d7-4eb0-a94d-ed1ca196cd50",
      "modified": "2026-04-29T14:23:06.091Z",
      "references": [
        {
          "source_name": "Malwarebytes Kimsuky June 2021",
          "url": "https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--792376f7-db54-4ae9-b50a-38b67ed96053",
      "subject": "ATTACK:enterprise:S0644",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--792376f7-db54-4ae9-b50a-38b67ed96053",
      "modified": "2026-04-29T14:23:06.091Z",
      "references": [
        {
          "source_name": "Talos Oblique RAT March 2021",
          "url": "https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7a8a36ee-66f8-42ca-abeb-29e6223b91ee",
      "subject": "ATTACK:enterprise:S0272",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7a8a36ee-66f8-42ca-abeb-29e6223b91ee",
      "modified": "2026-04-29T14:23:06.093Z",
      "references": [
        {
          "source_name": "TrendMicro Patchwork Dec 2017",
          "url": "https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7ac890f4-b4d0-4899-be19-bcbda48c3736",
      "subject": "ATTACK:enterprise:S0652",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7ac890f4-b4d0-4899-be19-bcbda48c3736",
      "modified": "2026-04-29T14:23:06.093Z",
      "references": [
        {
          "source_name": "Kaspersky Ferocious Kitten Jun 2021",
          "url": "https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7adaf2f3-52f2-40aa-b1ae-2fd2f05d9d56",
      "subject": "ATTACK:enterprise:S0113",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7adaf2f3-52f2-40aa-b1ae-2fd2f05d9d56",
      "modified": "2026-04-29T14:23:06.093Z",
      "references": [
        {
          "source_name": "ESET Operation Groundbait",
          "url": "http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7aeee346-4272-45c4-b351-1cf4ac98a15d",
      "subject": "ATTACK:enterprise:S0376",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7aeee346-4272-45c4-b351-1cf4ac98a15d",
      "modified": "2026-04-29T14:23:06.094Z",
      "references": [
        {
          "source_name": "US-CERT HOPLIGHT Apr 2019",
          "url": "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7b29c94f-1834-42ac-933c-ae6cd125e87a",
      "subject": "ATTACK:enterprise:S0048",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7b29c94f-1834-42ac-933c-ae6cd125e87a",
      "modified": "2026-04-29T14:23:06.094Z",
      "references": [
        {
          "source_name": "F-Secure The Dukes",
          "url": "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7b4e1a93-99ca-444d-bfc4-bc589a9a25a9",
      "subject": "ATTACK:enterprise:S0476",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7b4e1a93-99ca-444d-bfc4-bc589a9a25a9",
      "modified": "2026-04-29T14:23:06.094Z",
      "references": [
        {
          "source_name": "SentinelOne Valak June 2020",
          "url": "https://assets.sentinelone.com/labs/sentinel-one-valak-i"
        },
        {
          "source_name": "Cybereason Valak May 2020",
          "url": "https://www.cybereason.com/blog/valak-more-than-meets-the-eye"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7bb2d594-36dc-458d-9f9b-8a3df42fac67",
      "subject": "ATTACK:enterprise:S0230",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7bb2d594-36dc-458d-9f9b-8a3df42fac67",
      "modified": "2026-04-29T14:23:06.095Z",
      "references": [
        {
          "source_name": "Proofpoint ZeroT Feb 2017",
          "url": "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7e2a1dfa-1ccd-4700-a4a5-3b98590ae710",
      "subject": "ATTACK:enterprise:S0192",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7e2a1dfa-1ccd-4700-a4a5-3b98590ae710",
      "modified": "2026-04-29T14:23:06.098Z",
      "references": [
        {
          "source_name": "GitHub Pupy",
          "url": "https://github.com/n1nj4sec/pupy"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7e618069-63cd-4739-bbaf-8582743906f8",
      "subject": "ATTACK:enterprise:S1210",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7e618069-63cd-4739-bbaf-8582743906f8",
      "modified": "2026-04-29T14:23:06.098Z",
      "references": [
        {
          "source_name": "Cisco LotusBlossom 2025",
          "url": "https://blog.talosintelligence.com/lotus-blossom-espionage-group/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7f4685df-335f-4c8a-900a-4018e52d92c3",
      "subject": "ATTACK:enterprise:S1138",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7f4685df-335f-4c8a-900a-4018e52d92c3",
      "modified": "2026-04-29T14:23:06.099Z",
      "references": [
        {
          "source_name": "Sophos Gootloader",
          "url": "https://news.sophos.com/en-us/2021/03/01/gootloader-expands-its-payload-delivery-options/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7f659555-cfc4-420f-8548-3a89aa1da8c9",
      "subject": "ATTACK:enterprise:S0543",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7f659555-cfc4-420f-8548-3a89aa1da8c9",
      "modified": "2026-04-29T14:23:06.100Z",
      "references": [
        {
          "source_name": "Unit42 Molerat Mar 2020",
          "url": "https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7fbb56bf-cadd-4663-8067-f233d4c9c751",
      "subject": "ATTACK:enterprise:S0085",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7fbb56bf-cadd-4663-8067-f233d4c9c751",
      "modified": "2026-04-29T14:23:06.100Z",
      "references": [
        {
          "source_name": "Cylance Dust Storm",
          "url": "https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--804cf89b-1070-44e1-a479-a07558ae3128",
      "subject": "ATTACK:enterprise:S1180",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--804cf89b-1070-44e1-a479-a07558ae3128",
      "modified": "2026-04-29T14:23:06.101Z",
      "references": [
        {
          "source_name": "Trustwave BlackByte 2021",
          "url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--80c87037-4997-449c-8a92-1183103dda8d",
      "subject": "ATTACK:enterprise:S1222",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--80c87037-4997-449c-8a92-1183103dda8d",
      "modified": "2026-04-29T14:23:06.101Z",
      "references": [
        {
          "source_name": "Google Cloud Mandiant UNC3886 2024",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--810630f3-01fb-416d-992c-3f5a0390d962",
      "subject": "ATTACK:enterprise:S0601",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--810630f3-01fb-416d-992c-3f5a0390d962",
      "modified": "2026-04-29T14:23:06.102Z",
      "references": [
        {
          "source_name": "Unit 42 Hildegard Malware",
          "url": "https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8282f068-c2d3-4673-b683-7fbd3a59f38e",
      "subject": "ATTACK:enterprise:S0013",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8282f068-c2d3-4673-b683-7fbd3a59f38e",
      "modified": "2026-04-29T14:23:06.104Z",
      "references": [
        {
          "source_name": "Eset PlugX Korplug Mustang Panda March 2022",
          "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--834bbbc7-33b7-41e4-9bc8-98401a5a0e36",
      "subject": "ATTACK:enterprise:S0410",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--834bbbc7-33b7-41e4-9bc8-98401a5a0e36",
      "modified": "2026-04-29T14:23:06.105Z",
      "references": [
        {
          "source_name": "Fysbis Palo Alto Analysis",
          "url": "https://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--83b6ef41-24e7-4ace-bb6e-29faf8ac5ab4",
      "subject": "ATTACK:enterprise:S9020",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--83b6ef41-24e7-4ace-bb6e-29faf8ac5ab4",
      "modified": "2026-04-29T14:23:06.105Z",
      "references": [
        {
          "source_name": "Kaspersky LODEINFO Part II OCT 2022",
          "url": "https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-ii/107745/"
        },
        {
          "source_name": "ITOCHU LODEINFO JAN 2024",
          "url": "https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--854fd292-dbaf-4112-96b2-824364c82a4c",
      "subject": "ATTACK:enterprise:S0355",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--854fd292-dbaf-4112-96b2-824364c82a4c",
      "modified": "2026-04-29T14:23:06.107Z",
      "references": [
        {
          "source_name": "Unit 42 Nokki Oct 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/10/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--855bcd64-ef37-4197-8d3e-2c147d42d774",
      "subject": "ATTACK:enterprise:S0461",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--855bcd64-ef37-4197-8d3e-2c147d42d774",
      "modified": "2026-04-29T14:23:06.107Z",
      "references": [
        {
          "source_name": "Korean FSI TA505 2020",
          "url": "https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="
        },
        {
          "source_name": "Proofpoint TA505 October 2019",
          "url": "https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--85b17ee3-cd16-4f7d-bfaa-23e756f344d5",
      "subject": "ATTACK:enterprise:S0556",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--85b17ee3-cd16-4f7d-bfaa-23e756f344d5",
      "modified": "2026-04-29T14:23:06.108Z",
      "references": [
        {
          "source_name": "Check Point Pay2Key November 2020",
          "url": "https://research.checkpoint.com/2020/ransomware-alert-pay2key/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--85c11944-e1a0-49e0-a0ef-03e9df1b2adb",
      "subject": "ATTACK:enterprise:S1167",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--85c11944-e1a0-49e0-a0ef-03e9df1b2adb",
      "modified": "2026-04-29T14:23:06.108Z",
      "references": [
        {
          "source_name": "SentinelOne AcidPour 2024",
          "url": "https://www.sentinelone.com/labs/acidpour-new-embedded-wiper-variant-of-acidrain-appears-in-ukraine/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--85c97a8c-75ff-4469-bcc4-28c64a928390",
      "subject": "ATTACK:enterprise:G1039",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--85c97a8c-75ff-4469-bcc4-28c64a928390",
      "modified": "2026-07-31T18:48:06.279Z",
      "references": [
        {
          "source_name": "group-ib_redcurl1",
          "url": "https://www.group-ib.com/resources/research-hub/red-curl/"
        },
        {
          "source_name": "group-ib_redcurl2",
          "url": "https://www.group-ib.com/resources/research-hub/red-curl-2/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--86b8a22d-66c3-4b54-82fd-662455d0e2c5",
      "subject": "ATTACK:enterprise:S0666",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--86b8a22d-66c3-4b54-82fd-662455d0e2c5",
      "modified": "2026-04-29T14:23:06.109Z",
      "references": [
        {
          "source_name": "ESET Gelsemium June 2021",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--870cebf9-bf09-451c-a894-cad79936bb67",
      "subject": "ATTACK:enterprise:G0082",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--870cebf9-bf09-451c-a894-cad79936bb67",
      "modified": "2026-09-30T18:29:45.163Z",
      "references": [
        {
          "source_name": "CISA AA20-239A BeagleBoyz August 2020",
          "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-239a"
        },
        {
          "source_name": "Microsoft Axios Compromise APR 2026",
          "url": "https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/"
        },
        {
          "source_name": "Microsoft Sapphire Sleet APR 2026",
          "url": "https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"
        },
        {
          "source_name": "MIcrosoft Mastra npm Compromise JUN 2026",
          "url": "https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--87406432-7190-4606-980b-441819713d1d",
      "subject": "ATTACK:enterprise:S0215",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--87406432-7190-4606-980b-441819713d1d",
      "modified": "2026-04-29T14:23:06.110Z",
      "references": [
        {
          "source_name": "FireEye APT37 Feb 2018",
          "url": "https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8763c8dd-cd68-4402-be43-4dbd96c83c2d",
      "subject": "ATTACK:enterprise:S0475",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8763c8dd-cd68-4402-be43-4dbd96c83c2d",
      "modified": "2026-04-29T14:23:06.110Z",
      "references": [
        {
          "source_name": "Unit 42 BackConfig May 2020",
          "url": "https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--87a01c6d-b7a3-481f-82a9-5dee8c6f91db",
      "subject": "ATTACK:enterprise:S0697",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--87a01c6d-b7a3-481f-82a9-5dee8c6f91db",
      "modified": "2026-04-29T14:23:06.110Z",
      "references": [
        {
          "source_name": "Qualys Hermetic Wiper March 2022",
          "url": "https://blog.qualys.com/vulnerabilities-threat-research/2022/03/01/ukrainian-targets-hit-by-hermeticwiper-new-datawiper-malware"
        },
        {
          "source_name": "ESET Hermetic Wizard March 2022",
          "url": "https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine"
        },
        {
          "source_name": "SentinelOne Hermetic Wiper February 2022",
          "url": "https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack"
        },
        {
          "source_name": "Crowdstrike DriveSlayer February 2022",
          "url": "https://www.crowdstrike.com/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--87e080cf-b8c0-4679-bcfb-ff77ab7698f3",
      "subject": "ATTACK:enterprise:S0083",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--87e080cf-b8c0-4679-bcfb-ff77ab7698f3",
      "modified": "2026-04-29T14:23:06.111Z",
      "references": [
        {
          "source_name": "Cylance Dust Storm",
          "url": "https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--87ef3b62-acb4-4cd2-86ec-36683a57bedf",
      "subject": "ATTACK:enterprise:S1078",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--87ef3b62-acb4-4cd2-86ec-36683a57bedf",
      "modified": "2026-04-29T14:23:06.111Z",
      "references": [
        {
          "source_name": "RotaJakiro 2021 netlab360 analysis",
          "url": "https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--88221b55-8e8a-4a38-b477-a45907083011",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--88221b55-8e8a-4a38-b477-a45907083011",
      "modified": "2026-07-31T18:47:52.804Z",
      "references": [
        {
          "source_name": "Avira Mustang Panda January 2020",
          "url": "https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8840d33c-de12-45d5-a0e3-cdfddf789794",
      "subject": "ATTACK:enterprise:S0245",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8840d33c-de12-45d5-a0e3-cdfddf789794",
      "modified": "2026-04-29T14:23:06.111Z",
      "references": [
        {
          "source_name": "US-CERT BADCALL",
          "url": "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-G.PDF"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--88d53468-4ab8-455e-bd16-dc52ef9a3d96",
      "subject": "ATTACK:enterprise:S0346",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--88d53468-4ab8-455e-bd16-dc52ef9a3d96",
      "modified": "2026-04-29T14:23:06.112Z",
      "references": [
        {
          "source_name": "McAfee Oceansalt Oct 2018",
          "url": "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-oceansalt.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--89d37095-2f31-42e9-b8f7-3abdd76d5f57",
      "subject": "ATTACK:enterprise:S0663",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--89d37095-2f31-42e9-b8f7-3abdd76d5f57",
      "modified": "2026-04-29T14:23:06.113Z",
      "references": [
        {
          "source_name": "Lunghi Iron Tiger Linux",
          "url": "https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"
        },
        {
          "source_name": "Trend Micro Iron Tiger April 2021",
          "url": "https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8a00aa55-b7b2-4df5-902b-d01bfdf89089",
      "subject": "ATTACK:enterprise:S0247",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8a00aa55-b7b2-4df5-902b-d01bfdf89089",
      "modified": "2026-04-29T14:23:06.113Z",
      "references": [
        {
          "source_name": "Talos NavRAT May 2018",
          "url": "https://blog.talosintelligence.com/2018/05/navrat.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8a8afe63-a754-40e3-98af-cfc3f0aa6ef5",
      "subject": "ATTACK:enterprise:S0455",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8a8afe63-a754-40e3-98af-cfc3f0aa6ef5",
      "modified": "2026-04-29T14:23:06.114Z",
      "references": [
        {
          "source_name": "FireEye Metamorfo Apr 2018",
          "url": "https://www.fireeye.com/blog/threat-research/2018/04/metamorfo-campaign-targeting-brazilian-users.html"
        },
        {
          "source_name": "Fortinet Metamorfo Feb 2020",
          "url": "https://www.fortinet.com/blog/threat-research/another-metamorfo-variant-targeting-customers-of-financial-institutions"
        },
        {
          "source_name": "ESET Casbaneiro Oct 2019",
          "url": "https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8aec9b0d-392b-438f-9953-82406e940a44",
      "subject": "ATTACK:enterprise:S9023",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8aec9b0d-392b-438f-9953-82406e940a44",
      "modified": "2026-04-29T14:23:06.114Z",
      "references": [
        {
          "source_name": "ESET HiddenFace 2024",
          "url": "https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_2_8_Breitenbacher_en.pdf"
        },
        {
          "source_name": "JPCERT MirrorFace JUL 2024",
          "url": "https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"
        },
        {
          "source_name": "Trend Micro Earth Kasha NOV 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8b4c7113-2f11-44a7-863d-1ff49ae64215",
      "subject": "ATTACK:enterprise:S0660",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8b4c7113-2f11-44a7-863d-1ff49ae64215",
      "modified": "2026-04-29T14:23:06.115Z",
      "references": [
        {
          "source_name": "Trend Micro DRBControl February 2020",
          "url": "https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"
        },
        {
          "source_name": "Talent-Jump Clambling February 2020",
          "url": "https://www.talent-jump.com/article/2020/02/17/CLAMBLING-A-New-Backdoor-Base-On-Dropbox-en/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8b6f5eed-f21e-41db-a858-32bb0d12e593",
      "subject": "ATTACK:enterprise:C0006",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8b6f5eed-f21e-41db-a858-32bb0d12e593",
      "modified": "2026-07-31T18:47:20.776Z",
      "references": [
        {
          "source_name": "McAfee Honeybee",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8bbf259b-029b-48fa-859b-5dbbbcd98b53",
      "subject": "ATTACK:enterprise:S0265",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8bbf259b-029b-48fa-859b-5dbbbcd98b53",
      "modified": "2026-04-29T14:23:06.116Z",
      "references": [
        {
          "source_name": "Unit 42 Kazuar May 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8cc363e3-8239-4eb9-b149-cdacedd2879c",
      "subject": "ATTACK:enterprise:S9063",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8cc363e3-8239-4eb9-b149-cdacedd2879c",
      "modified": "2026-10-01T18:23:25.136Z",
      "references": [
        {
          "source_name": "Mandiant_UNC1549_Nov2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8dd83463-b0cb-46e9-a01a-b22c6780066f",
      "subject": "ATTACK:enterprise:S0453",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8dd83463-b0cb-46e9-a01a-b22c6780066f",
      "modified": "2026-04-29T14:23:06.119Z",
      "references": [
        {
          "source_name": "Malwarebytes Pony April 2016",
          "url": "https://blog.malwarebytes.com/threat-analysis/2015/11/no-money-but-pony-from-a-mail-to-a-trojan-horse/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8e44e98f-b8aa-46f2-83dd-ada429e9f4e9",
      "subject": "ATTACK:enterprise:S9046",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8e44e98f-b8aa-46f2-83dd-ada429e9f4e9",
      "modified": "2026-10-08T22:18:58.800Z",
      "references": [
        {
          "source_name": "Claroty-IOCONTROL",
          "url": "https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol"
        },
        {
          "source_name": "Armis-IOCONTROL",
          "url": "https://www.armis.com/blog/iocontrol-malware-whats-new-whats-not/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8ed87a9f-db10-4e2c-aa3d-cf1e92797d1f",
      "subject": "ATTACK:enterprise:S1166",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8ed87a9f-db10-4e2c-aa3d-cf1e92797d1f",
      "modified": "2026-04-29T14:23:06.120Z",
      "references": [
        {
          "source_name": "ESET OilRig Campaigns Sep 2023",
          "url": "https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8ee927ba-1638-46c5-8510-a77d584e42d0",
      "subject": "ATTACK:enterprise:G1055",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8ee927ba-1638-46c5-8510-a77d584e42d0",
      "modified": "2026-07-31T18:48:25.809Z",
      "references": [
        {
          "source_name": "FBI IC3 Flash VOID MANTICORE Handala Hack March 2026",
          "url": "https://www.ic3.gov/CSA/2026/260320.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8fa843c8-bd61-48a2-8c65-587f6d96e238",
      "subject": "ATTACK:enterprise:G0046",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8fa843c8-bd61-48a2-8c65-587f6d96e238",
      "modified": "2026-07-31T20:48:32.029Z",
      "references": [
        {
          "source_name": "BlackBerry_FIN7_April2024",
          "url": "https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--90355089-e793-4a6a-98b4-c1f20322a98f",
      "subject": "ATTACK:enterprise:S0275",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--90355089-e793-4a6a-98b4-c1f20322a98f",
      "modified": "2026-04-29T14:23:06.122Z",
      "references": [
        {
          "source_name": "Trend Micro Earth Kasha Anel NOV 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"
        },
        {
          "source_name": "FireEye APT10 Sept 2018",
          "url": "https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--905c6670-b81e-40c1-b84d-8359ffc2dcc1",
      "subject": "ATTACK:enterprise:S0141",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--905c6670-b81e-40c1-b84d-8359ffc2dcc1",
      "modified": "2026-04-29T14:23:06.122Z",
      "references": [
        {
          "source_name": "Novetta Winnti April 2015",
          "url": "https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--906699ff-a10f-4527-9173-326965cc51a2",
      "subject": "ATTACK:enterprise:S0414",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--906699ff-a10f-4527-9173-326965cc51a2",
      "modified": "2026-04-29T14:23:06.122Z",
      "references": [
        {
          "source_name": "Unit42 BabyShark Feb 2019",
          "url": "https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9154afb8-abf6-4d9d-b114-5106d801338f",
      "subject": "ATTACK:enterprise:S0260",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9154afb8-abf6-4d9d-b114-5106d801338f",
      "modified": "2026-04-29T14:23:06.123Z",
      "references": [
        {
          "source_name": "ESET InvisiMole June 2018",
          "url": "https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"
        },
        {
          "source_name": "ESET InvisiMole June 2020",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--91cea20a-9698-4bec-8fdd-c1eda3ea66e7",
      "subject": "ATTACK:enterprise:S1060",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--91cea20a-9698-4bec-8fdd-c1eda3ea66e7",
      "modified": "2026-04-29T14:23:06.124Z",
      "references": [
        {
          "source_name": "SentinelLabs Metador Sept 2022",
          "url": "https://assets.sentinelone.com/sentinellabs22/metador#page=1"
        },
        {
          "source_name": "SentinelLabs Metador Technical Appendix Sept 2022",
          "url": "https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--923f1f73-2a15-4653-b7b3-83a9be2d94ba",
      "subject": "ATTACK:enterprise:C0058",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--923f1f73-2a15-4653-b7b3-83a9be2d94ba",
      "modified": "2026-07-31T18:47:18.690Z",
      "references": [
        {
          "source_name": "Microsoft SharePoint Exploit JUL 2025",
          "url": "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/#storm-2603"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9273ab6e-ccee-40ed-8cf1-420cd0650d20",
      "subject": "ATTACK:enterprise:S1202",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9273ab6e-ccee-40ed-8cf1-420cd0650d20",
      "modified": "2026-04-29T14:23:06.125Z",
      "references": [
        {
          "source_name": "Joint Cybersecurity Advisory LockBit 3.0 MAR 2023",
          "url": "https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9497e927-67da-4845-b7a9-fe7d13524110",
      "subject": "ATTACK:enterprise:S0380",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9497e927-67da-4845-b7a9-fe7d13524110",
      "modified": "2026-04-29T14:23:06.128Z",
      "references": [
        {
          "source_name": "Kaspersky StoneDrill 2017",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--960bdedf-dcca-4a9b-aa12-358324565470",
      "subject": "ATTACK:enterprise:S0238",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--960bdedf-dcca-4a9b-aa12-358324565470",
      "modified": "2026-04-29T14:23:06.130Z",
      "references": [
        {
          "source_name": "McAfee GhostSecret",
          "url": "https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--96a9cf17-42b0-4317-82e6-55e42a2dab41",
      "subject": "ATTACK:enterprise:G0094",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--96a9cf17-42b0-4317-82e6-55e42a2dab41",
      "modified": "2026-07-31T20:48:25.204Z",
      "references": [
        {
          "source_name": "Talos Kimsuky Nov 2021",
          "url": "https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"
        },
        {
          "source_name": "Securonix Kimsuky February 2025",
          "url": "https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"
        },
        {
          "source_name": "Securelist Kimsuky Sept 2013",
          "url": "https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"
        },
        {
          "source_name": "Aryaka Kimsuky July 2025",
          "url": "https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--96ef9f6c-46aa-4a59-ad5a-5ef72279d12a",
      "subject": "ATTACK:enterprise:S1029",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--96ef9f6c-46aa-4a59-ad5a-5ef72279d12a",
      "modified": "2026-04-29T14:23:06.131Z",
      "references": [
        {
          "source_name": "MalwareBytes SideCopy Dec 2021",
          "url": "https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--97a31149-5322-472a-b443-b60ab1cec1af",
      "subject": "ATTACK:enterprise:S1200",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--97a31149-5322-472a-b443-b60ab1cec1af",
      "modified": "2026-04-29T14:23:06.132Z",
      "references": [
        {
          "source_name": "Cybereason StealBit Exfiltration Tool",
          "url": "https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9b36e877-e637-46b8-bdf1-def74c977472",
      "subject": "ATTACK:enterprise:S0125",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9b36e877-e637-46b8-bdf1-def74c977472",
      "modified": "2026-04-29T14:23:06.137Z",
      "references": [
        {
          "source_name": "Kaspersky ProjectSauron Technical Analysis",
          "url": "https://securelist.com/files/2016/07/The-ProjectSauron-APT_Technical_Analysis_KL.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9ba5068b-4e9e-445f-831b-c3d8ca444e2a",
      "subject": "ATTACK:enterprise:S1034",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9ba5068b-4e9e-445f-831b-c3d8ca444e2a",
      "modified": "2026-04-29T14:23:06.137Z",
      "references": [
        {
          "source_name": "Cybereason StrifeWater Feb 2022",
          "url": "https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9c4281ea-b225-44b4-b460-255e51586598",
      "subject": "ATTACK:enterprise:S0460",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9c4281ea-b225-44b4-b460-255e51586598",
      "modified": "2026-04-29T14:23:06.138Z",
      "references": [
        {
          "source_name": "Proofpoint TA505 October 2019",
          "url": "https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9c5c8dbe-ec34-46f9-b4af-0a6e73f00c89",
      "subject": "ATTACK:enterprise:G0069",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9c5c8dbe-ec34-46f9-b4af-0a6e73f00c89",
      "modified": "2026-07-31T20:48:30.057Z",
      "references": [
        {
          "source_name": "Talos MuddyWater May 2019",
          "url": "https://blog.talosintelligence.com/2019/05/recent-muddywater-associated-blackwater.html"
        },
        {
          "source_name": "Securelist MuddyWater Oct 2018",
          "url": "https://securelist.com/muddywater/88059/"
        },
        {
          "source_name": "Talos MuddyWater Jan 2022",
          "url": "https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html"
        },
        {
          "source_name": "Trend Micro Muddy Water March 2021",
          "url": "https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"
        },
        {
          "source_name": "Reaqta MuddyWater November 2017",
          "url": "https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9db842bf-d65d-44a8-93ca-aef62cadafc1",
      "subject": "ATTACK:enterprise:S0402",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9db842bf-d65d-44a8-93ca-aef62cadafc1",
      "modified": "2026-04-29T14:23:06.140Z",
      "references": [
        {
          "source_name": "Carbon Black Shlayer Feb 2019",
          "url": "https://blogs.vmware.com/security/2020/02/vmware-carbon-black-tau-threat-analysis-shlayer-macos.html"
        },
        {
          "source_name": "sentinelone shlayer to zshlayer",
          "url": "https://www.sentinelone.com/blog/coming-out-of-your-shell-from-shlayer-to-zshlayer/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9dfb9740-1641-4306-8ee8-38318be3ae42",
      "subject": "ATTACK:enterprise:S0384",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9dfb9740-1641-4306-8ee8-38318be3ae42",
      "modified": "2026-04-29T14:23:06.140Z",
      "references": [
        {
          "source_name": "Checkpoint Dridex Jan 2021",
          "url": "https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9e339696-4e81-496f-808e-82d63b62c331",
      "subject": "ATTACK:enterprise:S0451",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9e339696-4e81-496f-808e-82d63b62c331",
      "modified": "2026-04-29T14:23:06.141Z",
      "references": [
        {
          "source_name": "ESET LoudMiner June 2019",
          "url": "https://www.welivesecurity.com/2019/06/20/loudminer-mining-cracked-vst-software/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9e85e741-0dcd-4a15-a35a-a920f46824c2",
      "subject": "ATTACK:enterprise:S0546",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9e85e741-0dcd-4a15-a35a-a920f46824c2",
      "modified": "2026-04-29T14:23:06.141Z",
      "references": [
        {
          "source_name": "BleepingComputer Molerats Dec 2020",
          "url": "https://www.bleepingcomputer.com/news/security/hacking-group-s-new-malware-abuses-google-and-facebook-services/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9ee2a9f3-9174-4927-8561-56d5c6723b9e",
      "subject": "ATTACK:enterprise:S0199",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9ee2a9f3-9174-4927-8561-56d5c6723b9e",
      "modified": "2026-04-29T14:23:06.142Z",
      "references": [
        {
          "source_name": "FireEye APT33 Sept 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9f653750-2ee6-4d00-906b-c71f1d217288",
      "subject": "ATTACK:enterprise:S0171",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9f653750-2ee6-4d00-906b-c71f1d217288",
      "modified": "2026-04-29T14:23:06.142Z",
      "references": [
        {
          "source_name": "Forcepoint Felismus Mar 2017",
          "url": "https://blogs.forcepoint.com/security-labs/playing-cat-mouse-introducing-felismus-malware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a02da835-676d-47df-86c6-547a7d29dbae",
      "subject": "ATTACK:enterprise:S0079",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a02da835-676d-47df-86c6-547a7d29dbae",
      "modified": "2026-04-29T14:23:06.143Z",
      "references": [
        {
          "source_name": "Scarlet Mimic Jan 2016",
          "url": "http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a08dadbf-6f68-415f-9daa-f84571af83a2",
      "subject": "ATTACK:enterprise:S0144",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a08dadbf-6f68-415f-9daa-f84571af83a2",
      "modified": "2026-04-29T14:23:06.144Z",
      "references": [
        {
          "source_name": "Palo Alto menuPass Feb 2017",
          "url": "http://researchcenter.paloaltonetworks.com/2017/02/unit42-menupass-returns-new-malware-new-attacks-japanese-academics-organizations/"
        },
        {
          "source_name": "PWC Cloud Hopper Technical Annex April 2017",
          "url": "https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a0e4dc2c-1977-4c4c-a5ee-4710fb3ef1a5",
      "subject": "ATTACK:enterprise:S0022",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a0e4dc2c-1977-4c4c-a5ee-4710fb3ef1a5",
      "modified": "2026-04-29T14:23:06.144Z",
      "references": [
        {
          "source_name": "Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023",
          "url": "https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a0e78137-f13e-491e-ba5e-d1cd005ab17c",
      "subject": "ATTACK:enterprise:S1168",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a0e78137-f13e-491e-ba5e-d1cd005ab17c",
      "modified": "2026-04-29T14:23:06.144Z",
      "references": [
        {
          "source_name": "ESET OilRig Downloaders DEC 2023",
          "url": "https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a641447f-995a-4f06-93d2-637e265c7638",
      "subject": "ATTACK:enterprise:G0139",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a641447f-995a-4f06-93d2-637e265c7638",
      "modified": "2026-07-31T18:47:49.871Z",
      "references": [
        {
          "source_name": "ATT TeamTNT Chimaera September 2020",
          "url": "https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera"
        },
        {
          "source_name": "Cisco Talos Intelligence Group",
          "url": "https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a6904fd0-d121-4b26-b05c-1615e3baf599",
      "subject": "ATTACK:enterprise:S1025",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a6904fd0-d121-4b26-b05c-1615e3baf599",
      "modified": "2026-04-29T14:23:06.152Z",
      "references": [
        {
          "source_name": "Korean FSI TA505 2020",
          "url": "https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="
        },
        {
          "source_name": "BlackBerry Amadey 2020",
          "url": "https://blogs.blackberry.com/en/2020/01/threat-spotlight-amadey-bot"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a6f54d8a-7659-4efb-b53b-0e05664bdd23",
      "subject": "ATTACK:enterprise:G1015",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a6f54d8a-7659-4efb-b53b-0e05664bdd23",
      "modified": "2026-07-31T20:48:34.381Z",
      "references": [
        {
          "source_name": "Mandiant VMware vSphere JUL 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a6f98712-2c65-493f-a707-db17417e5c80",
      "subject": "ATTACK:enterprise:S1196",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a6f98712-2c65-493f-a707-db17417e5c80",
      "modified": "2026-04-29T14:23:06.152Z",
      "references": [
        {
          "source_name": "S2W Troll Stealer 2024",
          "url": "https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"
        },
        {
          "source_name": "Symantec Troll Stealer 2024",
          "url": "https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a88332d2-d03f-4139-b11c-19e82459189b",
      "subject": "ATTACK:enterprise:S0184",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a88332d2-d03f-4139-b11c-19e82459189b",
      "modified": "2026-04-29T14:23:06.155Z",
      "references": [
        {
          "source_name": "FireEye APT34 Dec 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a8dc6cca-3ede-4110-baf1-8ce53fb655a9",
      "subject": "ATTACK:enterprise:S0236",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a8dc6cca-3ede-4110-baf1-8ce53fb655a9",
      "modified": "2026-04-29T14:23:06.155Z",
      "references": [
        {
          "source_name": "Symantec Orangeworm April 2018",
          "url": "https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a8f11c39-df96-451e-a93a-417512f82819",
      "subject": "ATTACK:enterprise:S0153",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a8f11c39-df96-451e-a93a-417512f82819",
      "modified": "2026-04-29T14:23:06.155Z",
      "references": [
        {
          "source_name": "Accenture Hogfish April 2018",
          "url": "http://web.archive.org/web/20220810112638/https:/www.accenture.com/t20180423T055005Z_w_/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"
        },
        {
          "source_name": "PWC Cloud Hopper Technical Annex April 2017",
          "url": "https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a9e6a51e-69b1-4b21-9db1-5aabdded2f0a",
      "subject": "ATTACK:enterprise:S0447",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a9e6a51e-69b1-4b21-9db1-5aabdded2f0a",
      "modified": "2026-04-29T14:23:06.156Z",
      "references": [
        {
          "source_name": "FSecure Lokibot November 2019",
          "url": "https://www.f-secure.com/v-descs/trojan_w32_lokibot.shtml"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--aa4acffb-0b5c-48b3-b0c4-d321e6ae842d",
      "subject": "ATTACK:enterprise:S9043",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--aa4acffb-0b5c-48b3-b0c4-d321e6ae842d",
      "modified": "2026-07-29T20:40:50.537Z",
      "references": [
        {
          "source_name": "Hunt.io TeamPCP Toolkit MAY 2026",
          "url": "https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"
        },
        {
          "source_name": "Trend Micro TeamPCP MAY 2026",
          "url": "https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"
        },
        {
          "source_name": "Phoenix TeamPCP 20 MAY 2026",
          "url": "https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--aaa42f0a-5709-45e2-81d3-0687b3c72cc9",
      "subject": "ATTACK:enterprise:S0681",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--aaa42f0a-5709-45e2-81d3-0687b3c72cc9",
      "modified": "2026-04-29T14:23:06.157Z",
      "references": [
        {
          "source_name": "BiZone Lizar May 2021",
          "url": "https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"
        },
        {
          "source_name": "SekoiaBourhis_DiceLoader_Feb2024",
          "url": "https://blog.sekoia.io/unveiling-the-intricacies-of-diceloader/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--abf00a6a-7922-432c-95e0-6c44db2c20e3",
      "subject": "ATTACK:enterprise:S0248",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--abf00a6a-7922-432c-95e0-6c44db2c20e3",
      "modified": "2026-04-29T14:23:06.159Z",
      "references": [
        {
          "source_name": "ASERT Donot March 2018",
          "url": "https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ac4b5156-e98e-4826-abc5-02e244496c03",
      "subject": "ATTACK:enterprise:S1160",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ac4b5156-e98e-4826-abc5-02e244496c03",
      "modified": "2026-04-29T14:23:06.159Z",
      "references": [
        {
          "source_name": "Bitsight Latrodectus June 2024",
          "url": "https://www.bitsight.com/blog/latrodectus-are-you-coming-back"
        },
        {
          "source_name": "Latrodectus APR 2024",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"
        },
        {
          "source_name": "Elastic Latrodectus May 2024",
          "url": "https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ad39bd23-1dd8-4725-bf00-74c0e564215f",
      "subject": "ATTACK:enterprise:S0201",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ad39bd23-1dd8-4725-bf00-74c0e564215f",
      "modified": "2026-04-29T14:23:06.161Z",
      "references": [
        {
          "source_name": "Microsoft PLATINUM April 2016",
          "url": "https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ad60db1c-ea28-4f3d-8ba3-d30a76a4751b",
      "subject": "ATTACK:enterprise:C0044",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ad60db1c-ea28-4f3d-8ba3-d30a76a4751b",
      "modified": "2026-07-31T21:13:47.692Z",
      "references": [
        {
          "source_name": "ESET OilRig Campaigns Sep 2023",
          "url": "https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--aecb4057-07a2-4b44-805a-5566a4047e23",
      "subject": "ATTACK:enterprise:S0532",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--aecb4057-07a2-4b44-805a-5566a4047e23",
      "modified": "2026-04-29T14:23:06.163Z",
      "references": [
        {
          "source_name": "Unit 42 Lucifer June 2020",
          "url": "https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--aeda6707-50e2-47e2-833a-18e4a5d73e88",
      "subject": "ATTACK:enterprise:S0084",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--aeda6707-50e2-47e2-833a-18e4a5d73e88",
      "modified": "2026-04-29T14:23:06.163Z",
      "references": [
        {
          "source_name": "Cylance Dust Storm",
          "url": "https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--aee29ae1-4544-4fc8-b30b-4717888991ca",
      "subject": "ATTACK:enterprise:S0032",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--aee29ae1-4544-4fc8-b30b-4717888991ca",
      "modified": "2026-04-29T14:23:06.163Z",
      "references": [
        {
          "source_name": "Gh0stRAT ATT March 2019",
          "url": "https://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--afe95822-7845-4f16-b50c-62f428c59697",
      "subject": "ATTACK:enterprise:S1240",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--afe95822-7845-4f16-b50c-62f428c59697",
      "modified": "2026-04-29T14:23:06.165Z",
      "references": [
        {
          "source_name": "Kroll RedLine Stealer August 2024",
          "url": "https://www.kroll.com/en/publications/cyber/redlinestealer-malware"
        },
        {
          "source_name": "Proofpoint RedLine Stealer March 2020",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/new-redline-stealer-distributed-using-coronavirus-themed-email-campaign"
        },
        {
          "source_name": "Splunk RedLine Stealer June 2023",
          "url": "https://www.splunk.com/en_us/blog/security/do-not-cross-the-redline-stealer-detections-and-analysis.html"
        },
        {
          "source_name": "Veriti RedLine Stealer MAAS April 2023",
          "url": "https://veriti.ai/blog/veriti-research/from-chatgpt-to-redline-stealer-the-dark-side-of-openai-and-google-bard/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b0791504-fc65-402b-bc47-bd96ed4abea1",
      "subject": "ATTACK:enterprise:G0022",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b0791504-fc65-402b-bc47-bd96ed4abea1",
      "modified": "2026-07-31T18:47:38.154Z",
      "references": [
        {
          "source_name": "Symantec Buckeye",
          "url": "https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"
        },
        {
          "source_name": "evolution of pirpi",
          "url": "https://recon.cx/2017/montreal/resources/slides/RECON-MTL-2017-evolution_of_pirpi.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b1c307de-b924-4332-b8db-3c371e46430e",
      "subject": "ATTACK:enterprise:S0253",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b1c307de-b924-4332-b8db-3c371e46430e",
      "modified": "2026-04-29T14:23:06.168Z",
      "references": [
        {
          "source_name": "McAfee Gold Dragon",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b22e151c-4919-4160-9f5c-143484948003",
      "subject": "ATTACK:enterprise:S0244",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b22e151c-4919-4160-9f5c-143484948003",
      "modified": "2026-04-29T14:23:06.168Z",
      "references": [
        {
          "source_name": "Palo Alto Comnie",
          "url": "https://researchcenter.paloaltonetworks.com/2018/01/unit42-comnie-continues-target-organizations-east-asia/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b30cc0be-74f0-42a6-85ef-594d6d184bae",
      "subject": "ATTACK:enterprise:G0121",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b30cc0be-74f0-42a6-85ef-594d6d184bae",
      "modified": "2026-07-31T18:47:52.053Z",
      "references": [
        {
          "source_name": "ATT Sidewinder January 2021",
          "url": "https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"
        },
        {
          "source_name": "Rewterz Sidewinder COVID-19 June 2020",
          "url": "https://www.rewterz.com/articles/analysis-on-sidewinder-apt-group-covid-19"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b5076cf3-ccd5-4dd7-895b-abf79eddf63f",
      "subject": "ATTACK:enterprise:S9010",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b5076cf3-ccd5-4dd7-895b-abf79eddf63f",
      "modified": "2026-04-29T14:23:06.172Z",
      "references": [
        {
          "source_name": "Socket GlassWorm January 2026",
          "url": "https://socket.dev/blog/glassworm-loader-hits-open-vsx-via-suspected-developer-account-compromise"
        },
        {
          "source_name": "Koi GlassWorm Rust December 2025",
          "url": "https://www.koi.ai/blog/glassworm-goes-native-same-infrastructure-hardened-delivery"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b509e591-b086-4631-a9ba-5a5dc80de8d0",
      "subject": "ATTACK:enterprise:S0331",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b509e591-b086-4631-a9ba-5a5dc80de8d0",
      "modified": "2026-04-29T14:23:06.172Z",
      "references": [
        {
          "source_name": "Fortinet Agent Tesla April 2018",
          "url": "https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html"
        },
        {
          "source_name": "Fortinet Agent Tesla June 2017",
          "url": "https://www.fortinet.com/blog/threat-research/in-depth-analysis-of-net-malware-javaupdtr.html"
        },
        {
          "source_name": "Malwarebytes Agent Tesla April 2020",
          "url": "https://blog.malwarebytes.com/threat-analysis/2020/04/new-agenttesla-variant-steals-wifi-credentials/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b60dcc78-83b0-4fe2-b874-6f22f99b6087",
      "subject": "ATTACK:enterprise:G0059",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b60dcc78-83b0-4fe2-b874-6f22f99b6087",
      "modified": "2026-07-31T18:48:29.214Z",
      "references": [
        {
          "source_name": "DFIR Phosphorus November 2021",
          "url": "https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"
        },
        {
          "source_name": "DFIR Report APT35 ProxyShell March 2022",
          "url": "https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"
        },
        {
          "source_name": "Unit 42 Magic Hound Feb 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b642368c-b543-471a-93f2-40af6ff94cbf",
      "subject": "ATTACK:enterprise:G1034",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b642368c-b543-471a-93f2-40af6ff94cbf",
      "modified": "2026-07-31T18:48:27.132Z",
      "references": [
        {
          "source_name": "ESET EvasivePanda 2024",
          "url": "https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b6c71a79-0909-4a01-b026-306040e0da44",
      "subject": "ATTACK:enterprise:G1054",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b6c71a79-0909-4a01-b026-306040e0da44",
      "modified": "2026-07-31T18:48:08.955Z",
      "references": [
        {
          "source_name": "ITOCHU LODEINFO JAN 2024",
          "url": "https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"
        },
        {
          "source_name": "JPCERT MirrorFace JUL 2024",
          "url": "https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"
        },
        {
          "source_name": "Trend Micro Earth Kasha NOV 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b7d456ea-d533-4d29-b6d4-45586c4a124e",
      "subject": "ATTACK:enterprise:S1142",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b7d456ea-d533-4d29-b6d4-45586c4a124e",
      "modified": "2026-04-29T14:23:06.176Z",
      "references": [
        {
          "source_name": "ESET Turla Lunar toolset May 2024",
          "url": "https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b844919a-e7d8-4317-9f0d-56338bae818c",
      "subject": "ATTACK:enterprise:S0572",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b844919a-e7d8-4317-9f0d-56338bae818c",
      "modified": "2026-04-29T14:23:06.177Z",
      "references": [
        {
          "source_name": "ClearSky Lebanese Cedar Jan 2021",
          "url": "https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b880fc5d-236d-44b5-90ec-46ce43c330ed",
      "subject": "ATTACK:enterprise:S9050",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b880fc5d-236d-44b5-90ec-46ce43c330ed",
      "modified": "2026-09-28T18:53:00.771Z",
      "references": [
        {
          "source_name": "Cyfirma_Vidar_June2024",
          "url": "https://www.cyfirma.com/research/vidar-stealer-an-in-depth-analysis-of-an-information-stealing-malware/"
        },
        {
          "source_name": "Logpoint_StealerMalwareFamilies_2024",
          "url": "https://web.archive.org/web/20240517205011/https://www.logpoint.com/wp-content/uploads/2024/03/logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families-1.pdf"
        },
        {
          "source_name": "Unit42_Vidar_July2026",
          "url": "https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/"
        },
        {
          "source_name": "QuorumCyber_Vidar_March2023",
          "url": "https://www.quorumcyber.com/wp-content/uploads/2023/01/Malware-Analysis-Vidar.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b892d69f-bdfc-48e8-83f5-3081b9bffa4a",
      "subject": "ATTACK:enterprise:S0386",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b892d69f-bdfc-48e8-83f5-3081b9bffa4a",
      "modified": "2026-04-29T14:23:06.177Z",
      "references": [
        {
          "source_name": "TrendMicro Ursnif Mar 2015",
          "url": "https://web.archive.org/web/20210719165945/https://www.trendmicro.com/en_us/research/15/c/ursnif-the-multifaceted-malware.html?_ga=2.165628854.808042651.1508120821-744063452.1505819992"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b8ecd33a-190f-4f7d-945d-c258512d76d4",
      "subject": "ATTACK:enterprise:G1040",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b8ecd33a-190f-4f7d-945d-c258512d76d4",
      "modified": "2026-07-31T18:48:25.919Z",
      "references": [
        {
          "source_name": "Trend Micro Ransomware Spotlight Play July 2023",
          "url": "https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--baf93cec-ad47-4380-bda7-9569e088b5e9",
      "subject": "ATTACK:enterprise:G1053",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--baf93cec-ad47-4380-bda7-9569e088b5e9",
      "modified": "2026-07-31T18:48:03.915Z",
      "references": [
        {
          "source_name": "Microsoft Storm-501 Sabbath Ransomware Embargo September 2024",
          "url": "https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bb4e12ab-cfaa-4693-9156-bb97fc9c5b92",
      "subject": "ATTACK:enterprise:S1182",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bb4e12ab-cfaa-4693-9156-bb97fc9c5b92",
      "modified": "2026-04-29T14:23:06.181Z",
      "references": [
        {
          "source_name": "Cisco MagicRAT 2022",
          "url": "https://blog.talosintelligence.com/lazarus-magicrat/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bc52cbe2-32a0-4491-aa57-46ef39e431b9",
      "subject": "ATTACK:enterprise:C0014",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bc52cbe2-32a0-4491-aa57-46ef39e431b9",
      "modified": "2026-07-31T18:47:31.876Z",
      "references": [
        {
          "source_name": "FoxIT Wocao December 2019",
          "url": "https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bf35d6f4-4ea1-4d4d-bb02-b5d4f6b9f0eb",
      "subject": "ATTACK:enterprise:G1052",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bf35d6f4-4ea1-4d4d-bb02-b5d4f6b9f0eb",
      "modified": "2026-07-31T18:47:54.824Z",
      "references": [
        {
          "source_name": "Sekoia ClickFake 2025",
          "url": "https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bfaa2e3f-fab0-4136-a951-ed1bad30a771",
      "subject": "ATTACK:enterprise:S1064",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bfaa2e3f-fab0-4136-a951-ed1bad30a771",
      "modified": "2026-04-29T14:23:06.187Z",
      "references": [
        {
          "source_name": "HP SVCReady Jun 2022",
          "url": "https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c008b7f3-0507-4987-a7e4-8c4d57cb4ca5",
      "subject": "ATTACK:enterprise:S0062",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c008b7f3-0507-4987-a7e4-8c4d57cb4ca5",
      "modified": "2026-04-29T14:23:06.188Z",
      "references": [
        {
          "source_name": "DustySky",
          "url": "https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c0220333-2cfb-4449-acbb-9bea0b7751b4",
      "subject": "ATTACK:enterprise:S0569",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c0220333-2cfb-4449-acbb-9bea0b7751b4",
      "modified": "2026-04-29T14:23:06.188Z",
      "references": [
        {
          "source_name": "CheckPoint Volatile Cedar March 2015",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c088f23e-b741-453c-a710-01990dead853",
      "subject": "ATTACK:enterprise:S0096",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c088f23e-b741-453c-a710-01990dead853",
      "modified": "2026-04-29T14:23:06.189Z",
      "references": [
        {
          "source_name": "TechNet Systeminfo",
          "url": "https://technet.microsoft.com/en-us/library/bb491007.aspx"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c089604b-f25e-4a4c-857b-0c2d157d34bb",
      "subject": "ATTACK:enterprise:S0691",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c089604b-f25e-4a4c-857b-0c2d157d34bb",
      "modified": "2026-04-29T14:23:06.189Z",
      "references": [
        {
          "source_name": "Microsoft NICKEL December 2021",
          "url": "https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c140a027-1994-4e00-a9f9-8c407f22b486",
      "subject": "ATTACK:enterprise:G1044",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c140a027-1994-4e00-a9f9-8c407f22b486",
      "modified": "2026-07-31T18:48:16.387Z",
      "references": [
        {
          "source_name": "Mandiant APT42-charms",
          "url": "https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c1544dec-4586-466a-b730-862c06e9e3c7",
      "subject": "ATTACK:enterprise:S0249",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c1544dec-4586-466a-b730-862c06e9e3c7",
      "modified": "2026-04-29T14:23:06.190Z",
      "references": [
        {
          "source_name": "McAfee Gold Dragon",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c1a4334d-8975-4ca2-8734-d6c26e36702a",
      "subject": "ATTACK:enterprise:S0024",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c1a4334d-8975-4ca2-8734-d6c26e36702a",
      "modified": "2026-04-29T14:23:06.190Z",
      "references": [
        {
          "source_name": "Malwarebytes Dyreza November 2015",
          "url": "https://blog.malwarebytes.com/threat-analysis/2015/11/a-technical-look-at-dyreza/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c1c32fe3-7aba-4d58-94df-89ce60a76810",
      "subject": "ATTACK:enterprise:G1008",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c1c32fe3-7aba-4d58-94df-89ce60a76810",
      "modified": "2026-07-31T18:47:36.943Z",
      "references": [
        {
          "source_name": "MalwareBytes SideCopy Dec 2021",
          "url": "https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c2057ba9-0072-46aa-acce-f9277c4e38bd",
      "subject": "ATTACK:enterprise:C0029",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c2057ba9-0072-46aa-acce-f9277c4e38bd",
      "modified": "2026-07-31T18:47:23.372Z",
      "references": [
        {
          "source_name": "Mandiant Cutting Edge Part 2 January 2024",
          "url": "https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c3893875-4f9e-43e4-babf-6f45ec485444",
      "subject": "ATTACK:enterprise:S0688",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c3893875-4f9e-43e4-babf-6f45ec485444",
      "modified": "2026-04-29T14:23:06.192Z",
      "references": [
        {
          "source_name": "Check Point Meteor Aug 2021",
          "url": "https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c3d9182c-178b-4d8d-91d8-f4d1313738bb",
      "subject": "ATTACK:enterprise:G0073",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c3d9182c-178b-4d8d-91d8-f4d1313738bb",
      "modified": "2026-07-31T18:48:31.141Z",
      "references": [
        {
          "source_name": "FireEye APT19",
          "url": "https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"
        },
        {
          "source_name": "Unit 42 C0d0so0 Jan 2016",
          "url": "https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c40c369b-d68a-4f89-a5ee-4fa5b95bf472",
      "subject": "ATTACK:enterprise:S9052",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c40c369b-d68a-4f89-a5ee-4fa5b95bf472",
      "modified": "2026-09-24T18:38:49.014Z",
      "references": [
        {
          "source_name": "CheckPoint_NimbusManticore_May2026",
          "url": "https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c4684b0f-86e1-4200-bd12-e9472f892779",
      "subject": "ATTACK:enterprise:S1184",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c4684b0f-86e1-4200-bd12-e9472f892779",
      "modified": "2026-04-29T14:23:06.193Z",
      "references": [
        {
          "source_name": "Google Cloud BOLDMOVE 2023",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/chinese-actors-exploit-fortios-flaw/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c47e35e1-cf8a-4c2b-b63d-25b37a008226",
      "subject": "ATTACK:enterprise:G0026",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c47e35e1-cf8a-4c2b-b63d-25b37a008226",
      "modified": "2026-07-31T18:47:50.840Z",
      "references": [
        {
          "source_name": "PaloAlto DNS Requests May 2016",
          "url": "https://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c5087d19-7d99-4106-9dc7-407c7de710be",
      "subject": "ATTACK:enterprise:S0208",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c5087d19-7d99-4106-9dc7-407c7de710be",
      "modified": "2026-04-29T14:23:06.194Z",
      "references": [
        {
          "source_name": "Symantec Pasam May 2012",
          "url": "https://www.symantec.com/security_response/writeup.jsp?docid=2012-050412-4128-99"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c50c585a-b5c4-41c7-91a2-b6bb14b7e1f0",
      "subject": "ATTACK:enterprise:S0348",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c50c585a-b5c4-41c7-91a2-b6bb14b7e1f0",
      "modified": "2026-04-29T14:23:06.194Z",
      "references": [
        {
          "source_name": "PaloAlto CardinalRat Apr 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c6172742-12ae-4d3f-9fd6-194cfdc93de7",
      "subject": "ATTACK:enterprise:S0679",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c6172742-12ae-4d3f-9fd6-194cfdc93de7",
      "modified": "2026-04-29T14:23:06.196Z",
      "references": [
        {
          "source_name": "Kaspersky WIRTE November 2021",
          "url": "https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c62b3e99-4ab2-4474-b3f7-2779652210f7",
      "subject": "ATTACK:enterprise:S0445",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c62b3e99-4ab2-4474-b3f7-2779652210f7",
      "modified": "2026-04-29T14:23:06.196Z",
      "references": [
        {
          "source_name": "FOX-IT May 2016 Mofang",
          "url": "https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c6606ced-4641-451f-ac2a-493b1d15d0aa",
      "subject": "ATTACK:enterprise:S0148",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c6606ced-4641-451f-ac2a-493b1d15d0aa",
      "modified": "2026-04-29T14:23:06.197Z",
      "references": [
        {
          "source_name": "ESET RTM Feb 2017",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c6f6b904-0246-471c-93ca-0b70c70b0c96",
      "subject": "ATTACK:enterprise:S1244",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c6f6b904-0246-471c-93ca-0b70c70b0c96",
      "modified": "2026-04-29T14:23:06.197Z",
      "references": [
        {
          "source_name": "Security Scorecard Medusa Ransomware January 2024",
          "url": "https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c707d09b-1b36-4a1c-99be-c905fdd3ff6b",
      "subject": "ATTACK:enterprise:S1028",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c707d09b-1b36-4a1c-99be-c905fdd3ff6b",
      "modified": "2026-04-29T14:23:06.197Z",
      "references": [
        {
          "source_name": "MalwareBytes SideCopy Dec 2021",
          "url": "https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c8342b87-ceea-40e0-a9ad-11b72aa1378f",
      "subject": "ATTACK:enterprise:G0061",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c8342b87-ceea-40e0-a9ad-11b72aa1378f",
      "modified": "2026-07-31T18:48:30.008Z",
      "references": [
        {
          "source_name": "Symantec FIN8 Jul 2023",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c97ef137-79d7-4e87-ba15-f719724eb15b",
      "subject": "ATTACK:enterprise:S9034",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c97ef137-79d7-4e87-ba15-f719724eb15b",
      "modified": "2026-04-29T14:23:06.201Z",
      "references": [
        {
          "source_name": "SecureListUbiedo_Tsundere_Nov2025",
          "url": "https://securelist.com/tsundere-node-js-botnet-uses-ethereum-blockchain/117979/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ca765e99-996e-4d0f-ada0-5c44d3930404",
      "subject": "ATTACK:enterprise:S1022",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ca765e99-996e-4d0f-ada0-5c44d3930404",
      "modified": "2026-04-29T14:23:06.202Z",
      "references": [
        {
          "source_name": "CrowdStrike IceApple May 2022",
          "url": "https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cb37da3b-6ffd-4882-9680-4e467f25d7f4",
      "subject": "ATTACK:enterprise:S0658",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cb37da3b-6ffd-4882-9680-4e467f25d7f4",
      "modified": "2026-04-29T14:23:06.203Z",
      "references": [
        {
          "source_name": "trendmicro xcsset xcode project 2020",
          "url": "https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cc8a3a34-1324-4a4d-8557-3c23fad2b07c",
      "subject": "ATTACK:enterprise:S1207",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cc8a3a34-1324-4a4d-8557-3c23fad2b07c",
      "modified": "2026-04-29T14:23:06.205Z",
      "references": [
        {
          "source_name": "Acronis XLoader 2021",
          "url": "https://www.acronis.com/en-us/cyber-protection-center/posts/trojan-as-a-service-from-formbook-to-xloader/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ccd4c695-2458-4eb0-ad9c-a19d411f7627",
      "subject": "ATTACK:enterprise:S0659",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ccd4c695-2458-4eb0-ad9c-a19d411f7627",
      "modified": "2026-04-29T14:23:06.205Z",
      "references": [
        {
          "source_name": "Fortinet Diavol July 2021",
          "url": "https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cd18fa85-3b0c-4201-b85d-92dfaf91eb5a",
      "subject": "ATTACK:enterprise:C0062",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cd18fa85-3b0c-4201-b85d-92dfaf91eb5a",
      "modified": "2026-07-31T18:47:24.729Z",
      "references": [
        {
          "source_name": "Anthropic AI Orchestrated Campaign NOV 2025",
          "url": "https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cd5799f3-8be5-4272-88db-626940136130",
      "subject": "ATTACK:enterprise:G0081",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cd5799f3-8be5-4272-88db-626940136130",
      "modified": "2026-07-31T18:47:57.597Z",
      "references": [
        {
          "source_name": "TrendMicro TropicTrooper 2015",
          "url": "https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf"
        },
        {
          "source_name": "TrendMicro Tropic Trooper May 2020",
          "url": "https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ced766d2-ca63-43d2-8551-76f37696cc88",
      "subject": "ATTACK:enterprise:S0268",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ced766d2-ca63-43d2-8551-76f37696cc88",
      "modified": "2026-04-29T14:23:06.208Z",
      "references": [
        {
          "source_name": "Unit 42 Bisonal July 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-bisonal-malware-used-attacks-russia-south-korea/"
        },
        {
          "source_name": "Talos Bisonal Mar 2020",
          "url": "https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"
        },
        {
          "source_name": "Kaspersky CactusPete Aug 2020",
          "url": "https://securelist.com/cactuspete-apt-groups-updated-bisonal-backdoor/97962/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cf629c11-56bd-4804-a03a-311689060c85",
      "subject": "ATTACK:enterprise:G0143",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cf629c11-56bd-4804-a03a-311689060c85",
      "modified": "2026-07-31T18:47:59.571Z",
      "references": [
        {
          "source_name": "CrowdStrike AQUATIC PANDA December 2021",
          "url": "https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cf82b1ee-b2b1-47c1-8826-64811df5b6da",
      "subject": "ATTACK:enterprise:C0064",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cf82b1ee-b2b1-47c1-8826-64811df5b6da",
      "modified": "2026-09-23T22:27:32.921Z",
      "references": [
        {
          "source_name": "AI-Mexico-Govt-Breach",
          "url": "https://cdn.prod.website-files.com/69944dd945f20ca4a27a7c47/69d8bb5aea59e31efb3b8a7f_Tech_Report_ai_breach_mex_gov.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cfc92bbe-4a8b-47ec-b12d-d08fdcea1fbb",
      "subject": "ATTACK:enterprise:S0240",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cfc92bbe-4a8b-47ec-b12d-d08fdcea1fbb",
      "modified": "2026-04-29T14:23:06.209Z",
      "references": [
        {
          "source_name": "Talos ROKRAT",
          "url": "https://blog.talosintelligence.com/2017/04/introducing-rokrat.html"
        },
        {
          "source_name": "Talos ROKRAT 2",
          "url": "https://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"
        },
        {
          "source_name": "Securelist ScarCruft May 2019",
          "url": "https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/"
        },
        {
          "source_name": "NCCGroup RokRat Nov 2018",
          "url": "https://research.nccgroup.com/2018/11/08/rokrat-analysis/"
        },
        {
          "source_name": "Volexity InkySquid RokRAT August 2021",
          "url": "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
        },
        {
          "source_name": "Malwarebytes RokRAT VBA January 2021",
          "url": "https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d0592d8b-cb1e-431f-a27e-1412892ca030",
      "subject": "ATTACK:enterprise:S0604",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d0592d8b-cb1e-431f-a27e-1412892ca030",
      "modified": "2026-04-29T14:23:06.211Z",
      "references": [
        {
          "source_name": "Dragos Crashoverride 2017",
          "url": "https://dragos.com/blog/crashoverride/CrashOverride-01.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d0ddfe52-8e91-4576-b7e2-912b51eca87d",
      "subject": "ATTACK:enterprise:G1035",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d0ddfe52-8e91-4576-b7e2-912b51eca87d",
      "modified": "2026-07-31T18:48:03.298Z",
      "references": [
        {
          "source_name": "DomainTools WinterVivern 2021",
          "url": "https://www.domaintools.com/resources/blog/winter-vivern-a-look-at-re-crafted-government-maldocs/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d216c395-ceb2-4103-8035-336a0821b79c",
      "subject": "ATTACK:enterprise:S0596",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d216c395-ceb2-4103-8035-336a0821b79c",
      "modified": "2026-04-29T14:23:06.213Z",
      "references": [
        {
          "source_name": "Kaspersky ShadowPad Aug 2017",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d31367da-4a66-4fe2-ac2c-d54ba1e985b0",
      "subject": "ATTACK:enterprise:S1198",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d31367da-4a66-4fe2-ac2c-d54ba1e985b0",
      "modified": "2026-04-29T14:23:06.214Z",
      "references": [
        {
          "source_name": "Symantec Troll Stealer 2024",
          "url": "https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d336d669-ef00-476d-81f6-0fe88093e1e6",
      "subject": "ATTACK:enterprise:S1026",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d336d669-ef00-476d-81f6-0fe88093e1e6",
      "modified": "2026-04-29T14:23:06.214Z",
      "references": [
        {
          "source_name": "SentinelOne Aoqin Dragon June 2022",
          "url": "https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d5be9ea1-7bf2-453b-bbca-19a9d82ea532",
      "subject": "ATTACK:enterprise:S0650",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d5be9ea1-7bf2-453b-bbca-19a9d82ea532",
      "modified": "2026-04-29T14:23:06.217Z",
      "references": [
        {
          "source_name": "Crowdstrike Qakbot October 2020",
          "url": "https://www.crowdstrike.com/blog/duck-hunting-with-falcon-complete-qakbot-zip-based-campaign/"
        },
        {
          "source_name": "Group IB Ransomware September 2020",
          "url": "https://web.archive.org/web/20220119114433/https://groupib.pathfactory.com/ransomware-reports/prolock_wp"
        },
        {
          "source_name": "Microsoft Ransomware as a Service",
          "url": "https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"
        },
        {
          "source_name": "ATT QakBot April 2021",
          "url": "https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d6154157-fe69-4da3-8cc3-790eecf33f8c",
      "subject": "ATTACK:enterprise:S0151",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d6154157-fe69-4da3-8cc3-790eecf33f8c",
      "modified": "2026-04-29T14:23:06.218Z",
      "references": [
        {
          "source_name": "FireEye FIN7 April 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d68f3474-8ba0-45e8-8876-3b1dd8a56fbf",
      "subject": "ATTACK:enterprise:S0610",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d68f3474-8ba0-45e8-8876-3b1dd8a56fbf",
      "modified": "2026-04-29T14:23:06.218Z",
      "references": [
        {
          "source_name": "Check Point APT34 April 2021",
          "url": "https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d7643073-825d-407c-b2ba-11c313ea6a9e",
      "subject": "ATTACK:enterprise:S9008",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d7643073-825d-407c-b2ba-11c313ea6a9e",
      "modified": "2026-04-29T14:23:06.219Z",
      "references": [
        {
          "source_name": "Aikido Shai-Hulud September 2025",
          "url": "https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-again"
        },
        {
          "source_name": "Socket Shai-Hulud November 2025",
          "url": "https://socket.dev/blog/shai-hulud-strikes-again-v2"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d7e5009a-1eb3-4b74-ad0c-53ba0e151935",
      "subject": "ATTACK:enterprise:S0662",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d7e5009a-1eb3-4b74-ad0c-53ba0e151935",
      "modified": "2026-04-29T14:23:06.220Z",
      "references": [
        {
          "source_name": "Profero APT27 December 2020",
          "url": "https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d826904c-7853-4f85-a5e4-948b21ae374c",
      "subject": "ATTACK:enterprise:S0454",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d826904c-7853-4f85-a5e4-948b21ae374c",
      "modified": "2026-04-29T14:23:06.220Z",
      "references": [
        {
          "source_name": "Symantec Chafer Dec 2015",
          "url": "https://www.symantec.com/connect/blogs/iran-based-attackers-use-back-door-threats-spy-middle-eastern-targets"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d843c014-0814-4945-b75a-09db4ad6e81b",
      "subject": "ATTACK:enterprise:S0409",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d843c014-0814-4945-b75a-09db4ad6e81b",
      "modified": "2026-04-29T14:23:06.220Z",
      "references": [
        {
          "source_name": "ESET Machete July 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d8bad886-d65a-4652-811f-f8ff9f6bb6db",
      "subject": "ATTACK:enterprise:S0270",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d8bad886-d65a-4652-811f-f8ff9f6bb6db",
      "modified": "2026-04-29T14:23:06.221Z",
      "references": [
        {
          "source_name": "Unit 42 DarkHydrus July 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d96e80d3-f4ca-40bd-ae69-979a0a782a57",
      "subject": "ATTACK:enterprise:S1159",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d96e80d3-f4ca-40bd-ae69-979a0a782a57",
      "modified": "2026-04-29T14:23:06.222Z",
      "references": [
        {
          "source_name": "Google Cloud APT41 2024",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--da0a0a14-0f29-43f8-abf7-b281a1071928",
      "subject": "ATTACK:enterprise:S0647",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--da0a0a14-0f29-43f8-abf7-b281a1071928",
      "modified": "2026-04-29T14:23:06.223Z",
      "references": [
        {
          "source_name": "ESET BackdoorDiplomacy Jun 2021",
          "url": "https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--dac8dcfd-e7e7-4b41-b100-07f95f6b0ba9",
      "subject": "ATTACK:enterprise:S0330",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--dac8dcfd-e7e7-4b41-b100-07f95f6b0ba9",
      "modified": "2026-04-29T14:23:06.224Z",
      "references": [
        {
          "source_name": "Talos Zeus Panda Nov 2017",
          "url": "https://blog.talosintelligence.com/2017/11/zeus-panda-campaign.html#More"
        },
        {
          "source_name": "GDATA Zeus Panda June 2017",
          "url": "https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--dacff5f4-a7ed-424b-847b-377ed2b91679",
      "subject": "ATTACK:enterprise:S0484",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--dacff5f4-a7ed-424b-847b-377ed2b91679",
      "modified": "2026-04-29T14:23:06.224Z",
      "references": [
        {
          "source_name": "Prevx Carberp March 2011",
          "url": "https://web.archive.org/web/20231227000328/http://pxnow.prevx.com/content/blog/carberp-a_modular_information_stealing_trojan.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--db46b437-c406-4c36-a0fe-bf1f2c32a6fe",
      "subject": "ATTACK:enterprise:S0182",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--db46b437-c406-4c36-a0fe-bf1f2c32a6fe",
      "modified": "2026-04-29T14:23:06.225Z",
      "references": [
        {
          "source_name": "Microsoft FinFisher March 2018",
          "url": "https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/"
        },
        {
          "source_name": "FinFisher Citation",
          "url": "https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--de70abfa-848f-4993-bdb8-7235d4a3d720",
      "subject": "ATTACK:enterprise:S0450",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--de70abfa-848f-4993-bdb8-7235d4a3d720",
      "modified": "2026-04-29T14:23:06.229Z",
      "references": [
        {
          "source_name": "TrendMicro POWERSTATS V3 June 2019",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--de9ac4ba-9e06-4704-9549-b3c59882bdb2",
      "subject": "ATTACK:enterprise:S1183",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--de9ac4ba-9e06-4704-9549-b3c59882bdb2",
      "modified": "2026-04-29T14:23:06.229Z",
      "references": [
        {
          "source_name": "IBM StrelaStealer 2024",
          "url": "https://securityintelligence.com/x-force/strela-stealer-todays-invoice-tomorrows-phish/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--dea3c118-57a6-4ce2-b8f2-01cb6e417d6d",
      "subject": "ATTACK:enterprise:S9059",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--dea3c118-57a6-4ce2-b8f2-01cb6e417d6d",
      "modified": "2026-09-28T18:46:41.344Z",
      "references": [
        {
          "source_name": "Mandiant_UNC1549_Feb2024",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e07c827b-aa0a-4cc5-b1ff-a2905bc99027",
      "subject": "ATTACK:enterprise:S9025",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e07c827b-aa0a-4cc5-b1ff-a2905bc99027",
      "modified": "2026-04-29T14:23:06.231Z",
      "references": [
        {
          "source_name": "Trend Micro Earth Kasha NOV 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e08f461a-7ebb-41e8-8e97-9ade8f52e4e2",
      "subject": "ATTACK:enterprise:G1020",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e08f461a-7ebb-41e8-8e97-9ade8f52e4e2",
      "modified": "2026-07-31T18:47:37.925Z",
      "references": [
        {
          "source_name": "Microsoft Ransomware as a Service",
          "url": "https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e0dc0d73-4e0a-46a6-8100-0c231eba58a5",
      "subject": "ATTACK:enterprise:S1147",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e0dc0d73-4e0a-46a6-8100-0c231eba58a5",
      "modified": "2026-04-29T14:23:06.232Z",
      "references": [
        {
          "source_name": "ESET EvasivePanda 2024",
          "url": "https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e11c02c8-e740-489f-925f-33c05c94c80f",
      "subject": "ATTACK:enterprise:S0547",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e11c02c8-e740-489f-925f-33c05c94c80f",
      "modified": "2026-04-29T14:23:06.232Z",
      "references": [
        {
          "source_name": "Cybereason Molerats Dec 2020",
          "url": "https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e20b57e5-c010-4b9e-a04e-660daa8b5c87",
      "subject": "ATTACK:enterprise:G0054",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e20b57e5-c010-4b9e-a04e-660daa8b5c87",
      "modified": "2026-07-31T18:48:21.386Z",
      "references": [
        {
          "source_name": "Symantec Sowbug Nov 2017",
          "url": "https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e24411cf-6274-4b6b-87b4-b90b01146c8d",
      "subject": "ATTACK:enterprise:G0102",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e24411cf-6274-4b6b-87b4-b90b01146c8d",
      "modified": "2026-07-31T20:48:50.577Z",
      "references": [
        {
          "source_name": "Mandiant FIN12 Oct 2021",
          "url": "https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"
        },
        {
          "source_name": "DFIR Ryuk's Return October 2020",
          "url": "https://thedfirreport.com/2020/10/08/ryuks-return/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e2675622-ec8e-4894-9f5e-3c82944e3019",
      "subject": "ATTACK:enterprise:G0010",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e2675622-ec8e-4894-9f5e-3c82944e3019",
      "modified": "2026-07-31T18:48:04.373Z",
      "references": [
        {
          "source_name": "Kaspersky Turla",
          "url": "https://securelist.com/the-epic-turla-operation/65545/"
        },
        {
          "source_name": "ESET ComRAT May 2020",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e27622dc-aa7a-46c3-9314-8a7baa0db3bf",
      "subject": "ATTACK:enterprise:C0046",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e27622dc-aa7a-46c3-9314-8a7baa0db3bf",
      "modified": "2026-07-31T18:47:29.227Z",
      "references": [
        {
          "source_name": "CCCS ArcaneDoor 2024",
          "url": "https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e2b67455-4986-46f4-a4ff-f5ee215ef998",
      "subject": "ATTACK:enterprise:S0587",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e2b67455-4986-46f4-a4ff-f5ee215ef998",
      "modified": "2026-04-29T14:23:06.234Z",
      "references": [
        {
          "source_name": "Leonardo Turla Penquin May 2020",
          "url": "https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e2e35a7a-3057-4955-9e7e-c3972e0ad423",
      "subject": "ATTACK:enterprise:S0198",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e2e35a7a-3057-4955-9e7e-c3972e0ad423",
      "modified": "2026-04-29T14:23:06.234Z",
      "references": [
        {
          "source_name": "McAfee Netwire Mar 2015",
          "url": "https://securingtomorrow.mcafee.com/mcafee-labs/netwire-rat-behind-recent-targeted-attacks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e3542e4e-6c4d-468a-b11e-462e35dc33f6",
      "subject": "ATTACK:enterprise:S0431",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e3542e4e-6c4d-468a-b11e-462e35dc33f6",
      "modified": "2026-04-29T14:23:06.235Z",
      "references": [
        {
          "source_name": "US-CERT HOTCROISSANT February 2020",
          "url": "https://www.us-cert.gov/ncas/analysis-reports/ar20-045d"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e38f9a94-155a-485c-bed6-c745b07a54d9",
      "subject": "ATTACK:enterprise:C0035",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e38f9a94-155a-485c-bed6-c745b07a54d9",
      "modified": "2026-07-31T18:47:18.554Z",
      "references": [
        {
          "source_name": "Lumen KVBotnet 2023",
          "url": "https://blog.lumen.com/routers-roasting-on-an-open-firewall-the-kv-botnet-investigation/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e391c03a-9ef4-436f-8ab5-2c15168c9551",
      "subject": "ATTACK:enterprise:S0344",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e391c03a-9ef4-436f-8ab5-2c15168c9551",
      "modified": "2026-04-29T14:23:06.235Z",
      "references": [
        {
          "source_name": "Unit42 Azorult Nov 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/11/unit42-new-wine-old-bottle-new-azorult-variant-found-findmyname-campaign-using-fallout-exploit-kit/"
        },
        {
          "source_name": "Proofpoint Azorult July 2018",
          "url": "https://www.proofpoint.com/us/threat-insight/post/new-version-azorult-stealer-improves-loading-features-spreads-alongside"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e452a193-b1a0-40b6-af3e-a734859fcf0b",
      "subject": "ATTACK:enterprise:S1186",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e452a193-b1a0-40b6-af3e-a734859fcf0b",
      "modified": "2026-04-29T14:23:06.236Z",
      "references": [
        {
          "source_name": "Cisco ArcaneDoor 2024",
          "url": "https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e5b20ee8-7af4-41a4-ac76-622a55a37e13",
      "subject": "ATTACK:enterprise:S1148",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e5b20ee8-7af4-41a4-ac76-622a55a37e13",
      "modified": "2026-04-29T14:23:06.238Z",
      "references": [
        {
          "source_name": "Sekoia Raccoon2 2022",
          "url": "https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis/"
        },
        {
          "source_name": "S2W Racoon 2022",
          "url": "https://medium.com/s2wblog/raccoon-stealer-is-back-with-a-new-version-5f436e04b20d"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e8068ad2-97b3-4693-a6ad-a8ee9a272890",
      "subject": "ATTACK:enterprise:G0040",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e8068ad2-97b3-4693-a6ad-a8ee9a272890",
      "modified": "2026-07-31T20:48:26.488Z",
      "references": [
        {
          "source_name": "Cymmetria Patchwork",
          "url": "https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"
        },
        {
          "source_name": "TrendMicro Patchwork Dec 2017",
          "url": "https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ea41718b-4215-43d4-8d1f-def88af935e3",
      "subject": "ATTACK:enterprise:G0112",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ea41718b-4215-43d4-8d1f-def88af935e3",
      "modified": "2026-09-02T18:52:47.199Z",
      "references": [
        {
          "source_name": "BlackBerry Bahamut",
          "url": "https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ea4c3651-b2a3-418e-8d3b-3c8075b988ef",
      "subject": "ATTACK:enterprise:S0043",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ea4c3651-b2a3-418e-8d3b-3c8075b988ef",
      "modified": "2026-04-29T14:23:06.244Z",
      "references": [
        {
          "source_name": "FireEye admin@338",
          "url": "https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--eade28d3-c5ce-453e-8e57-3262167c30be",
      "subject": "ATTACK:enterprise:S0257",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--eade28d3-c5ce-453e-8e57-3262167c30be",
      "modified": "2026-04-29T14:23:06.245Z",
      "references": [
        {
          "source_name": "Unit 42 VERMIN Jan 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--eb85fa2e-3c50-4130-9717-8688237fecbc",
      "subject": "ATTACK:enterprise:G0018",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--eb85fa2e-3c50-4130-9717-8688237fecbc",
      "modified": "2026-07-31T18:47:39.739Z",
      "references": [
        {
          "source_name": "FireEye admin@338",
          "url": "https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ec362b37-1a64-4b28-8d34-7819d0aa5b2a",
      "subject": "ATTACK:enterprise:S0161",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ec362b37-1a64-4b28-8d34-7819d0aa5b2a",
      "modified": "2026-04-29T14:23:06.246Z",
      "references": [
        {
          "source_name": "XAgentOSX 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ec3f88b1-ba85-497f-91d0-3eb8dcc5c4f1",
      "subject": "ATTACK:enterprise:S0228",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ec3f88b1-ba85-497f-91d0-3eb8dcc5c4f1",
      "modified": "2026-04-29T14:23:06.246Z",
      "references": [
        {
          "source_name": "Proofpoint Leviathan Oct 2017",
          "url": "https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ec85433f-2635-4e7c-af49-6dbfb269dbbd",
      "subject": "ATTACK:enterprise:S0196",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ec85433f-2635-4e7c-af49-6dbfb269dbbd",
      "modified": "2026-04-29T14:23:06.247Z",
      "references": [
        {
          "source_name": "Morphisec ShellTea June 2019",
          "url": "http://blog.morphisec.com/security-alert-fin8-is-back"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ecb55914-837c-4600-a0f8-65d83d2d726b",
      "subject": "ATTACK:enterprise:S0673",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ecb55914-837c-4600-a0f8-65d83d2d726b",
      "modified": "2026-04-29T14:23:06.247Z",
      "references": [
        {
          "source_name": "Prevailion DarkWatchman 2021",
          "url": "https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ed1aa5fa-7f0e-4d87-b3f5-7b50ab01e34b",
      "subject": "ATTACK:enterprise:S0219",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ed1aa5fa-7f0e-4d87-b3f5-7b50ab01e34b",
      "modified": "2026-04-29T14:23:06.248Z",
      "references": [
        {
          "source_name": "FireEye APT37 Feb 2018",
          "url": "https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ed2e17b5-171b-4878-a3ab-2b70e8ca132a",
      "subject": "ATTACK:enterprise:S0124",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ed2e17b5-171b-4878-a3ab-2b70e8ca132a",
      "modified": "2026-04-29T14:23:06.248Z",
      "references": [
        {
          "source_name": "Palo Alto DNS Requests",
          "url": "http://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--edbd751e-29ad-419f-a3ff-9d210453351d",
      "subject": "ATTACK:enterprise:S0172",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--edbd751e-29ad-419f-a3ff-9d210453351d",
      "modified": "2026-04-29T14:23:06.249Z",
      "references": [
        {
          "source_name": "Palo Alto Reaver Nov 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ee466042-fd08-4c86-898d-63fc5d4ed1d6",
      "subject": "ATTACK:enterprise:S0631",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ee466042-fd08-4c86-898d-63fc5d4ed1d6",
      "modified": "2026-04-29T14:23:06.249Z",
      "references": [
        {
          "source_name": "Cybereason Chaes Nov 2020",
          "url": "https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--eeb8635c-0297-470c-a66c-56f8e30c771e",
      "subject": "ATTACK:enterprise:S1153",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--eeb8635c-0297-470c-a66c-56f8e30c771e",
      "modified": "2026-04-29T14:23:06.250Z",
      "references": [
        {
          "source_name": "Kandji Cuckoo April 2024",
          "url": "https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware"
        },
        {
          "source_name": "SentinelOne Cuckoo Stealer May 2024",
          "url": "https://www.sentinelone.com/blog/macos-cuckoo-stealer-ensuring-detection-and-defense-as-new-samples-rapidly-emerge/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--eed367b8-b1d1-492e-a376-6725b6db7103",
      "subject": "ATTACK:enterprise:S0632",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--eed367b8-b1d1-492e-a376-6725b6db7103",
      "modified": "2026-04-29T14:23:06.250Z",
      "references": [
        {
          "source_name": "Group IB GrimAgent July 2021",
          "url": "https://www.group-ib.com/blog/grimagent/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ef6d08c0-e9dd-45e1-b5ce-42cd5731f2ab",
      "subject": "ATTACK:enterprise:S0353",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ef6d08c0-e9dd-45e1-b5ce-42cd5731f2ab",
      "modified": "2026-04-29T14:23:06.251Z",
      "references": [
        {
          "source_name": "Unit 42 NOKKI Sept 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--efa41e3c-752a-43e4-81e4-dfac1dbd75a3",
      "subject": "ATTACK:enterprise:G1051",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--efa41e3c-752a-43e4-81e4-dfac1dbd75a3",
      "modified": "2026-07-31T18:48:11.187Z",
      "references": [
        {
          "source_name": "CISA Medusa Group Medusa Ransomware March 2025",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--efa98949-4b58-4407-8fa2-366c06dc2ed9",
      "subject": "ATTACK:enterprise:S0089",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--efa98949-4b58-4407-8fa2-366c06dc2ed9",
      "modified": "2026-04-29T14:23:06.251Z",
      "references": [
        {
          "source_name": "F-Secure BlackEnergy 2014",
          "url": "https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf"
        },
        {
          "source_name": "Securelist BlackEnergy Nov 2014",
          "url": "https://securelist.com/be2-custom-plugins-router-abuse-and-target-profiles/67353/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--efbe5efa-6863-4334-90e5-d7caab9806a6",
      "subject": "ATTACK:enterprise:G0038",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--efbe5efa-6863-4334-90e5-d7caab9806a6",
      "modified": "2026-07-31T18:48:07.459Z",
      "references": [
        {
          "source_name": "Citizen Lab Stealth Falcon May 2016",
          "url": "https://citizenlab.org/2016/05/stealth-falcon/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f068a0fc-0461-4034-a0ea-b629788bc9f3",
      "subject": "ATTACK:enterprise:S0641",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f068a0fc-0461-4034-a0ea-b629788bc9f3",
      "modified": "2026-04-29T14:23:06.252Z",
      "references": [
        {
          "source_name": "ESET Kobalos Jan 2021",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f0a74237-9a46-4ea8-a268-3ac87f593ea9",
      "subject": "ATTACK:enterprise:S0554",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f0a74237-9a46-4ea8-a268-3ac87f593ea9",
      "modified": "2026-04-29T14:23:06.252Z",
      "references": [
        {
          "source_name": "JoeSecurity Egregor 2020",
          "url": "https://www.joesandbox.com/analysis/326673/0/pdf"
        },
        {
          "source_name": "NHS Digital Egregor Nov 2020",
          "url": "https://digital.nhs.uk/cyber-alerts/2020/cc-3681#summary"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f14c6ecd-4997-44aa-9d29-232195fd4a82",
      "subject": "ATTACK:enterprise:S0216",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f14c6ecd-4997-44aa-9d29-232195fd4a82",
      "modified": "2026-04-29T14:23:06.253Z",
      "references": [
        {
          "source_name": "FireEye APT37 Feb 2018",
          "url": "https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f19234f6-5b59-4229-aae1-70df380a076a",
      "subject": "ATTACK:enterprise:S0093",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f19234f6-5b59-4229-aae1-70df380a076a",
      "modified": "2026-04-29T14:23:06.254Z",
      "references": [
        {
          "source_name": "Symantec Dragonfly",
          "url": "https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"
        },
        {
          "source_name": "Gigamon Berserk Bear October 2021",
          "url": "https://vblocalhost.com/uploads/VB2021-Slowik.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f36f0a5d-a2a6-440f-8d6f-3fbdafb07af0",
      "subject": "ATTACK:enterprise:S0483",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f36f0a5d-a2a6-440f-8d6f-3fbdafb07af0",
      "modified": "2026-04-29T14:23:06.256Z",
      "references": [
        {
          "source_name": "DFIR_Quantum_Ransomware",
          "url": "https://thedfirreport.com/2022/04/25/quantum-ransomware/"
        },
        {
          "source_name": "IBM IcedID November 2017",
          "url": "https://securityintelligence.com/new-banking-trojan-icedid-discovered-by-ibm-x-force-research/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f3e4b47e-cde3-4f27-85b7-464b02325ee6",
      "subject": "ATTACK:enterprise:S0241",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f3e4b47e-cde3-4f27-85b7-464b02325ee6",
      "modified": "2026-04-29T14:23:06.256Z",
      "references": [
        {
          "source_name": "Lazarus RATANKBA",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-campaign-targeting-cryptocurrencies-reveals-remote-controller-tool-evolved-ratankba/"
        },
        {
          "source_name": "RATANKBA",
          "url": "https://www.trendmicro.com/en_us/research/17/b/ratankba-watering-holes-against-enterprises.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f619f10a-a579-49a6-a64f-80be117eea94",
      "subject": "ATTACK:enterprise:S1121",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f619f10a-a579-49a6-a64f-80be117eea94",
      "modified": "2026-04-29T14:23:06.259Z",
      "references": [
        {
          "source_name": "Mandiant Cutting Edge Part 3 February 2024",
          "url": "https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f6208ff3-bf0a-4461-bb60-bc6c58cb9e49",
      "subject": "ATTACK:enterprise:S1212",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f6208ff3-bf0a-4461-bb60-bc6c58cb9e49",
      "modified": "2026-04-29T14:23:06.259Z",
      "references": [
        {
          "source_name": "Group-IB RansomHub FEB 2025",
          "url": "https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f65ea007-e6e0-4311-a766-4ca60f17a79f",
      "subject": "ATTACK:enterprise:G1036",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f65ea007-e6e0-4311-a766-4ca60f17a79f",
      "modified": "2026-07-31T18:48:25.120Z",
      "references": [
        {
          "source_name": "Microsoft Moonstone Sleet 2024",
          "url": "https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f6f600fd-796d-4f1f-b2c6-0ca283b2cdb1",
      "subject": "ATTACK:enterprise:S0534",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f6f600fd-796d-4f1f-b2c6-0ca283b2cdb1",
      "modified": "2026-04-29T14:23:06.261Z",
      "references": [
        {
          "source_name": "Cybereason Bazar July 2020",
          "url": "https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"
        },
        {
          "source_name": "NCC Group Team9 June 2020",
          "url": "https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f7f1c7c3-192b-4675-815d-0a61b3e3a206",
      "subject": "ATTACK:enterprise:G0034",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f7f1c7c3-192b-4675-815d-0a61b3e3a206",
      "modified": "2026-07-31T20:48:33.423Z",
      "references": [
        {
          "source_name": "ESET Telebots July 2017",
          "url": "https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/"
        },
        {
          "source_name": "US District Court Indictment GRU Unit 74455 October 2020",
          "url": "https://www.justice.gov/opa/press-release/file/1328521/download"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f865403f-5b4a-4e5a-bb50-8d416ad36db4",
      "subject": "ATTACK:enterprise:G0004",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f865403f-5b4a-4e5a-bb50-8d416ad36db4",
      "modified": "2026-07-31T18:48:01.899Z",
      "references": [
        {
          "source_name": "Mandiant Operation Ke3chang November 2014",
          "url": "https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"
        },
        {
          "source_name": "NCC Group APT15 Alive and Strong",
          "url": "https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"
        },
        {
          "source_name": "Microsoft NICKEL December 2021",
          "url": "https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f8a9e39a-0038-437c-96ad-4408d028dd86",
      "subject": "ATTACK:enterprise:S0533",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f8a9e39a-0038-437c-96ad-4408d028dd86",
      "modified": "2026-04-29T14:23:06.263Z",
      "references": [
        {
          "source_name": "CISA MAR SLOTHFULMEDIA October 2020",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f93060a3-7c58-444f-a45e-1386c289cee6",
      "subject": "ATTACK:enterprise:S0680",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f93060a3-7c58-444f-a45e-1386c289cee6",
      "modified": "2026-04-29T14:23:06.263Z",
      "references": [
        {
          "source_name": "Kaspersky WIRTE November 2021",
          "url": "https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f99c66b5-df6f-4097-b72b-82bbe3f5fe02",
      "subject": "ATTACK:enterprise:S9041",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f99c66b5-df6f-4097-b72b-82bbe3f5fe02",
      "modified": "2026-07-29T22:38:33.840Z",
      "references": [
        {
          "source_name": "Aqua Security Blog Trivy Compromise APR 2026",
          "url": "https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"
        },
        {
          "source_name": "Wiz Trivy Compromise MAR 2026",
          "url": "https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f9bf12c3-7512-47fe-86d7-cc89662abad4",
      "subject": "ATTACK:enterprise:S0351",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f9bf12c3-7512-47fe-86d7-cc89662abad4",
      "modified": "2026-04-29T14:23:06.264Z",
      "references": [
        {
          "source_name": "Unit42 Cannon Nov 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"
        },
        {
          "source_name": "Unit42 Sofacy Dec 2018",
          "url": "https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f9c5fdd4-4978-433f-a718-f8f512e13cac",
      "subject": "ATTACK:enterprise:S0105",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f9c5fdd4-4978-433f-a718-f8f512e13cac",
      "modified": "2026-04-29T14:23:06.264Z",
      "references": [
        {
          "source_name": "Mandiant APT41",
          "url": "https://www.mandiant.com/resources/apt41-us-state-governments"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fbcc97eb-3768-4c8f-b00e-eb84a69fc0da",
      "subject": "ATTACK:enterprise:S9024",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fbcc97eb-3768-4c8f-b00e-eb84a69fc0da",
      "modified": "2026-04-29T14:23:06.267Z",
      "references": [
        {
          "source_name": "Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fbe4387a-5e79-45e0-aae1-9b3a53dcd3ee",
      "subject": "ATTACK:enterprise:S0692",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fbe4387a-5e79-45e0-aae1-9b3a53dcd3ee",
      "modified": "2026-04-29T14:23:06.267Z",
      "references": [
        {
          "source_name": "GitHub SILENTTRINITY Modules July 2019",
          "url": "https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fbf97550-8c44-4b68-8c99-8a61dfae4947",
      "subject": "ATTACK:enterprise:S9053",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fbf97550-8c44-4b68-8c99-8a61dfae4947",
      "modified": "2026-09-24T22:25:17.045Z",
      "references": [
        {
          "source_name": "CheckPoint_NimbusManticoreEurope_Sept2025",
          "url": "https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fbfc610a-5355-40fc-b5a1-059e89a1eb8d",
      "subject": "ATTACK:enterprise:S0058",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fbfc610a-5355-40fc-b5a1-059e89a1eb8d",
      "modified": "2026-04-29T14:23:06.267Z",
      "references": [
        {
          "source_name": "Baumgartner Naikon 2015",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fc4c0c44-2e94-47c1-9174-fcf0fa1a80b4",
      "subject": "ATTACK:enterprise:S0473",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fc4c0c44-2e94-47c1-9174-fcf0fa1a80b4",
      "modified": "2026-04-29T14:23:06.267Z",
      "references": [
        {
          "source_name": "Trend Micro Tick November 2019",
          "url": "https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fcad9dc8-fa79-491e-91ec-35a2a9cd55e8",
      "subject": "ATTACK:enterprise:S1059",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fcad9dc8-fa79-491e-91ec-35a2a9cd55e8",
      "modified": "2026-04-29T14:23:06.268Z",
      "references": [
        {
          "source_name": "SentinelLabs Metador Technical Appendix Sept 2022",
          "url": "https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fdd492a3-197b-4663-95c6-25d972dd7088",
      "subject": "ATTACK:enterprise:C0007",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fdd492a3-197b-4663-95c6-25d972dd7088",
      "modified": "2026-07-31T18:47:27.632Z",
      "references": [
        {
          "source_name": "Bitdefender FunnyDream Campaign November 2020",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fe786b29-e621-48e2-84b5-aed35e6930fe",
      "subject": "ATTACK:enterprise:S0176",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fe786b29-e621-48e2-84b5-aed35e6930fe",
      "modified": "2026-04-29T14:23:06.270Z",
      "references": [
        {
          "source_name": "Microsoft SIR Vol 21",
          "url": "http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fe865909-091d-42cd-82a1-5cfc5df38e4d",
      "subject": "ATTACK:enterprise:S1213",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fe865909-091d-42cd-82a1-5cfc5df38e4d",
      "modified": "2026-04-29T14:23:06.271Z",
      "references": [
        {
          "source_name": "TrendMicro LummaStealer 2025",
          "url": "https://www.trendmicro.com/en_us/research/25/a/lumma-stealers-github-based-delivery-via-mdr.html"
        },
        {
          "source_name": "Fortinet LummaStealer 2024",
          "url": "https://www.fortinet.com/blog/threat-research/lumma-variant-on-youtube"
        },
        {
          "source_name": "Cybereason LumaStealer Undated",
          "url": "https://www.cybereason.com/blog/threat-analysis-rise-of-lummastealer"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ff3ade9d-2665-4794-bb1e-cb436d790f3f",
      "subject": "ATTACK:enterprise:S0615",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ff3ade9d-2665-4794-bb1e-cb436d790f3f",
      "modified": "2026-04-29T14:23:06.271Z",
      "references": [
        {
          "source_name": "BlackBerry CostaRicto November 2020",
          "url": "https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ff57d2d8-095c-4f9b-bb57-bc0971bb6a8d",
      "subject": "ATTACK:enterprise:S1228",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ff57d2d8-095c-4f9b-bb57-bc0971bb6a8d",
      "modified": "2026-04-29T14:23:06.272Z",
      "references": [
        {
          "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
          "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
        },
        {
          "source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA",
          "url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"
        },
        {
          "source_name": "Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"
        },
        {
          "source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload",
          "url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    }
  ],
  "source_snapshot": {
    "file": "enterprise-attack-20.0.json",
    "url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
    "sha256": "81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352",
    "bytes": 55271014,
    "checked_at": "2026-10-16T03:31:39Z"
  },
  "notices_url": "https://aol.pm/source-notices.txt",
  "notices": "License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"
}

License
-------
The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,
development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce
MITRE's copyright designation and this license in any such copy.

"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation."

Disclaimers
-----------
MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part
of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover
full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or
variations on existing techniques not documented by ATT&CK.

ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE
ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,
AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT
THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR
FITNESS FOR A PARTICULAR PURPOSE.