{"record":{"id":"ATTACK:enterprise:T1083","title":"File and Directory Discovery","type":"Technique","source_url":"https://attack.mitre.org/techniques/T1083","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--7bc57495-ea59-4380-be31-a64af124ef18","external_id":"T1083","domain":"enterprise","created":"2017-05-31T21:31:04.710Z","modified":"2026-09-11T19:45:35.899Z","version":"1.7","aliases":[],"tactics":["discovery"],"source_references":[{"source_name":"Windows Commands JPCERT","url":"https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"},{"source_name":"US-CERT-TA18-106A","url":"https://www.us-cert.gov/ncas/alerts/TA18-106A"}]},"assertions":[{"id":"enterprise:relationship--007cc21a-685a-4701-99c1-20f258cedc7c","subject":"ATTACK:enterprise:S0069","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--007cc21a-685a-4701-99c1-20f258cedc7c","modified":"2026-04-29T14:23:05.903Z","references":[{"source_name":"FireEye APT17","url":"https://web.archive.org/web/20240119213200/https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0188b7af-d060-4715-baf2-ad69333482dc","subject":"ATTACK:enterprise:S0229","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0188b7af-d060-4715-baf2-ad69333482dc","modified":"2026-04-29T14:23:05.905Z","references":[{"source_name":"Proofpoint Leviathan Oct 2017","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--01a01a28-19e5-4e32-8a24-a98f2b69ced5","subject":"ATTACK:enterprise:S0438","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--01a01a28-19e5-4e32-8a24-a98f2b69ced5","modified":"2026-04-29T14:23:05.905Z","references":[{"source_name":"ESET Attor Oct 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--03ab3120-4c6e-4de2-982a-fe22d466f748","subject":"ATTACK:enterprise:S0136","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--03ab3120-4c6e-4de2-982a-fe22d466f748","modified":"2026-04-29T14:23:05.908Z","references":[{"source_name":"ESET Sednit USBStealer 2014","url":"http://www.welivesecurity.com/2014/11/11/sednit-espionage-group-attacking-air-gapped-networks/"},{"source_name":"Kaspersky Sofacy","url":"https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--03b12a66-789a-4480-8903-deab828d08b6","subject":"ATTACK:enterprise:S0461","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--03b12a66-789a-4480-8903-deab828d08b6","modified":"2026-04-29T14:23:05.908Z","references":[{"source_name":"Proofpoint TA505 October 2019","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0449fd1f-35ee-4c99-ac63-716da2a2276d","subject":"ATTACK:enterprise:S9043","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0449fd1f-35ee-4c99-ac63-716da2a2276d","modified":"2026-07-29T19:33:21.870Z","references":[{"source_name":"Hunt.io TeamPCP Toolkit MAY 2026","url":"https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--05282a2d-21c6-4150-94e0-d57c2f84c887","subject":"ATTACK:enterprise:S0599","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--05282a2d-21c6-4150-94e0-d57c2f84c887","modified":"2026-04-29T14:23:05.910Z","references":[{"source_name":"Aqua Kinsing April 2020","url":"https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--062059e8-21cb-4030-8244-ce7f6643e3c9","subject":"ATTACK:enterprise:S1025","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--062059e8-21cb-4030-8244-ce7f6643e3c9","modified":"2026-04-29T14:23:05.911Z","references":[{"source_name":"Korean FSI TA505 2020","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--06ab6825-89f4-4bb7-8c82-ae9a5d4cdf61","subject":"ATTACK:enterprise:S1065","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--06ab6825-89f4-4bb7-8c82-ae9a5d4cdf61","modified":"2026-04-29T14:23:05.912Z","references":[{"source_name":"MalwareBytes WoodyRAT Aug 2022","url":"https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--07702379-2d40-48ae-a077-d68e0da5e4be","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--07702379-2d40-48ae-a077-d68e0da5e4be","modified":"2026-04-29T14:23:05.913Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source_name":"CIRCL PlugX March 2013","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"},{"source_name":"DOJ Affidavit Search and Seizure PlugX December 2024","url":"https://www.justice.gov/archives/opa/media/1384136/dl"},{"source_name":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"},{"source_name":"Sophos Mustang Panda PLUGX","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--079b3956-d020-4b9d-a230-e43b391e261f","subject":"ATTACK:enterprise:S1129","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--079b3956-d020-4b9d-a230-e43b391e261f","modified":"2026-04-29T14:23:05.914Z","references":[{"source_name":"Kersten Akira 2023","url":"https://www.trellix.com/blogs/research/akira-ransomware/"},{"source_name":"Cisco Akira Ransomware OCT 2024","url":"https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--084ac639-2502-4020-8938-65352349acbb","subject":"ATTACK:enterprise:S0180","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--084ac639-2502-4020-8938-65352349acbb","modified":"2026-04-29T14:23:05.915Z","references":[{"source_name":"US-CERT Volgmer Nov 2017","url":"https://www.us-cert.gov/ncas/alerts/TA17-318B"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--08a444cf-9159-4f35-aa4a-691a434940e5","subject":"ATTACK:enterprise:S9031","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--08a444cf-9159-4f35-aa4a-691a434940e5","modified":"2026-04-29T14:23:05.915Z","references":[{"source_name":"Palo Alto Ashen Lepus DEC 2025","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0925dc87-1a47-4248-ad5b-316f5a1ce22a","subject":"ATTACK:enterprise:G1017","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0925dc87-1a47-4248-ad5b-316f5a1ce22a","modified":"2026-07-31T18:47:39.574Z","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--093bc793-3edd-4096-bd7b-aeb5c855128b","subject":"ATTACK:enterprise:S0598","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--093bc793-3edd-4096-bd7b-aeb5c855128b","modified":"2026-04-29T14:23:05.916Z","references":[{"source_name":"ANSSI Sandworm January 2021","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0a2c9965-291c-4724-829b-3cd5e8b26b58","subject":"ATTACK:enterprise:S0534","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0a2c9965-291c-4724-829b-3cd5e8b26b58","modified":"2026-04-29T14:23:05.917Z","references":[{"source_name":"Cybereason Bazar July 2020","url":"https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"},{"source_name":"NCC Group Team9 June 2020","url":"https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0c53d506-c557-43be-99e2-04a907341c8a","subject":"ATTACK:enterprise:G1052","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0c53d506-c557-43be-99e2-04a907341c8a","modified":"2026-07-31T18:47:54.262Z","references":[{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0c75b350-2996-47f8-9e01-38b7cf53481c","subject":"ATTACK:enterprise:G1048","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0c75b350-2996-47f8-9e01-38b7cf53481c","modified":"2026-07-31T18:47:53.321Z","references":[{"source_name":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"},{"source_name":"Google Cloud Threat Intelligence ESXi VIBs 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0d8aa058-426a-45c9-af5b-898746ae5862","subject":"ATTACK:enterprise:S0115","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0d8aa058-426a-45c9-af5b-898746ae5862","modified":"2026-04-29T14:23:05.922Z","references":[{"source_name":"Kaspersky Transparent Tribe August 2020","url":"https://securelist.com/transparent-tribe-part-1/98127/"},{"source_name":"Proofpoint Operation Transparent Tribe March 2016","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"},{"source_name":"Cisco Talos Transparent Tribe Education Campaign July 2022","url":"https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0dba319b-0d1e-4c73-8153-9ce13d27c98c","subject":"ATTACK:enterprise:S0242","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0dba319b-0d1e-4c73-8153-9ce13d27c98c","modified":"2026-04-29T14:23:05.922Z","references":[{"source_name":"SecureList SynAck Doppelgänging May 2018","url":"https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/"},{"source_name":"Kaspersky Lab SynAck May 2018","url":"https://usa.kaspersky.com/about/press-releases/2018_synack-doppelganging"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0e89ca75-b73e-476e-b56d-1cf815fa7868","subject":"ATTACK:enterprise:G0040","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0e89ca75-b73e-476e-b56d-1cf815fa7868","modified":"2026-07-31T20:48:26.149Z","references":[{"source_name":"Cymmetria Patchwork","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"},{"source_name":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0efa0a7a-545d-49e2-b0c4-0e251226404a","subject":"ATTACK:enterprise:G0054","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0efa0a7a-545d-49e2-b0c4-0e251226404a","modified":"2026-07-31T18:48:21.180Z","references":[{"source_name":"Symantec Sowbug Nov 2017","url":"https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0efc2bef-9227-4af2-b73b-bfa61a3073aa","subject":"ATTACK:enterprise:S0248","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0efc2bef-9227-4af2-b73b-bfa61a3073aa","modified":"2026-04-29T14:23:05.924Z","references":[{"source_name":"ASERT Donot March 2018","url":"https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1039ed0e-216f-4eef-9a7e-c4eaa3ca0152","subject":"ATTACK:enterprise:S0586","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1039ed0e-216f-4eef-9a7e-c4eaa3ca0152","modified":"2026-04-29T14:23:05.926Z","references":[{"source_name":"CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--10619fa8-c479-4b61-9aac-ee08f00114d1","subject":"ATTACK:enterprise:S0064","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--10619fa8-c479-4b61-9aac-ee08f00114d1","modified":"2026-04-29T14:23:05.926Z","references":[{"source_name":"FireEye EPS Awakens Part 2","url":"https://web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--12e62986-c406-4767-9cc5-49d05c5c34b7","subject":"ATTACK:enterprise:S1042","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--12e62986-c406-4767-9cc5-49d05c5c34b7","modified":"2026-04-29T14:23:05.930Z","references":[{"source_name":"Mandiant UNC3890 Aug 2022","url":"https://www.mandiant.com/resources/blog/suspected-iranian-actor-targeting-israeli-shipping"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--135fb6c4-1f42-42ce-b323-22e57ae4fbc6","subject":"ATTACK:enterprise:C0015","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--135fb6c4-1f42-42ce-b323-22e57ae4fbc6","modified":"2026-07-31T18:47:25.188Z","references":[{"source_name":"DFIR Conti Bazar Nov 2021","url":"https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--13b78b09-00b6-4307-87b7-7cd8c9360b39","subject":"ATTACK:enterprise:S0410","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--13b78b09-00b6-4307-87b7-7cd8c9360b39","modified":"2026-04-29T14:23:05.931Z","references":[{"source_name":"Fysbis Dr Web Analysis","url":"https://vms.drweb.com/virus/?i=4276269"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--147e009d-48db-40bc-999c-70aa1e770a0c","subject":"ATTACK:enterprise:S0125","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--147e009d-48db-40bc-999c-70aa1e770a0c","modified":"2026-04-29T14:23:05.932Z","references":[{"source_name":"Symantec Remsec IOCs","url":"http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/Symantec_Remsec_IOCs.pdf"},{"source_name":"Kaspersky ProjectSauron Full Report","url":"https://securelist.com/files/2016/07/The-ProjectSauron-APT_research_KL.pdf"},{"source_name":"Kaspersky ProjectSauron Technical Analysis","url":"https://securelist.com/files/2016/07/The-ProjectSauron-APT_Technical_Analysis_KL.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1530b5b9-a559-42ac-a668-8133cb18e944","subject":"ATTACK:enterprise:S0607","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1530b5b9-a559-42ac-a668-8133cb18e944","modified":"2026-04-29T14:23:05.933Z","references":[{"source_name":"Trend Micro KillDisk 2","url":"https://www.trendmicro.com/en_us/research/18/a/new-killdisk-variant-hits-financial-organizations-in-latin-america.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--15cde143-4ede-475f-9b8c-813d6c23083a","subject":"ATTACK:enterprise:S1245","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--15cde143-4ede-475f-9b8c-813d6c23083a","modified":"2026-04-29T14:23:05.934Z","references":[{"source_name":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"},{"source_name":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--15fd646c-172b-4458-945a-69a07a5648bb","subject":"ATTACK:enterprise:C0006","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--15fd646c-172b-4458-945a-69a07a5648bb","modified":"2026-07-31T18:47:20.488Z","references":[{"source_name":"McAfee Honeybee","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--165b726a-1e4c-49ce-af28-92586883dcdf","subject":"ATTACK:enterprise:S1247","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--165b726a-1e4c-49ce-af28-92586883dcdf","modified":"2026-04-29T14:23:05.934Z","references":[{"source_name":"Cyble Embargo Ransomware May 2024","url":"https://cyble.com/blog/the-rust-revolution-new-embargo-ransomware-steps-in/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1684e405-53bd-4951-a26d-e7c39887b06a","subject":"ATTACK:enterprise:S0059","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1684e405-53bd-4951-a26d-e7c39887b06a","modified":"2026-04-29T14:23:05.935Z","references":[{"source_name":"Baumgartner Naikon 2015","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--16b915ff-7bf5-4032-b39a-9c8073847d77","subject":"ATTACK:enterprise:G0047","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--16b915ff-7bf5-4032-b39a-9c8073847d77","modified":"2026-07-31T18:47:47.365Z","references":[{"source_name":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source_name":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source_name":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"},{"source_name":"Unit 42 Gamaredon February 2022","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--17a2eeb2-2221-4292-b584-d39d19a6409f","subject":"ATTACK:enterprise:S0647","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--17a2eeb2-2221-4292-b584-d39d19a6409f","modified":"2026-04-29T14:23:05.936Z","references":[{"source_name":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--17c43eed-f8a2-42cb-8f0a-f31978e9e351","subject":"ATTACK:enterprise:S0216","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--17c43eed-f8a2-42cb-8f0a-f31978e9e351","modified":"2026-04-29T14:23:05.937Z","references":[{"source_name":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--19f512b8-6869-460d-97d8-7e1f9b3c51cb","subject":"ATTACK:enterprise:S0339","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--19f512b8-6869-460d-97d8-7e1f9b3c51cb","modified":"2026-04-29T14:23:05.940Z","references":[{"source_name":"Radware Micropsia July 2018","url":"https://www.radware.com/blog/security/2018/07/micropsia-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1a4c94a1-6362-42b3-b1d9-41ae3fbf5ea5","subject":"ATTACK:enterprise:S0083","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1a4c94a1-6362-42b3-b1d9-41ae3fbf5ea5","modified":"2026-04-29T14:23:05.940Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1a4f5197-ec9f-4607-984c-4a09978acd8e","subject":"ATTACK:enterprise:S0141","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1a4f5197-ec9f-4607-984c-4a09978acd8e","modified":"2026-04-29T14:23:05.940Z","references":[{"source_name":"Novetta Winnti April 2015","url":"https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1b3cc0cb-de43-405b-bfa5-f0bececabf8c","subject":"ATTACK:enterprise:S0049","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1b3cc0cb-de43-405b-bfa5-f0bececabf8c","modified":"2026-04-29T14:23:05.942Z","references":[{"source_name":"F-Secure The Dukes","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1c4fd1a5-c3a4-4f71-8310-785962dc65d4","subject":"ATTACK:enterprise:S0651","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1c4fd1a5-c3a4-4f71-8310-785962dc65d4","modified":"2026-04-29T14:23:05.943Z","references":[{"source_name":"Checkpoint IndigoZebra July 2021","url":"https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1c9b32f8-f78d-4580-b183-676c7203286d","subject":"ATTACK:enterprise:C0012","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1c9b32f8-f78d-4580-b183-676c7203286d","modified":"2026-07-31T18:47:28.161Z","references":[{"source_name":"Cybereason OperationCuckooBees May 2022","url":"https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-winnti-techniques"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1ca295b2-6865-4daf-a41f-e9333f0561bc","subject":"ATTACK:enterprise:S9039","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1ca295b2-6865-4daf-a41f-e9333f0561bc","modified":"2026-04-29T14:23:05.944Z","references":[{"source_name":"CERT Polska","url":"https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1daaea6e-527f-4c3d-9387-72ea68d7140d","subject":"ATTACK:enterprise:S0385","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1daaea6e-527f-4c3d-9387-72ea68d7140d","modified":"2026-04-29T14:23:05.945Z","references":[{"source_name":"Fidelis njRAT June 2013","url":"https://www.threatminer.org/_reports/2013/fta-1009---njrat-uncovered-1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1f5fcc10-0902-4395-8dff-0353f7ae6189","subject":"ATTACK:enterprise:S9063","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1f5fcc10-0902-4395-8dff-0353f7ae6189","modified":"2026-10-01T18:15:06.347Z","references":[{"source_name":"Mandiant_UNC1549_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1fbde0c8-1b00-40bf-8fef-11892d103d63","subject":"ATTACK:enterprise:S0048","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1fbde0c8-1b00-40bf-8fef-11892d103d63","modified":"2026-04-29T14:23:05.948Z","references":[{"source_name":"F-Secure The Dukes","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1fe64d85-29ca-4cf0-9b30-8d41ebad37fc","subject":"ATTACK:enterprise:S0466","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1fe64d85-29ca-4cf0-9b30-8d41ebad37fc","modified":"2026-04-29T14:23:05.948Z","references":[{"source_name":"objective-see windtail1 dec 2018","url":"https://objective-see.com/blog/blog_0x3B.html"},{"source_name":"objective-see windtail2 jan 2019","url":"https://objective-see.com/blog/blog_0x3D.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--204086ef-c546-47fd-8844-b8af57085f26","subject":"ATTACK:enterprise:G1051","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--204086ef-c546-47fd-8844-b8af57085f26","modified":"2026-07-31T18:48:10.093Z","references":[{"source_name":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source_name":"Security Scorecard Medusa Ransomware January 2024","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--21382ce2-a504-4adf-81d2-dc1306285553","subject":"ATTACK:enterprise:G0035","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--21382ce2-a504-4adf-81d2-dc1306285553","modified":"2026-07-31T20:48:28.386Z","references":[{"source_name":"CISA AA20-296A Berserk Bear December 2020","url":"https://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions"},{"source_name":"Gigamon Berserk Bear October 2021","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"},{"source_name":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--227abd66-91cc-436e-aad8-c1fb82691357","subject":"ATTACK:enterprise:S0347","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--227abd66-91cc-436e-aad8-c1fb82691357","modified":"2026-04-29T14:23:05.952Z","references":[{"source_name":"TrendMicro Lazarus Nov 2018","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-continues-heists-mounts-attacks-on-financial-organizations-in-latin-america/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--22a1c738-6d0f-4abd-b00c-ee0b37ba1db6","subject":"ATTACK:enterprise:S0659","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--22a1c738-6d0f-4abd-b00c-ee0b37ba1db6","modified":"2026-04-29T14:23:05.952Z","references":[{"source_name":"Fortinet Diavol July 2021","url":"https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--23149a27-cccf-4fb4-bc35-fc4ebf4c6664","subject":"ATTACK:enterprise:S0633","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--23149a27-cccf-4fb4-bc35-fc4ebf4c6664","modified":"2026-04-29T14:23:05.953Z","references":[{"source_name":"GitHub Sliver File System August 2021","url":"https://github.com/BishopFox/sliver/tree/master/client/command/filesystem"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--24ea53e3-a51f-4c4a-b3de-2e1d09ed69e8","subject":"ATTACK:enterprise:S0139","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--24ea53e3-a51f-4c4a-b3de-2e1d09ed69e8","modified":"2026-04-29T14:23:05.956Z","references":[{"source_name":"Volexity PowerDuke November 2016","url":"https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2597e12c-c342-4ca0-a235-b05752b2bfa5","subject":"ATTACK:enterprise:S0475","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2597e12c-c342-4ca0-a235-b05752b2bfa5","modified":"2026-04-29T14:23:05.956Z","references":[{"source_name":"Unit 42 BackConfig May 2020","url":"https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--25d926a0-d2b5-473d-b27b-fb69cf763b77","subject":"ATTACK:enterprise:S0239","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--25d926a0-d2b5-473d-b27b-fb69cf763b77","modified":"2026-04-29T14:23:05.957Z","references":[{"source_name":"US-CERT Bankshot Dec 2017","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-B_WHITE.PDF"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--262fe71a-a2d5-4624-ac50-5a76c0dd862e","subject":"ATTACK:enterprise:S1031","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--262fe71a-a2d5-4624-ac50-5a76c0dd862e","modified":"2026-04-29T14:23:05.957Z","references":[{"source_name":"Unit 42 PingPull Jun 2022","url":"https://unit42.paloaltonetworks.com/pingpull-gallium/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--26968975-5f01-4b4b-9cdc-ef3b76710304","subject":"ATTACK:enterprise:S0065","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--26968975-5f01-4b4b-9cdc-ef3b76710304","modified":"2026-04-29T14:23:05.957Z","references":[{"source_name":"CrowdStrike Putter Panda","url":"http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--27834043-1004-4a70-9023-a318bd6db7c6","subject":"ATTACK:enterprise:S0181","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--27834043-1004-4a70-9023-a318bd6db7c6","modified":"2026-04-29T14:23:05.959Z","references":[{"source_name":"US-CERT FALLCHILL Nov 2017","url":"https://www.us-cert.gov/ncas/alerts/TA17-318A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--27c7f9ed-dd66-4bc0-a186-2f05aac6d6df","subject":"ATTACK:enterprise:S0652","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--27c7f9ed-dd66-4bc0-a186-2f05aac6d6df","modified":"2026-04-29T14:23:05.959Z","references":[{"source_name":"Kaspersky Ferocious Kitten Jun 2021","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--291e908e-1d2e-4b29-a564-5a33149d1dbb","subject":"ATTACK:enterprise:S0091","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--291e908e-1d2e-4b29-a564-5a33149d1dbb","modified":"2026-04-29T14:23:05.961Z","references":[{"source_name":"Kaspersky Turla","url":"https://securelist.com/the-epic-turla-operation/65545/"},{"source_name":"Kaspersky Turla Aug 2014","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08080105/KL_Epic_Turla_Technical_Appendix_20140806.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--292fd2a5-45fa-4125-84ea-8b5f341dc579","subject":"ATTACK:enterprise:S0660","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--292fd2a5-45fa-4125-84ea-8b5f341dc579","modified":"2026-04-29T14:23:05.961Z","references":[{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"},{"source_name":"Talent-Jump Clambling February 2020","url":"https://www.talent-jump.com/article/2020/02/17/CLAMBLING-A-New-Backdoor-Base-On-Dropbox-en/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--29be6a34-6a89-42e8-a6b1-dca821ed7f94","subject":"ATTACK:enterprise:S0472","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--29be6a34-6a89-42e8-a6b1-dca821ed7f94","modified":"2026-04-29T14:23:05.961Z","references":[{"source_name":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2b196fe7-93e1-4575-8818-578305fc1fae","subject":"ATTACK:enterprise:S0446","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2b196fe7-93e1-4575-8818-578305fc1fae","modified":"2026-04-29T14:23:05.963Z","references":[{"source_name":"CrowdStrike Ryuk January 2019","url":"https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2b4bd264-4c8b-4303-9c54-113284c9e9a0","subject":"ATTACK:enterprise:S0650","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2b4bd264-4c8b-4303-9c54-113284c9e9a0","modified":"2026-04-29T14:23:05.963Z","references":[{"source_name":"ATT QakBot April 2021","url":"https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2bcaf336-cd02-47e3-b73f-6f0c5cc3592f","subject":"ATTACK:enterprise:S0428","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2bcaf336-cd02-47e3-b73f-6f0c5cc3592f","modified":"2026-04-29T14:23:05.964Z","references":[{"source_name":"Talos PoetRAT April 2020","url":"https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2bce15a3-cf65-48a5-8a07-1c85c9c33a1a","subject":"ATTACK:enterprise:S0689","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2bce15a3-cf65-48a5-8a07-1c85c9c33a1a","modified":"2026-04-29T14:23:05.964Z","references":[{"source_name":"Cisco Ukraine Wipers January 2022","url":"https://blog.talosintelligence.com/2022/01/ukraine-campaign-delivers-defacement.html"},{"source_name":"Unit 42 WhisperGate January 2022","url":"https://unit42.paloaltonetworks.com/ukraine-cyber-conflict-cve-2021-32648-whispergate/#whispergate-malware-family"},{"source_name":"Microsoft WhisperGate January 2022","url":"https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"},{"source_name":"Medium S2W WhisperGate January 2022","url":"https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2c09a27c-2eea-4287-9908-964533234e71","subject":"ATTACK:enterprise:S0106","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2c09a27c-2eea-4287-9908-964533234e71","modified":"2026-04-29T14:23:05.964Z","references":[{"source_name":"TechNet Dir","url":"https://technet.microsoft.com/en-us/library/cc755121.aspx"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2d76d7b2-ec41-4630-8405-ec7db2c0607c","subject":"ATTACK:enterprise:S0345","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2d76d7b2-ec41-4630-8405-ec7db2c0607c","modified":"2026-04-29T14:23:05.966Z","references":[{"source_name":"McAfee Oceansalt Oct 2018","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-oceansalt.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2f142216-22ad-4c34-b787-8bfeb2fcd57b","subject":"ATTACK:enterprise:S9053","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2f142216-22ad-4c34-b787-8bfeb2fcd57b","modified":"2026-09-24T22:11:29.964Z","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2f19f736-a547-47c3-ae26-40a0d13cdf41","subject":"ATTACK:enterprise:G0082","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2f19f736-a547-47c3-ae26-40a0d13cdf41","modified":"2026-09-30T19:01:31.054Z","references":[{"source_name":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"},{"source_name":"Microsoft Axios Compromise APR 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/"},{"source_name":"Microsoft Sapphire Sleet APR 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3094a14f-ccd2-4ba4-a3f6-c6d2721f02db","subject":"ATTACK:enterprise:G0007","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3094a14f-ccd2-4ba4-a3f6-c6d2721f02db","modified":"2026-07-31T20:48:44.568Z","references":[{"source_name":"Überwachung APT28 Forfiles June 2015","url":"https://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/"},{"source_name":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--30ab931e-9cc1-4e95-a3f5-364be094b54e","subject":"ATTACK:enterprise:S0271","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--30ab931e-9cc1-4e95-a3f5-364be094b54e","modified":"2026-04-29T14:23:05.978Z","references":[{"source_name":"US-CERT KEYMARBLE Aug 2018","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-221A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--32ee78b3-58de-4de5-bc3d-34ea8dc90ca3","subject":"ATTACK:enterprise:S0063","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--32ee78b3-58de-4de5-bc3d-34ea8dc90ca3","modified":"2026-04-29T14:23:05.986Z","references":[{"source_name":"Palo Alto CVE-2015-3113 July 2015","url":"http://researchcenter.paloaltonetworks.com/2015/07/ups-observations-on-cve-2015-3113-prior-zero-days-and-the-pirpi-payload/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--33327a36-9f05-4a27-ac6a-d36e4cee0b21","subject":"ATTACK:enterprise:S0219","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--33327a36-9f05-4a27-ac6a-d36e4cee0b21","modified":"2026-04-29T14:23:05.986Z","references":[{"source_name":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--355c008f-e48a-45f1-8ab8-f04fff3b7915","subject":"ATTACK:enterprise:C0058","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--355c008f-e48a-45f1-8ab8-f04fff3b7915","modified":"2026-07-31T18:47:18.102Z","references":[{"source_name":"Microsoft SharePoint Exploit JUL 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/#storm-2603"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3572a770-9151-42d5-82b5-360002725052","subject":"ATTACK:enterprise:S0348","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3572a770-9151-42d5-82b5-360002725052","modified":"2026-04-29T14:23:05.991Z","references":[{"source_name":"PaloAlto CardinalRat Apr 2017","url":"https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--358047bf-1dd3-4fc4-bc1a-b7004bd54b8d","subject":"ATTACK:enterprise:S0072","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--358047bf-1dd3-4fc4-bc1a-b7004bd54b8d","modified":"2026-04-29T14:23:05.992Z","references":[{"source_name":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--35ec37ba-44aa-49b1-9379-3f6070554c62","subject":"ATTACK:enterprise:S0055","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--35ec37ba-44aa-49b1-9379-3f6070554c62","modified":"2026-04-29T14:23:05.993Z","references":[{"source_name":"Camba RARSTONE","url":"http://blog.trendmicro.com/trendlabs-security-intelligence/bkdr_rarstone-new-rat-to-watch-out-for/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--37440d78-4ced-42c2-9a9c-fd71f10e6cd6","subject":"ATTACK:enterprise:S9027","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--37440d78-4ced-42c2-9a9c-fd71f10e6cd6","modified":"2026-04-29T14:23:05.995Z","references":[{"source_name":"Trend Micro Earth Kasha Anel NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--37e4bb23-505b-41bb-a2f4-98501b065598","subject":"ATTACK:enterprise:S0437","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--37e4bb23-505b-41bb-a2f4-98501b065598","modified":"2026-04-29T14:23:05.996Z","references":[{"source_name":"TrendMicro BlackTech June 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--37f94533-8fbe-48d2-bf4f-f825ad75ff98","subject":"ATTACK:enterprise:S0089","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--37f94533-8fbe-48d2-bf4f-f825ad75ff98","modified":"2026-04-29T14:23:05.996Z","references":[{"source_name":"F-Secure BlackEnergy 2014","url":"https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf"},{"source_name":"Securelist BlackEnergy Nov 2014","url":"https://securelist.com/be2-custom-plugins-router-abuse-and-target-profiles/67353/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3ad23432-af84-4887-bbf2-733d12d03395","subject":"ATTACK:enterprise:S1090","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3ad23432-af84-4887-bbf2-733d12d03395","modified":"2026-04-29T14:23:06.002Z","references":[{"source_name":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3b79c4a0-aaa4-430d-9f15-4acbc5e1b0a3","subject":"ATTACK:enterprise:S1141","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3b79c4a0-aaa4-430d-9f15-4acbc5e1b0a3","modified":"2026-04-29T14:23:06.003Z","references":[{"source_name":"ESET Turla Lunar toolset May 2024","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3ca496bf-41f9-4d0b-b36d-576f90db340e","subject":"ATTACK:enterprise:S0366","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3ca496bf-41f9-4d0b-b36d-576f90db340e","modified":"2026-04-29T14:23:06.007Z","references":[{"source_name":"FireEye WannaCry 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html"},{"source_name":"LogRhythm WannaCry","url":"https://web.archive.org/web/20230522041200/https://logrhythm.com/blog/a-technical-analysis-of-wannacry-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3dd2f874-57e3-4670-9c0a-7d8c35741bb6","subject":"ATTACK:enterprise:S0516","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3dd2f874-57e3-4670-9c0a-7d8c35741bb6","modified":"2026-04-29T14:23:06.009Z","references":[{"source_name":"CISA SoreFang July 2016","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3de749e5-353a-4bdc-8951-9e0fa387bc70","subject":"ATTACK:enterprise:S0129","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3de749e5-353a-4bdc-8951-9e0fa387bc70","modified":"2026-04-29T14:23:06.009Z","references":[{"source_name":"Forcepoint Monsoon","url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3f824a1b-70d5-4859-bd55-6b084f602a52","subject":"ATTACK:enterprise:S0572","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3f824a1b-70d5-4859-bd55-6b084f602a52","modified":"2026-04-29T14:23:06.011Z","references":[{"source_name":"ClearSky Lebanese Cedar Jan 2021","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--40e6721c-f5fd-4c51-aec9-93b70e7e312c","subject":"ATTACK:enterprise:G0100","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--40e6721c-f5fd-4c51-aec9-93b70e7e312c","modified":"2026-07-31T18:48:25.083Z","references":[{"source_name":"Symantec Inception Framework March 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--416c98b4-221d-4e2f-aed4-43b844a89ad0","subject":"ATTACK:enterprise:S0452","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--416c98b4-221d-4e2f-aed4-43b844a89ad0","modified":"2026-04-29T14:23:06.014Z","references":[{"source_name":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--431043b7-f0e8-411b-8eec-0d602867b028","subject":"ATTACK:enterprise:S0640","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--431043b7-f0e8-411b-8eec-0d602867b028","modified":"2026-04-29T14:23:06.017Z","references":[{"source_name":"Arxiv Avaddon Feb 2021","url":"https://arxiv.org/pdf/2102.04796.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4322a0e4-1653-416a-81c1-cfc8a7cfd69e","subject":"ATTACK:enterprise:S1040","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4322a0e4-1653-416a-81c1-cfc8a7cfd69e","modified":"2026-04-29T14:23:06.017Z","references":[{"source_name":"Rclone","url":"https://rclone.org"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--44356f01-27ae-45f5-b37f-85ce8c22fa44","subject":"ATTACK:enterprise:G1054","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--44356f01-27ae-45f5-b37f-85ce8c22fa44","modified":"2026-07-31T18:48:08.574Z","references":[{"source_name":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"},{"source_name":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"},{"source_name":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--44a9f8e6-7b16-4c19-a1ac-df57a67b329a","subject":"ATTACK:enterprise:S0610","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--44a9f8e6-7b16-4c19-a1ac-df57a67b329a","modified":"2026-04-29T14:23:06.019Z","references":[{"source_name":"Check Point APT34 April 2021","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--44ddb228-ec4e-495e-b930-04a49fe58a7d","subject":"ATTACK:enterprise:S0632","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--44ddb228-ec4e-495e-b930-04a49fe58a7d","modified":"2026-04-29T14:23:06.019Z","references":[{"source_name":"Group IB GrimAgent July 2021","url":"https://www.group-ib.com/blog/grimagent/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--45264c38-14fb-4788-bc8f-97d26957e02e","subject":"ATTACK:enterprise:C0062","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--45264c38-14fb-4788-bc8f-97d26957e02e","modified":"2026-07-31T18:47:24.274Z","references":[{"source_name":"Anthropic AI Orchestrated Campaign NOV 2025","url":"https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--472c61e4-e839-4766-b1ce-d9095203e538","subject":"ATTACK:enterprise:S0468","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--472c61e4-e839-4766-b1ce-d9095203e538","modified":"2026-04-29T14:23:06.022Z","references":[{"source_name":"Trend Micro Skidmap","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--47ad4b99-a600-4788-b90d-ba8e2799107a","subject":"ATTACK:enterprise:G1039","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--47ad4b99-a600-4788-b90d-ba8e2799107a","modified":"2026-07-31T18:48:06.057Z","references":[{"source_name":"therecord_redcurl","url":"https://therecord.media/redcurl-hackers-russian-bank-australian-company"},{"source_name":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source_name":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4990cf9a-9041-45c6-9d31-232ddb770341","subject":"ATTACK:enterprise:S0350","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4990cf9a-9041-45c6-9d31-232ddb770341","modified":"2026-04-29T14:23:06.026Z","references":[{"source_name":"McAfee Night Dragon","url":"https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--49dbde7a-a8ac-4d86-8216-1055f7536467","subject":"ATTACK:enterprise:S0412","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--49dbde7a-a8ac-4d86-8216-1055f7536467","modified":"2026-04-29T14:23:06.026Z","references":[{"source_name":"Talos ZxShell Oct 2014","url":"https://blogs.cisco.com/security/talos/opening-zxshell"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4a0c829e-1590-407a-bc3f-64793050e039","subject":"ATTACK:enterprise:S1149","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4a0c829e-1590-407a-bc3f-64793050e039","modified":"2026-04-29T14:23:06.026Z","references":[{"source_name":"Mandiant ROADSWEEP August 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4a358258-d616-4f15-aead-d4e6f6153aae","subject":"ATTACK:enterprise:S0547","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4a358258-d616-4f15-aead-d4e6f6153aae","modified":"2026-04-29T14:23:06.027Z","references":[{"source_name":"Cybereason Molerats Dec 2020","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf"},{"source_name":"BleepingComputer Molerats Dec 2020","url":"https://www.bleepingcomputer.com/news/security/hacking-group-s-new-malware-abuses-google-and-facebook-services/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4b2baed3-8e3c-4ab6-9b92-f147a9ab7d13","subject":"ATTACK:enterprise:S0436","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4b2baed3-8e3c-4ab6-9b92-f147a9ab7d13","modified":"2026-04-29T14:23:06.028Z","references":[{"source_name":"JPCert TSCookie March 2018","url":"https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4d453252-ae9c-48c0-a9ab-2ca700855e3f","subject":"ATTACK:enterprise:G1047","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4d453252-ae9c-48c0-a9ab-2ca700855e3f","modified":"2026-07-31T18:48:23.925Z","references":[{"source_name":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4e07996d-c9d9-49a8-9800-94daf69cd3b3","subject":"ATTACK:enterprise:S0236","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4e07996d-c9d9-49a8-9800-94daf69cd3b3","modified":"2026-04-29T14:23:06.031Z","references":[{"source_name":"Symantec Orangeworm April 2018","url":"https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4ebc45da-6c79-4d9f-9c25-144ff55f70c9","subject":"ATTACK:enterprise:S1100","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4ebc45da-6c79-4d9f-9c25-144ff55f70c9","modified":"2026-04-29T14:23:06.032Z","references":[{"source_name":"Kaspersky ToddyCat June 2022","url":"https://securelist.com/toddycat/106799/"},{"source_name":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4ffd0780-b8ed-4b8f-b5b8-ff5b0afd4f1f","subject":"ATTACK:enterprise:S0201","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4ffd0780-b8ed-4b8f-b5b8-ff5b0afd4f1f","modified":"2026-04-29T14:23:06.034Z","references":[{"source_name":"Microsoft PLATINUM April 2016","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--50271beb-48b1-411e-86b5-990b4cbb1fb5","subject":"ATTACK:enterprise:S0086","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--50271beb-48b1-411e-86b5-990b4cbb1fb5","modified":"2026-04-29T14:23:06.035Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--512e16e9-634c-45d3-b569-c25a3072bbdc","subject":"ATTACK:enterprise:S0036","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--512e16e9-634c-45d3-b569-c25a3072bbdc","modified":"2026-04-29T14:23:06.036Z","references":[{"source_name":"FireEye APT30","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--53339b8f-f66b-4bcc-86a8-31daaeebb0e6","subject":"ATTACK:enterprise:S0447","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--53339b8f-f66b-4bcc-86a8-31daaeebb0e6","modified":"2026-04-29T14:23:06.039Z","references":[{"source_name":"Talos Lokibot Jan 2021","url":"https://blog.talosintelligence.com/2021/01/a-deep-dive-into-lokibot-infection-chain.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--536a0d57-9faf-4baa-83de-40c7aaafe28c","subject":"ATTACK:enterprise:S0376","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--536a0d57-9faf-4baa-83de-40c7aaafe28c","modified":"2026-04-29T14:23:06.039Z","references":[{"source_name":"US-CERT HOPLIGHT Apr 2019","url":"https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--577a7635-c4e3-42ab-8f16-d59330fdd535","subject":"ATTACK:enterprise:G0114","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--577a7635-c4e3-42ab-8f16-d59330fdd535","modified":"2026-07-31T20:48:41.283Z","references":[{"source_name":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--58a589e3-1ed8-42b0-90d2-0b1744beecc6","subject":"ATTACK:enterprise:S1169","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--58a589e3-1ed8-42b0-90d2-0b1744beecc6","modified":"2026-04-29T14:23:06.046Z","references":[{"source_name":"ESET OilRig Campaigns Sep 2023","url":"https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5b83337c-5030-402d-ad28-1b9f5cf782cc","subject":"ATTACK:enterprise:S0337","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5b83337c-5030-402d-ad28-1b9f5cf782cc","modified":"2026-04-29T14:23:06.050Z","references":[{"source_name":"Unit 42 BadPatch Oct 2017","url":"https://researchcenter.paloaltonetworks.com/2017/10/unit42-badpatch/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5bb94c21-96c6-4c71-ae46-b222a69a493a","subject":"ATTACK:enterprise:S0034","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5bb94c21-96c6-4c71-ae46-b222a69a493a","modified":"2026-04-29T14:23:06.050Z","references":[{"source_name":"FireEye APT30","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5c0bb793-ced9-4b3c-80c2-af33e1fa6213","subject":"ATTACK:enterprise:S0663","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5c0bb793-ced9-4b3c-80c2-af33e1fa6213","modified":"2026-04-29T14:23:06.051Z","references":[{"source_name":"Lunghi Iron Tiger Linux","url":"https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"},{"source_name":"Trend Micro Iron Tiger April 2021","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5c15936e-ed4a-4a6e-a126-eb36084019b5","subject":"ATTACK:enterprise:S1160","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5c15936e-ed4a-4a6e-a126-eb36084019b5","modified":"2026-04-29T14:23:06.051Z","references":[{"source_name":"Bitsight Latrodectus June 2024","url":"https://www.bitsight.com/blog/latrodectus-are-you-coming-back"},{"source_name":"Latrodectus APR 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"},{"source_name":"Elastic Latrodectus May 2024","url":"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5c5ac8b1-745e-4727-9735-a7d1ff049fb2","subject":"ATTACK:enterprise:S1202","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5c5ac8b1-745e-4727-9735-a7d1ff049fb2","modified":"2026-04-29T14:23:06.051Z","references":[{"source_name":"Joint Cybersecurity Advisory LockBit 3.0 MAR 2023","url":"https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5c738353-868a-4e4d-8628-e1d14e502980","subject":"ATTACK:enterprise:S0414","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5c738353-868a-4e4d-8628-e1d14e502980","modified":"2026-04-29T14:23:06.051Z","references":[{"source_name":"Unit42 BabyShark Feb 2019","url":"https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5c816fc0-c4e3-47ef-8193-ef88eabdfc7e","subject":"ATTACK:enterprise:G0018","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5c816fc0-c4e3-47ef-8193-ef88eabdfc7e","modified":"2026-07-31T18:47:39.508Z","references":[{"source_name":"FireEye admin@338","url":"https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5c84d301-b6d1-4af8-9c25-1260e05fa924","subject":"ATTACK:enterprise:S0149","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5c84d301-b6d1-4af8-9c25-1260e05fa924","modified":"2026-04-29T14:23:06.051Z","references":[{"source_name":"Palo Alto MoonWind March 2017","url":"http://researchcenter.paloaltonetworks.com/2017/03/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5c8fba10-9d8a-4257-a458-8f58efc8d912","subject":"ATTACK:enterprise:G0004","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5c8fba10-9d8a-4257-a458-8f58efc8d912","modified":"2026-07-31T18:48:01.036Z","references":[{"source_name":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"},{"source_name":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5cc7ade7-2e21-41a3-8535-4274c138dcc4","subject":"ATTACK:enterprise:S0576","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5cc7ade7-2e21-41a3-8535-4274c138dcc4","modified":"2026-04-29T14:23:06.052Z","references":[{"source_name":"IBM MegaCortex","url":"https://securityintelligence.com/posts/from-mega-to-giga-cross-version-comparison-of-top-megacortex-modifications/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5d3f0b01-04e0-43d0-9fa5-7d2dd2d3910f","subject":"ATTACK:enterprise:S1153","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5d3f0b01-04e0-43d0-9fa5-7d2dd2d3910f","modified":"2026-04-29T14:23:06.052Z","references":[{"source_name":"Kandji Cuckoo April 2024","url":"https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware"},{"source_name":"SentinelOne Cuckoo Stealer May 2024","url":"https://www.sentinelone.com/blog/macos-cuckoo-stealer-ensuring-detection-and-defense-as-new-samples-rapidly-emerge/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5d46a519-1ef9-4cdb-b737-8c7b3ffb4f0e","subject":"ATTACK:enterprise:S0147","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5d46a519-1ef9-4cdb-b737-8c7b3ffb4f0e","modified":"2026-04-29T14:23:06.052Z","references":[{"source_name":"Palo Alto Gamaredon Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5ea439b8-ca9d-462b-9bb5-e0f13651b10c","subject":"ATTACK:enterprise:S0492","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5ea439b8-ca9d-462b-9bb5-e0f13651b10c","modified":"2026-04-29T14:23:06.054Z","references":[{"source_name":"Unit42 CookieMiner Jan 2019","url":"https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5f013e67-6f7b-4ea5-86d4-91940f3b74cb","subject":"ATTACK:enterprise:S9038","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5f013e67-6f7b-4ea5-86d4-91940f3b74cb","modified":"2026-04-29T14:23:06.054Z","references":[{"source_name":"CERT Polska","url":"https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5f4c8795-68b6-4935-beb4-adde242f44f6","subject":"ATTACK:enterprise:S0235","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5f4c8795-68b6-4935-beb4-adde242f44f6","modified":"2026-04-29T14:23:06.055Z","references":[{"source_name":"Lookout Dark Caracal Jan 2018","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6043fd33-6e50-439a-9ee4-1d24a96fe913","subject":"ATTACK:enterprise:S0616","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6043fd33-6e50-439a-9ee4-1d24a96fe913","modified":"2026-04-29T14:23:06.056Z","references":[{"source_name":"FireEye FiveHands April 2021","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--60c352ec-eb4c-451a-a56e-43a9dc4ee91f","subject":"ATTACK:enterprise:S0259","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--60c352ec-eb4c-451a-a56e-43a9dc4ee91f","modified":"2026-04-29T14:23:06.057Z","references":[{"source_name":"ASERT InnaputRAT April 2018","url":"https://asert.arbornetworks.com/innaput-actors-utilize-remote-access-trojan-since-2016-presumably-targeting-victim-files/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6189bf91-d755-47e6-9f3c-dd621e3f64fd","subject":"ATTACK:enterprise:S0559","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6189bf91-d755-47e6-9f3c-dd621e3f64fd","modified":"2026-04-29T14:23:06.058Z","references":[{"source_name":"FireEye SUNBURST Backdoor December 2020","url":"https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"},{"source_name":"Microsoft Analyzing Solorigate Dec 2020","url":"https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--618b5859-2518-424a-8345-6e4826586f9f","subject":"ATTACK:enterprise:S1184","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--618b5859-2518-424a-8345-6e4826586f9f","modified":"2026-04-29T14:23:06.058Z","references":[{"source_name":"Google Cloud BOLDMOVE 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/chinese-actors-exploit-fortios-flaw/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--61a3d7e0-3663-4fb7-9bb3-20a73257f27d","subject":"ATTACK:enterprise:S0625","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--61a3d7e0-3663-4fb7-9bb3-20a73257f27d","modified":"2026-04-29T14:23:06.058Z","references":[{"source_name":"McAfee Cuba April 2021","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6203e555-d5f9-4b3c-978b-d10db7575dbc","subject":"ATTACK:enterprise:S0211","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6203e555-d5f9-4b3c-978b-d10db7575dbc","modified":"2026-04-29T14:23:06.058Z","references":[{"source_name":"Symantec Linfo May 2012","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-051605-2535-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--62507790-a137-409e-a655-9190ff78cb52","subject":"ATTACK:enterprise:S0050","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--62507790-a137-409e-a655-9190ff78cb52","modified":"2026-04-29T14:23:06.059Z","references":[{"source_name":"F-Secure Cosmicduke","url":"https://blog.f-secure.com/wp-content/uploads/2019/10/CosmicDuke.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--62f2c1a6-3019-44a0-a750-794677ddabd0","subject":"ATTACK:enterprise:G0034","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--62f2c1a6-3019-44a0-a750-794677ddabd0","modified":"2026-07-31T20:48:32.961Z","references":[{"source_name":"Dragos Crashoverride 2018","url":"https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"},{"source_name":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6369c7fa-ec7b-4fff-a4b7-83348318814a","subject":"ATTACK:enterprise:S1140","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6369c7fa-ec7b-4fff-a4b7-83348318814a","modified":"2026-04-29T14:23:06.060Z","references":[{"source_name":"Google TAG COLDRIVER January 2024","url":"https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--636be06a-5c19-45c8-b6be-c38634c583dc","subject":"ATTACK:enterprise:S0265","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--636be06a-5c19-45c8-b6be-c38634c583dc","modified":"2026-04-29T14:23:06.060Z","references":[{"source_name":"Unit 42 Kazuar May 2017","url":"https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--63a7bbf6-bb2e-41e7-8893-c3f7f207a7a7","subject":"ATTACK:enterprise:S0161","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--63a7bbf6-bb2e-41e7-8893-c3f7f207a7a7","modified":"2026-04-29T14:23:06.061Z","references":[{"source_name":"XAgentOSX 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/"},{"source_name":"XAgentOSX 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6435a96b-f3b5-4a16-876f-901650257d36","subject":"ATTACK:enterprise:S0697","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6435a96b-f3b5-4a16-876f-901650257d36","modified":"2026-04-29T14:23:06.061Z","references":[{"source_name":"SentinelOne Hermetic Wiper February 2022","url":"https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack"},{"source_name":"Qualys Hermetic Wiper March 2022","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/03/01/ukrainian-targets-hit-by-hermeticwiper-new-datawiper-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--650fddda-8aa5-4311-9772-ba8ab0ed4afa","subject":"ATTACK:enterprise:S0687","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--650fddda-8aa5-4311-9772-ba8ab0ed4afa","modified":"2026-04-29T14:23:06.063Z","references":[{"source_name":"NCSC Cyclops Blink February 2022","url":"https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf"},{"source_name":"Trend Micro Cyclops Blink March 2022","url":"https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--66b5808f-b124-4736-bb6b-289503d07fa2","subject":"ATTACK:enterprise:S0618","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--66b5808f-b124-4736-bb6b-289503d07fa2","modified":"2026-04-29T14:23:06.065Z","references":[{"source_name":"CISA AR21-126A FIVEHANDS May 2021","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"},{"source_name":"NCC Group Fivehands June 2021","url":"https://research.nccgroup.com/2021/06/15/handy-guide-to-a-new-fivehands-ransomware-variant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--66e7e1f3-5113-407f-a07a-299c4b9b68e2","subject":"ATTACK:enterprise:S1070","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--66e7e1f3-5113-407f-a07a-299c4b9b68e2","modified":"2026-04-29T14:23:06.065Z","references":[{"source_name":"Avertium Black Basta June 2022","url":"https://www.avertium.com/resources/threat-reports/in-depth-look-at-black-basta-ransomware"},{"source_name":"Check Point Black Basta October 2022","url":"https://research.checkpoint.com/2022/black-basta-and-the-unnoticed-delivery/"},{"source_name":"Cyble Black Basta May 2022","url":"https://web.archive.org/web/20220506143054/https://blog.cyble.com/2022/05/06/black-basta-ransomware/"},{"source_name":"Palo Alto Networks Black Basta August 2022","url":"https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware"},{"source_name":"NCC Group Black Basta June 2022","url":"https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/"},{"source_name":"Uptycs Black Basta ESXi June 2022","url":"https://www.uptycs.com/blog/black-basta-ransomware-goes-cross-platform-now-targets-esxi-systems"},{"source_name":"Trend Micro Black Basta Spotlight September 2022","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbasta"},{"source_name":"Deep Instinct Black Basta August 2022","url":"https://www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6747d237-8156-453c-9751-3afd1b36bdca","subject":"ATTACK:enterprise:S0154","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6747d237-8156-453c-9751-3afd1b36bdca","modified":"2026-04-29T14:23:06.066Z","references":[{"source_name":"Cobalt Strike Manual 4.3 November 2020","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--68130387-da58-4676-889b-0b8c5b2c3a65","subject":"ATTACK:enterprise:S0673","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--68130387-da58-4676-889b-0b8c5b2c3a65","modified":"2026-04-29T14:23:06.066Z","references":[{"source_name":"Prevailion DarkWatchman 2021","url":"https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6832f4b5-3f36-4def-9b97-d0228da33964","subject":"ATTACK:enterprise:S0604","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6832f4b5-3f36-4def-9b97-d0228da33964","modified":"2026-04-29T14:23:06.067Z","references":[{"source_name":"ESET Industroyer","url":"https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--69127424-40bb-4b92-8558-6fe1561e0a59","subject":"ATTACK:enterprise:S0252","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--69127424-40bb-4b92-8558-6fe1561e0a59","modified":"2026-04-29T14:23:06.068Z","references":[{"source_name":"McAfee Gold Dragon","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--69d75d5b-0780-4618-aca4-3a9c9b1e2aee","subject":"ATTACK:enterprise:G1057","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--69d75d5b-0780-4618-aca4-3a9c9b1e2aee","modified":"2026-08-04T19:30:39.865Z","references":[{"source_name":"Google_SHOracle_Jun2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6b8ccd02-050f-40fa-8d03-36f1cc8f952b","subject":"ATTACK:enterprise:S1229","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6b8ccd02-050f-40fa-8d03-36f1cc8f952b","modified":"2026-04-29T14:23:06.071Z","references":[{"source_name":"Havoc Framework Documentation","url":"https://havocframework.com/docs/welcome"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6c130c97-8623-4d14-829e-0e90dd0757a0","subject":"ATTACK:enterprise:S0346","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6c130c97-8623-4d14-829e-0e90dd0757a0","modified":"2026-04-29T14:23:06.072Z","references":[{"source_name":"McAfee Oceansalt Oct 2018","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-oceansalt.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6c320415-f45c-438a-9671-c4c831ebd7fc","subject":"ATTACK:enterprise:S0198","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6c320415-f45c-438a-9671-c4c831ebd7fc","modified":"2026-04-29T14:23:06.072Z","references":[{"source_name":"Proofpoint NETWIRE December 2020","url":"https://www.proofpoint.com/us/blog/threat-insight/geofenced-netwire-campaigns"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6c3d4f83-49e2-42fa-a4b8-823f04b3cd32","subject":"ATTACK:enterprise:S1156","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6c3d4f83-49e2-42fa-a4b8-823f04b3cd32","modified":"2026-04-29T14:23:06.072Z","references":[{"source_name":"Talos Manjusaka 2022","url":"https://blog.talosintelligence.com/manjusaka-offensive-framework/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6cce15df-4e0c-4eac-b597-5a301d450546","subject":"ATTACK:enterprise:G0121","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6cce15df-4e0c-4eac-b597-5a301d450546","modified":"2026-07-31T18:47:51.907Z","references":[{"source_name":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6cfd1f0f-0355-4b1a-af29-84ed992bbb71","subject":"ATTACK:enterprise:S0131","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6cfd1f0f-0355-4b1a-af29-84ed992bbb71","modified":"2026-04-29T14:23:06.073Z","references":[{"source_name":"Forcepoint Monsoon","url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6d3fee1f-1c19-4ad8-9cd9-e5b00e5b040a","subject":"ATTACK:enterprise:S0340","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6d3fee1f-1c19-4ad8-9cd9-e5b00e5b040a","modified":"2026-04-29T14:23:06.074Z","references":[{"source_name":"Securelist Octopus Oct 2018","url":"https://securelist.com/octopus-infested-seas-of-central-asia/88200/"},{"source_name":"Security Affairs DustSquad Oct 2018","url":"https://securityaffairs.co/wordpress/77165/apt/russia-linked-apt-dustsquad.html"},{"source_name":"ESET Nomadic Octopus 2018","url":"https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6d8b4863-f8db-4776-a70f-ea16255d45bd","subject":"ATTACK:enterprise:S0562","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6d8b4863-f8db-4776-a70f-ea16255d45bd","modified":"2026-04-29T14:23:06.074Z","references":[{"source_name":"CrowdStrike SUNSPOT Implant January 2021","url":"https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6e1346fe-507c-4ab3-a254-ea00e226fafd","subject":"ATTACK:enterprise:S0672","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6e1346fe-507c-4ab3-a254-ea00e226fafd","modified":"2026-04-29T14:23:06.075Z","references":[{"source_name":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6e39f6fe-3808-41ae-9263-1fd23865bd7b","subject":"ATTACK:enterprise:S0081","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6e39f6fe-3808-41ae-9263-1fd23865bd7b","modified":"2026-04-29T14:23:06.075Z","references":[{"source_name":"Accenture Dragonfish Jan 2018","url":"https://web.archive.org/web/20190508165226/https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf"},{"source_name":"Lotus Blossom Jun 2015","url":"https://www.paloaltonetworks.com/resources/research/unit42-operation-lotus-blossom.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6ec66973-8ba0-4ec4-a4ca-c49a304f56b7","subject":"ATTACK:enterprise:S0268","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6ec66973-8ba0-4ec4-a4ca-c49a304f56b7","modified":"2026-04-29T14:23:06.076Z","references":[{"source_name":"Kaspersky CactusPete Aug 2020","url":"https://securelist.com/cactuspete-apt-groups-updated-bisonal-backdoor/97962/"},{"source_name":"Talos Bisonal Mar 2020","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6ed5bd9a-3f94-4ed0-94fb-0d3b93bc984e","subject":"ATTACK:enterprise:S0051","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6ed5bd9a-3f94-4ed0-94fb-0d3b93bc984e","modified":"2026-04-29T14:23:06.076Z","references":[{"source_name":"ESET Dukes October 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--707f2ce7-a09f-4df4-8b48-3106a63da041","subject":"ATTACK:enterprise:S0575","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--707f2ce7-a09f-4df4-8b48-3106a63da041","modified":"2026-04-29T14:23:06.079Z","references":[{"source_name":"CarbonBlack Conti July 2020","url":"https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--70b014d2-627e-41cc-98ae-794032eb5117","subject":"ATTACK:enterprise:C0059","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--70b014d2-627e-41cc-98ae-794032eb5117","modified":"2026-07-31T20:48:18.267Z","references":[{"source_name":"FBI Salesforce Data Theft SEP 2025","url":"https://www.ic3.gov/CSA/2025/250912.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--70fa48cc-4acf-4df3-b8a0-d862b2b67f33","subject":"ATTACK:enterprise:S0533","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--70fa48cc-4acf-4df3-b8a0-d862b2b67f33","modified":"2026-04-29T14:23:06.079Z","references":[{"source_name":"CISA MAR SLOTHFULMEDIA October 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7105ecea-8da8-4723-b717-ae9c3152cfdd","subject":"ATTACK:enterprise:S0045","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7105ecea-8da8-4723-b717-ae9c3152cfdd","modified":"2026-04-29T14:23:06.080Z","references":[{"source_name":"ESET Sednit Part 2","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"},{"source_name":"Bitdefender APT28 Dec 2015","url":"https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--714ecf14-6200-4edf-9a9c-dd9830831266","subject":"ATTACK:enterprise:S0182","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--714ecf14-6200-4edf-9a9c-dd9830831266","modified":"2026-04-29T14:23:06.080Z","references":[{"source_name":"Microsoft FinFisher March 2018","url":"https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/"},{"source_name":"FinFisher Citation","url":"https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--721d7ab2-4191-4b54-a91a-90d1b23f523e","subject":"ATTACK:enterprise:S1179","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--721d7ab2-4191-4b54-a91a-90d1b23f523e","modified":"2026-04-29T14:23:06.081Z","references":[{"source_name":"Symantec BlackByte 2022","url":"https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--72a914ff-e640-4ea3-9c61-d144a988e3a7","subject":"ATTACK:enterprise:S1102","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--72a914ff-e640-4ea3-9c61-d144a988e3a7","modified":"2026-04-29T14:23:06.082Z","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--734b4d88-1203-4ffc-8f49-393dfebfe162","subject":"ATTACK:enterprise:S1101","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--734b4d88-1203-4ffc-8f49-393dfebfe162","modified":"2026-04-29T14:23:06.083Z","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--73af2cc2-699d-4183-b69f-f15b3e8c0494","subject":"ATTACK:enterprise:S0473","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--73af2cc2-699d-4183-b69f-f15b3e8c0494","modified":"2026-04-29T14:23:06.083Z","references":[{"source_name":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--741fd887-1d55-489b-a77f-3a1d28016305","subject":"ATTACK:enterprise:S1105","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--741fd887-1d55-489b-a77f-3a1d28016305","modified":"2026-04-29T14:23:06.084Z","references":[{"source_name":"NCSC-NL COATHANGER Feb 2024","url":"https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear/TLP-CLEAR+MIVD+AIVD+Advisory+COATHANGER.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--74754640-5989-43de-9fab-5a986d9fc8f5","subject":"ATTACK:enterprise:S0674","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--74754640-5989-43de-9fab-5a986d9fc8f5","modified":"2026-04-29T14:23:06.085Z","references":[{"source_name":"Check Point APT35 CharmPower January 2022","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--74972bfd-6910-4602-8327-5cc6db07e48a","subject":"ATTACK:enterprise:S0496","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--74972bfd-6910-4602-8327-5cc6db07e48a","modified":"2026-04-29T14:23:06.085Z","references":[{"source_name":"Kaspersky Sodin July 2019","url":"https://securelist.com/sodin-ransomware/91473/"},{"source_name":"Cylance Sodinokibi July 2019","url":"https://threatvector.cylance.com/en_us/home/threat-spotlight-sodinokibi-ransomware.html"},{"source_name":"Secureworks GandCrab and REvil September 2019","url":"https://www.secureworks.com/blog/revil-the-gandcrab-connection"},{"source_name":"McAfee Sodinokibi October 2019","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"},{"source_name":"Intel 471 REvil March 2020","url":"https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/"},{"source_name":"Secureworks REvil September 2019","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--755e4d65-4e9f-499c-93f3-2aa9a9404000","subject":"ATTACK:enterprise:C0024","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--755e4d65-4e9f-499c-93f3-2aa9a9404000","modified":"2026-07-31T18:47:26.770Z","references":[{"source_name":"Volexity SolarWinds","url":"https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--75cc19f5-00b4-43e2-8eae-f633693dbe56","subject":"ATTACK:enterprise:S0363","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--75cc19f5-00b4-43e2-8eae-f633693dbe56","modified":"2026-04-29T14:23:06.086Z","references":[{"source_name":"Github PowerShell Empire","url":"https://github.com/PowerShellEmpire/Empire"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--75d124da-bb01-422f-bbf1-a472c841741b","subject":"ATTACK:enterprise:S0192","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--75d124da-bb01-422f-bbf1-a472c841741b","modified":"2026-04-29T14:23:06.086Z","references":[{"source_name":"GitHub Pupy","url":"https://github.com/n1nj4sec/pupy"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--75dcfc1b-016e-44ac-97c9-5a2eb3b76e50","subject":"ATTACK:enterprise:G1015","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--75dcfc1b-016e-44ac-97c9-5a2eb3b76e50","modified":"2026-07-31T20:48:34.306Z","references":[{"source_name":"CrowdStrike Scattered Spider JUL 2025","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"},{"source_name":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"},{"source_name":"Mandiant VMware vSphere JUL 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"},{"source_name":"Mandiant UNC3944 May 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations"},{"source_name":"MSTIC Octo Tempest Operations October 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--75ee501b-1283-4ccb-8999-00239eda55fb","subject":"ATTACK:enterprise:S1185","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--75ee501b-1283-4ccb-8999-00239eda55fb","modified":"2026-04-29T14:23:06.087Z","references":[{"source_name":"Huntress LightSpy macOS 2024","url":"https://www.huntress.com/blog/lightspy-malware-variant-targeting-macos"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--75f2e135-5c45-4b27-a7dc-f62e68f6a5ce","subject":"ATTACK:enterprise:S0666","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--75f2e135-5c45-4b27-a7dc-f62e68f6a5ce","modified":"2026-04-29T14:23:06.087Z","references":[{"source_name":"ESET Gelsemium June 2021","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--767ce5fe-06f5-4efc-aa41-129fad867c65","subject":"ATTACK:enterprise:G1007","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--767ce5fe-06f5-4efc-aa41-129fad867c65","modified":"2026-07-31T18:47:59.522Z","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--77270a5a-c2e7-4cf0-8d73-129758454bcc","subject":"ATTACK:enterprise:S0238","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--77270a5a-c2e7-4cf0-8d73-129758454bcc","modified":"2026-04-29T14:23:06.088Z","references":[{"source_name":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--784e4454-00c9-482e-a8a8-d5db7b034d3c","subject":"ATTACK:enterprise:S1199","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--784e4454-00c9-482e-a8a8-d5db7b034d3c","modified":"2026-04-29T14:23:06.089Z","references":[{"source_name":"FBI Lockbit 2.0 FEB 2022","url":"https://www.ic3.gov/CSA/2022/220204.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--78731c00-1f22-4dab-a3cd-d19fac57e82f","subject":"ATTACK:enterprise:G0081","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--78731c00-1f22-4dab-a3cd-d19fac57e82f","modified":"2026-07-31T18:47:57.273Z","references":[{"source_name":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--79826a7e-d9dd-4c4f-bc1f-e5f2d4c6465b","subject":"ATTACK:enterprise:G0070","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--79826a7e-d9dd-4c4f-bc1f-e5f2d4c6465b","modified":"2026-09-02T18:51:44.341Z","references":[{"source_name":"Lookout Dark Caracal Jan 2018","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--79d23451-095d-445d-a61e-3351b55eafde","subject":"ATTACK:enterprise:S0237","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--79d23451-095d-445d-a61e-3351b55eafde","modified":"2026-04-29T14:23:06.092Z","references":[{"source_name":"Talos GravityRAT","url":"https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7a453aab-789d-4fd5-9360-37c3f88ee3c6","subject":"ATTACK:enterprise:S0234","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7a453aab-789d-4fd5-9360-37c3f88ee3c6","modified":"2026-04-29T14:23:06.093Z","references":[{"source_name":"CheckPoint Bandook Nov 2020","url":"https://research.checkpoint.com/2020/bandook-signed-delivered/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7a79128c-d9e3-4345-941f-05e434d99911","subject":"ATTACK:enterprise:S9041","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7a79128c-d9e3-4345-941f-05e434d99911","modified":"2026-07-15T17:53:02.882Z","references":[{"source_name":"Aqua Security Trivy Compromise MAR 2026","url":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23"},{"source_name":"Aqua Security Blog Trivy Compromise APR 2026","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"},{"source_name":"Wiz Trivy Compromise MAR 2026","url":"https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"},{"source_name":"Wiz TeamPCP KICS MAR 2026","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7aab9015-1839-4672-9a9a-76f478c858a8","subject":"ATTACK:enterprise:G0069","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7aab9015-1839-4672-9a9a-76f478c858a8","modified":"2026-07-31T20:48:29.927Z","references":[{"source_name":"Securelist MuddyWater Oct 2018","url":"https://securelist.com/muddywater/88059/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7adebe2e-97f7-4a1a-8ac7-01b795dadc36","subject":"ATTACK:enterprise:S0094","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7adebe2e-97f7-4a1a-8ac7-01b795dadc36","modified":"2026-04-29T14:23:06.094Z","references":[{"source_name":"Secureworks Karagany July 2019","url":"https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7af39008-1480-4524-b8ce-e285628f61be","subject":"ATTACK:enterprise:S0378","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7af39008-1480-4524-b8ce-e285628f61be","modified":"2026-04-29T14:23:06.094Z","references":[{"source_name":"GitHub PoshC2","url":"https://github.com/nettitude/PoshC2_Python"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7c0995ef-ab5d-48f9-8884-7d953c4c3247","subject":"ATTACK:enterprise:S0066","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7c0995ef-ab5d-48f9-8884-7d953c4c3247","modified":"2026-04-29T14:23:06.095Z","references":[{"source_name":"CrowdStrike Putter Panda","url":"http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7c7b8fe8-4dfd-4367-b4a7-22321938a3b3","subject":"ATTACK:enterprise:S1159","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7c7b8fe8-4dfd-4367-b4a7-22321938a3b3","modified":"2026-04-29T14:23:06.096Z","references":[{"source_name":"Google Cloud APT41 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7c958b31-ef21-4231-9a8f-a66cb7db3355","subject":"ATTACK:enterprise:S0368","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7c958b31-ef21-4231-9a8f-a66cb7db3355","modified":"2026-04-29T14:23:06.096Z","references":[{"source_name":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7d584a95-3253-4093-bc03-8933374652a0","subject":"ATTACK:enterprise:S0665","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7d584a95-3253-4093-bc03-8933374652a0","modified":"2026-04-29T14:23:06.097Z","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7d72dfaf-3ba5-4420-985c-b0cd16716428","subject":"ATTACK:enterprise:S0635","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7d72dfaf-3ba5-4420-985c-b0cd16716428","modified":"2026-04-29T14:23:06.097Z","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7d95669c-e4e9-40d5-a36b-cadbc922270d","subject":"ATTACK:enterprise:S1099","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7d95669c-e4e9-40d5-a36b-cadbc922270d","modified":"2026-04-29T14:23:06.097Z","references":[{"source_name":"Kaspersky ToddyCat June 2022","url":"https://securelist.com/toddycat/106799/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7de1c513-5141-45ed-aeb0-b1b221f4dc3f","subject":"ATTACK:enterprise:S0283","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7de1c513-5141-45ed-aeb0-b1b221f4dc3f","modified":"2026-04-29T14:23:06.097Z","references":[{"source_name":"Kaspersky Adwind Feb 2016","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07195002/KL_AdwindPublicReport_2016.pdf"},{"source_name":"Symantec Frutas Feb 2013","url":"https://www.symantec.com/connect/blogs/cross-platform-frutas-rat-builder-and-back-door"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7e836d44-0047-4192-81fd-6fb8ff0cdbda","subject":"ATTACK:enterprise:S0611","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7e836d44-0047-4192-81fd-6fb8ff0cdbda","modified":"2026-04-29T14:23:06.098Z","references":[{"source_name":"Mcafee Clop Aug 2019","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7f499274-44b7-4415-a8e8-6b2134a7873e","subject":"ATTACK:enterprise:S0493","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7f499274-44b7-4415-a8e8-6b2134a7873e","modified":"2026-04-29T14:23:06.100Z","references":[{"source_name":"Trustwave GoldenSpy June 2020","url":"https://www.trustwave.com/en-us/resources/library/documents/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8060addd-e961-41e2-a835-9343153b7522","subject":"ATTACK:enterprise:S1017","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8060addd-e961-41e2-a835-9343153b7522","modified":"2026-04-29T14:23:06.101Z","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--807b9e89-a895-4c9b-aace-1d1ced5824b9","subject":"ATTACK:enterprise:S0628","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--807b9e89-a895-4c9b-aace-1d1ced5824b9","modified":"2026-04-29T14:23:06.101Z","references":[{"source_name":"Securelist APT10 March 2021","url":"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8170e34e-8342-4cbf-ae24-7bce63fb4d48","subject":"ATTACK:enterprise:S0642","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8170e34e-8342-4cbf-ae24-7bce63fb4d48","modified":"2026-06-13T12:04:40.996Z","references":[{"source_name":"Accenture MUDCARP March 2019","url":"https://web.archive.org/web/20210722005437/https://www.accenture.com/_acnmedia/PDF-96/Accenture-Security-MUDCARP.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--827b0e8c-857b-4ccd-b0ef-4effe2bb7fb0","subject":"ATTACK:enterprise:S0693","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--827b0e8c-857b-4ccd-b0ef-4effe2bb7fb0","modified":"2026-04-29T14:23:06.104Z","references":[{"source_name":"Malwarebytes IssacWiper CaddyWiper March 2022 ","url":"https://blog.malwarebytes.com/threat-intelligence/2022/03/double-header-isaacwiper-and-caddywiper/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8363c29c-b5f4-4b0b-8396-52628c773430","subject":"ATTACK:enterprise:S0603","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8363c29c-b5f4-4b0b-8396-52628c773430","modified":"2026-04-29T14:23:06.105Z","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--838b4a52-1360-4ca7-ab25-1b549508e687","subject":"ATTACK:enterprise:S0023","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--838b4a52-1360-4ca7-ab25-1b549508e687","modified":"2026-04-29T14:23:06.105Z","references":[{"source_name":"ESET Sednit Part 2","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--86b7bab7-a1d6-4820-be55-c379f3967f1a","subject":"ATTACK:enterprise:S0251","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--86b7bab7-a1d6-4820-be55-c379f3967f1a","modified":"2026-04-29T14:23:06.109Z","references":[{"source_name":"Securelist Sofacy Feb 2018","url":"https://securelist.com/a-slice-of-2017-sofacy-activity/83930/"},{"source_name":"ESET Zebrocy Nov 2018","url":"https://www.welivesecurity.com/2018/11/20/sednit-whats-going-zebrocy/"},{"source_name":"ESET Zebrocy May 2019","url":"https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/"},{"source_name":"Accenture SNAKEMACKEREL Nov 2018","url":"https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"},{"source_name":"CISA Zebrocy Oct 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303b"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--86ca25c9-8cc3-43f8-bf19-2aca39bcf05e","subject":"ATTACK:enterprise:S1053","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--86ca25c9-8cc3-43f8-bf19-2aca39bcf05e","modified":"2026-04-29T14:23:06.109Z","references":[{"source_name":"Malwarebytes AvosLocker Jul 2021","url":"https://www.malwarebytes.com/blog/threat-intelligence/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners"},{"source_name":"Trend Micro AvosLocker Apr 2022","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-avoslocker"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--87b8b451-bf9b-4e93-b591-05ef502970f5","subject":"ATTACK:enterprise:G0059","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--87b8b451-bf9b-4e93-b591-05ef502970f5","modified":"2026-07-31T18:48:28.853Z","references":[{"source_name":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--884019ca-fca8-46a8-8dc4-71f60427db0f","subject":"ATTACK:enterprise:S0435","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--884019ca-fca8-46a8-8dc4-71f60427db0f","modified":"2026-04-29T14:23:06.111Z","references":[{"source_name":"TrendMicro BlackTech June 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"},{"source_name":"JPCert PLEAD Downloader June 2018","url":"https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8908a544-e6b6-485a-8251-6c8dd1fbc040","subject":"ATTACK:enterprise:S0439","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8908a544-e6b6-485a-8251-6c8dd1fbc040","modified":"2026-04-29T14:23:06.112Z","references":[{"source_name":"ESET Okrum July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--898416fc-2061-47ae-a642-25442906a2d8","subject":"ATTACK:enterprise:S0644","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--898416fc-2061-47ae-a642-25442906a2d8","modified":"2026-04-29T14:23:06.113Z","references":[{"source_name":"Talos Oblique RAT March 2021","url":"https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8beb37e3-5cf0-4229-ae27-186a37133521","subject":"ATTACK:enterprise:S0127","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8beb37e3-5cf0-4229-ae27-186a37133521","modified":"2026-04-29T14:23:06.116Z","references":[{"source_name":"Palo Alto Networks BBSRAT","url":"http://researchcenter.paloaltonetworks.com/2015/12/bbsrat-attacks-targeting-russian-organizations-linked-to-roaming-tiger/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8e08658c-78f5-4bd5-a6e8-d74200ed776c","subject":"ATTACK:enterprise:S0491","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8e08658c-78f5-4bd5-a6e8-d74200ed776c","modified":"2026-09-03T14:50:23.969Z","references":[{"source_name":"Talos Promethium June 2020","url":"https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8eac9312-1c3f-41b7-973d-a7177a56af92","subject":"ATTACK:enterprise:S1196","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8eac9312-1c3f-41b7-973d-a7177a56af92","modified":"2026-04-29T14:23:06.119Z","references":[{"source_name":"S2W Troll Stealer 2024","url":"https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8f389f41-9588-4a67-a186-c25bef45e4cc","subject":"ATTACK:enterprise:S0686","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8f389f41-9588-4a67-a186-c25bef45e4cc","modified":"2026-04-29T14:23:06.120Z","references":[{"source_name":"Microsoft Actinium February 2022","url":"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--90be71e4-6b38-4411-aac5-09711a334393","subject":"ATTACK:enterprise:S0240","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--90be71e4-6b38-4411-aac5-09711a334393","modified":"2026-04-29T14:23:06.122Z","references":[{"source_name":"Securelist ScarCruft May 2019","url":"https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/"},{"source_name":"NCCGroup RokRat Nov 2018","url":"https://research.nccgroup.com/2018/11/08/rokrat-analysis/"},{"source_name":"Volexity InkySquid RokRAT August 2021","url":"https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--90cb412d-399d-4009-8aa0-63f411eb34ff","subject":"ATTACK:enterprise:G0139","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--90cb412d-399d-4009-8aa0-63f411eb34ff","modified":"2026-07-31T18:47:49.724Z","references":[{"source_name":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--90f5c230-407d-45ba-85db-44cd3ecea06d","subject":"ATTACK:enterprise:S9050","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--90f5c230-407d-45ba-85db-44cd3ecea06d","modified":"2026-09-25T17:55:08.070Z","references":[{"source_name":"Cyfirma_Vidar_June2024","url":"https://www.cyfirma.com/research/vidar-stealer-an-in-depth-analysis-of-an-information-stealing-malware/"},{"source_name":"Logpoint_StealerMalwareFamilies_2024","url":"https://web.archive.org/web/20240517205011/https://www.logpoint.com/wp-content/uploads/2024/03/logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families-1.pdf"},{"source_name":"Unit42_Vidar_July2026","url":"https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9105b1f2-17a4-4c2c-9ec9-3bff60b0b898","subject":"ATTACK:enterprise:S1170","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9105b1f2-17a4-4c2c-9ec9-3bff60b0b898","modified":"2026-04-29T14:23:06.123Z","references":[{"source_name":"ESET OilRig Downloaders DEC 2023","url":"https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--911d7f27-a32e-45fb-a66b-e7b195023c43","subject":"ATTACK:enterprise:S0431","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--911d7f27-a32e-45fb-a66b-e7b195023c43","modified":"2026-04-29T14:23:06.123Z","references":[{"source_name":"Carbon Black HotCroissant April 2020","url":"https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--91e69232-941e-43bf-9f10-b0e4cf8b43d1","subject":"ATTACK:enterprise:S1130","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--91e69232-941e-43bf-9f10-b0e4cf8b43d1","modified":"2026-04-29T14:23:06.124Z","references":[{"source_name":"HP RaspberryRobin 2024","url":"https://threatresearch.ext.hp.com/raspberry-robin-now-spreading-through-windows-script-files/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--922af0dd-415c-4512-9fe2-710a954f4c80","subject":"ATTACK:enterprise:S0643","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--922af0dd-415c-4512-9fe2-710a954f4c80","modified":"2026-04-29T14:23:06.124Z","references":[{"source_name":"Proofpoint Operation Transparent Tribe March 2016","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--922c214d-ad32-4490-bb3f-a4db73b718d5","subject":"ATTACK:enterprise:S0078","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--922c214d-ad32-4490-bb3f-a4db73b718d5","modified":"2026-04-29T14:23:06.124Z","references":[{"source_name":"Scarlet Mimic Jan 2016","url":"http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--93189ca3-7dfd-4c82-a7c7-a457a093d1d3","subject":"ATTACK:enterprise:S0600","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--93189ca3-7dfd-4c82-a7c7-a457a093d1d3","modified":"2026-04-29T14:23:06.125Z","references":[{"source_name":"Intezer Doki July 20","url":"https://www.intezer.com/blog/cloud-security/watch-your-containers-doki-infecting-docker-servers-in-the-cloud/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--93cf8ff7-a559-4fc9-ba31-18c0ebdc5244","subject":"ATTACK:enterprise:S1114","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--93cf8ff7-a559-4fc9-ba31-18c0ebdc5244","modified":"2026-04-29T14:23:06.126Z","references":[{"source_name":"Mandiant Cutting Edge January 2024","url":"https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--941c2dbc-ca93-4206-b023-fabc7476ac16","subject":"ATTACK:enterprise:G0030","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--941c2dbc-ca93-4206-b023-fabc7476ac16","modified":"2026-07-31T18:48:07.085Z","references":[{"source_name":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--94472a50-e097-4b67-9f59-2840a1633a0f","subject":"ATTACK:enterprise:S0250","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--94472a50-e097-4b67-9f59-2840a1633a0f","modified":"2026-04-29T14:23:06.127Z","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--95801883-3fa4-4385-a48f-4a92dd8e1e09","subject":"ATTACK:enterprise:S0564","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--95801883-3fa4-4385-a48f-4a92dd8e1e09","modified":"2026-04-29T14:23:06.129Z","references":[{"source_name":"Microsoft GALLIUM December 2019","url":"https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--95a8788a-b36c-4234-94bc-951eb1f72cce","subject":"ATTACK:enterprise:S1023","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--95a8788a-b36c-4234-94bc-951eb1f72cce","modified":"2026-04-29T14:23:06.129Z","references":[{"source_name":"Microsoft POLONIUM June 2022","url":"https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--95e83e36-ba44-4e8f-8afe-ff6622fd6f84","subject":"ATTACK:enterprise:G1014","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--95e83e36-ba44-4e8f-8afe-ff6622fd6f84","modified":"2026-07-31T18:48:14.908Z","references":[{"source_name":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"},{"source_name":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9627b2de-6420-480f-add5-312622eb957c","subject":"ATTACK:enterprise:C0014","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9627b2de-6420-480f-add5-312622eb957c","modified":"2026-07-31T18:47:31.777Z","references":[{"source_name":"FoxIT Wocao December 2019","url":"https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9670979e-9785-45f0-a470-f591c97f6f8a","subject":"ATTACK:enterprise:S0184","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9670979e-9785-45f0-a470-f591c97f6f8a","modified":"2026-04-29T14:23:06.130Z","references":[{"source_name":"FireEye APT34 Dec 2017","url":"https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--96ea567d-7113-4c2e-82c4-2ae6c6916ae9","subject":"ATTACK:enterprise:S0387","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--96ea567d-7113-4c2e-82c4-2ae6c6916ae9","modified":"2026-04-29T14:23:06.131Z","references":[{"source_name":"PWC KeyBoys Feb 2017","url":"https://web.archive.org/web/20211129064701/https://www.pwc.co.uk/issues/cyber-security-services/research/the-keyboys-are-back-in-town.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--98396d16-6e9a-4eee-a806-a841ed334142","subject":"ATTACK:enterprise:C0060","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--98396d16-6e9a-4eee-a806-a841ed334142","modified":"2026-07-31T18:47:27.101Z","references":[{"source_name":"Trend Micro Earth Kasha Anel NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9866c9ca-d769-458c-9797-112beb97498d","subject":"ATTACK:enterprise:S0567","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9866c9ca-d769-458c-9797-112beb97498d","modified":"2026-04-29T14:23:06.133Z","references":[{"source_name":"Securelist Dtrack","url":"https://securelist.com/my-name-is-dtrack/93338/"},{"source_name":"CyberBit Dtrack","url":"https://www.cyberbit.com/blog/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--991c16bd-c17b-479a-8f45-385467323c0a","subject":"ATTACK:enterprise:S0031","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--991c16bd-c17b-479a-8f45-385467323c0a","modified":"2026-04-29T14:23:06.134Z","references":[{"source_name":"FireEye APT30","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--992c7f74-c6d8-43e9-98e7-5818ca9524e3","subject":"ATTACK:enterprise:S0255","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--992c7f74-c6d8-43e9-98e7-5818ca9524e3","modified":"2026-04-29T14:23:06.134Z","references":[{"source_name":"Rancor Unit42 June 2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9c3faa58-eb39-407a-8233-8f43f53aa777","subject":"ATTACK:enterprise:S0354","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9c3faa58-eb39-407a-8233-8f43f53aa777","modified":"2026-04-29T14:23:06.138Z","references":[{"source_name":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source_name":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9c75cda8-5656-4968-8a74-738d1b2b0399","subject":"ATTACK:enterprise:S1142","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9c75cda8-5656-4968-8a74-738d1b2b0399","modified":"2026-04-29T14:23:06.138Z","references":[{"source_name":"ESET Turla Lunar toolset May 2024","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9ca67039-be32-4fed-a40a-5ddfe4d6fff2","subject":"ATTACK:enterprise:S1139","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9ca67039-be32-4fed-a40a-5ddfe4d6fff2","modified":"2026-06-12T19:52:54.217Z","references":[{"source_name":"Cybereason INC Ransomware November 2023","url":"https://web.archive.org/web/20231202022946/https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"},{"source_name":"SentinelOne INC Ransomware","url":"https://www.sentinelone.com/anthology/inc-ransom/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9cbfc2f6-0b87-402c-b536-2d9688b2e0ea","subject":"ATTACK:enterprise:S0402","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9cbfc2f6-0b87-402c-b536-2d9688b2e0ea","modified":"2026-04-29T14:23:06.139Z","references":[{"source_name":"sentinelone shlayer to zshlayer","url":"https://www.sentinelone.com/blog/coming-out-of-your-shell-from-shlayer-to-zshlayer/"},{"source_name":"20 macOS Common Tools and Techniques","url":"https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9d28bf78-0fde-4efd-85b2-fc1960f1b386","subject":"ATTACK:enterprise:S1027","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9d28bf78-0fde-4efd-85b2-fc1960f1b386","modified":"2026-04-29T14:23:06.139Z","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9e235097-0a3a-410f-b3a1-ec50ea910d47","subject":"ATTACK:enterprise:S0193","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9e235097-0a3a-410f-b3a1-ec50ea910d47","modified":"2026-04-29T14:23:06.141Z","references":[{"source_name":"Überwachung APT28 Forfiles June 2015","url":"https://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9e9b9874-f853-4945-9389-54174c2a7bfc","subject":"ATTACK:enterprise:S0498","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9e9b9874-f853-4945-9389-54174c2a7bfc","modified":"2026-04-29T14:23:06.141Z","references":[{"source_name":"SentinelOne Lazarus macOS July 2020","url":"https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9f44fb67-6ad0-44c3-bc84-8b12b50819a9","subject":"ATTACK:enterprise:S1111","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9f44fb67-6ad0-44c3-bc84-8b12b50819a9","modified":"2026-04-29T14:23:06.142Z","references":[{"source_name":"Ensilo Darkgate 2018","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9fcdfab7-1388-4eb1-8cd0-44c42692bb83","subject":"ATTACK:enterprise:S1212","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9fcdfab7-1388-4eb1-8cd0-44c42692bb83","modified":"2026-04-29T14:23:06.143Z","references":[{"source_name":"Group-IB RansomHub FEB 2025","url":"https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a00bb928-c644-4b77-ae9c-18c3165daa00","subject":"ATTACK:enterprise:S0212","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a00bb928-c644-4b77-ae9c-18c3165daa00","modified":"2026-04-29T14:23:06.143Z","references":[{"source_name":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a3251b26-7012-4f26-9c5d-1fb9d69b8569","subject":"ATTACK:enterprise:S0070","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a3251b26-7012-4f26-9c5d-1fb9d69b8569","modified":"2026-04-29T14:23:06.147Z","references":[{"source_name":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source_name":"ZScaler Hacking Team","url":"http://research.zscaler.com/2015/08/chinese-cyber-espionage-apt-group.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a4710756-98de-4242-b908-f9a0d6148a97","subject":"ATTACK:enterprise:S1244","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a4710756-98de-4242-b908-f9a0d6148a97","modified":"2026-04-29T14:23:06.149Z","references":[{"source_name":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source_name":"Security Scorecard Medusa Ransomware January 2024","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a5872314-732e-4896-a817-13986774d62c","subject":"ATTACK:enterprise:C0022","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a5872314-732e-4896-a817-13986774d62c","modified":"2026-07-31T21:14:22.782Z","references":[{"source_name":"ClearSky Lazarus Aug 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a7c21399-4d37-4a42-9933-64ad00ab4e07","subject":"ATTACK:enterprise:C0064","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a7c21399-4d37-4a42-9933-64ad00ab4e07","modified":"2026-09-23T22:02:05.710Z","references":[{"source_name":"AI-Mexico-Govt-Breach","url":"https://cdn.prod.website-files.com/69944dd945f20ca4a27a7c47/69d8bb5aea59e31efb3b8a7f_Tech_Report_ai_breach_mex_gov.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a7c4675f-bc26-4dcf-977c-2966f195260f","subject":"ATTACK:enterprise:S9030","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a7c4675f-bc26-4dcf-977c-2966f195260f","modified":"2026-04-29T14:23:06.154Z","references":[{"source_name":"Check Point Wirte NOV 2024","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a802d52a-01f4-44c8-b80d-d2c746e1e31d","subject":"ATTACK:enterprise:S0144","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a802d52a-01f4-44c8-b80d-d2c746e1e31d","modified":"2026-04-29T14:23:06.154Z","references":[{"source_name":"FireEye APT10 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a8b248fe-a27c-40fd-83d5-f4382035d656","subject":"ATTACK:enterprise:G0022","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a8b248fe-a27c-40fd-83d5-f4382035d656","modified":"2026-07-31T18:47:38.122Z","references":[{"source_name":"FireEye Clandestine Fox","url":"https://www.fireeye.com/blog/threat-research/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html"},{"source_name":"evolution of pirpi","url":"https://recon.cx/2017/montreal/resources/slides/RECON-MTL-2017-evolution_of_pirpi.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a933bad9-0f92-4a25-9b46-19120737caee","subject":"ATTACK:enterprise:G0050","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a933bad9-0f92-4a25-9b46-19120737caee","modified":"2026-07-31T18:47:45.223Z","references":[{"source_name":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ab1b96ad-3ad8-4b16-b886-559f693496ff","subject":"ATTACK:enterprise:G0129","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ab1b96ad-3ad8-4b16-b886-559f693496ff","modified":"2026-07-31T18:47:52.987Z","references":[{"source_name":"Avira Mustang Panda January 2020","url":"https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"},{"source_name":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ab27d055-77bb-4a3d-89b2-771e532f7384","subject":"ATTACK:enterprise:S0208","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ab27d055-77bb-4a3d-89b2-771e532f7384","modified":"2026-04-29T14:23:06.158Z","references":[{"source_name":"Symantec Pasam May 2012","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-050412-4128-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ac0de65d-dc44-4575-a175-167e9c85cde9","subject":"ATTACK:enterprise:S1059","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ac0de65d-dc44-4575-a175-167e9c85cde9","modified":"2026-04-29T14:23:06.159Z","references":[{"source_name":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"},{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ad3f239b-8a48-40dd-aa07-71fddb19e275","subject":"ATTACK:enterprise:S0629","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ad3f239b-8a48-40dd-aa07-71fddb19e275","modified":"2026-04-29T14:23:06.161Z","references":[{"source_name":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aef68e46-d1e1-49b9-aade-6c1bf226e053","subject":"ATTACK:enterprise:S0260","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aef68e46-d1e1-49b9-aade-6c1bf226e053","modified":"2026-04-29T14:23:06.163Z","references":[{"source_name":"ESET InvisiMole June 2018","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b0a6695b-e5ab-47b3-adfd-4db09c41457e","subject":"ATTACK:enterprise:C0002","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b0a6695b-e5ab-47b3-adfd-4db09c41457e","modified":"2026-07-31T18:47:31.052Z","references":[{"source_name":"McAfee Night Dragon","url":"https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b106375b-8359-41fa-b979-c883fa827346","subject":"ATTACK:enterprise:S0249","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b106375b-8359-41fa-b979-c883fa827346","modified":"2026-04-29T14:23:06.167Z","references":[{"source_name":"McAfee Gold Dragon","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b1c5e842-5fdd-445e-a778-ffc9ca7ef219","subject":"ATTACK:enterprise:S1162","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b1c5e842-5fdd-445e-a778-ffc9ca7ef219","modified":"2026-04-29T14:23:06.168Z","references":[{"source_name":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b2b29042-e638-446f-94c6-c7de3711884f","subject":"ATTACK:enterprise:S9042","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b2b29042-e638-446f-94c6-c7de3711884f","modified":"2026-07-28T17:58:51.894Z","references":[{"source_name":"Aikido TeamPCP Trivy MAR 2026","url":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b2c4bc70-088c-4e99-863b-65c4267c7220","subject":"ATTACK:enterprise:S0622","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b2c4bc70-088c-4e99-863b-65c4267c7220","modified":"2026-04-29T14:23:06.169Z","references":[{"source_name":"Malwarebytes Kimsuky June 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b37173c1-b29d-4a95-b79c-787b1acab673","subject":"ATTACK:enterprise:S0488","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b37173c1-b29d-4a95-b79c-787b1acab673","modified":"2026-04-29T14:23:06.170Z","references":[{"source_name":"CME Github September 2018","url":"https://github.com/byt3bl33d3r/CrackMapExec/wiki/SMB-Command-Reference"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b3c50e22-4f4c-490c-9284-0af1c0543821","subject":"ATTACK:enterprise:S0661","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b3c50e22-4f4c-490c-9284-0af1c0543821","modified":"2026-04-29T14:23:06.171Z","references":[{"source_name":"MSTIC FoggyWeb September 2021","url":"https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b3c69087-f989-4f93-924a-0d6df6c75315","subject":"ATTACK:enterprise:S0351","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b3c69087-f989-4f93-924a-0d6df6c75315","modified":"2026-04-29T14:23:06.171Z","references":[{"source_name":"Unit42 Cannon Nov 2018","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b567c4eb-669f-4e1b-b3dd-a5f3b9bdf567","subject":"ATTACK:enterprise:S0526","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b567c4eb-669f-4e1b-b3dd-a5f3b9bdf567","modified":"2026-04-29T14:23:06.173Z","references":[{"source_name":"Cybereason Kimsuky November 2020","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b57b7604-1b4c-4ee2-aa1a-737f459df99f","subject":"ATTACK:enterprise:S1122","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b57b7604-1b4c-4ee2-aa1a-737f459df99f","modified":"2026-04-29T14:23:06.173Z","references":[{"source_name":"ESET Security Mispadu Facebook Ads 2019","url":"https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b580bd73-72e4-479a-b8c8-221e12dc00db","subject":"ATTACK:enterprise:S0612","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b580bd73-72e4-479a-b8c8-221e12dc00db","modified":"2026-04-29T14:23:06.173Z","references":[{"source_name":"NCC Group WastedLocker June 2020","url":"https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b7226792-d4ae-472c-a407-853d56fc887d","subject":"ATTACK:enterprise:S0272","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b7226792-d4ae-472c-a407-853d56fc887d","modified":"2026-04-29T14:23:06.175Z","references":[{"source_name":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b7999bd1-4704-489d-8fc3-80661592b6dc","subject":"ATTACK:enterprise:S0015","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b7999bd1-4704-489d-8fc3-80661592b6dc","modified":"2026-04-29T14:23:06.176Z","references":[{"source_name":"Trend Micro IXESHE 2012","url":"https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b7b24f8b-e156-407b-aa3d-3d2c18c84c2d","subject":"ATTACK:enterprise:S9009","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b7b24f8b-e156-407b-aa3d-3d2c18c84c2d","modified":"2026-04-29T14:23:06.176Z","references":[{"source_name":"Black Hills Information Security TruffleHog January 2024","url":"https://www.blackhillsinfosec.com/rooting-for-secrets-with-trufflehog/"},{"source_name":"Netskope Shai-Hulud November 2025","url":"https://www.netskope.com/blog/shai-hulud-2-0-aggressive-automated-one-of-fastest-spreading-npm-supply-chain-attacks-ever-observed"},{"source_name":"Github TruffleSecurity Trufflehog April 2025","url":"https://github.com/trufflesecurity/trufflehog"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b7cd4d27-492d-4abf-8fee-27e2449ba26d","subject":"ATTACK:enterprise:S1194","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b7cd4d27-492d-4abf-8fee-27e2449ba26d","modified":"2026-04-29T14:23:06.176Z","references":[{"source_name":"CISA Akira Ransomware APR 2024","url":"https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf"},{"source_name":"Cisco Akira Ransomware OCT 2024","url":"https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/"},{"source_name":"Palo Alto Howling Scorpius DEC 2024","url":"https://unit42.paloaltonetworks.com/threat-assessment-howling-scorpius-akira-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b8f1354c-9cff-40ef-aa47-591952c735c3","subject":"ATTACK:enterprise:S0093","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b8f1354c-9cff-40ef-aa47-591952c735c3","modified":"2026-04-29T14:23:06.178Z","references":[{"source_name":"Symantec Dragonfly","url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b9fe8dd4-a3c9-4e58-9a74-937e4de677a8","subject":"ATTACK:enterprise:S0021","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b9fe8dd4-a3c9-4e58-9a74-937e4de677a8","modified":"2026-04-29T14:23:06.179Z","references":[{"source_name":"Fidelis Turbo","url":"https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2016/2016.02.29.Turbo_Campaign_Derusbi/TA_Fidelis_Turbo_1602_0.pdf"},{"source_name":"FireEye Periscope March 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ba0d8cf0-e6a7-4465-b818-d7b71b441919","subject":"ATTACK:enterprise:S0623","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ba0d8cf0-e6a7-4465-b818-d7b71b441919","modified":"2026-04-29T14:23:06.179Z","references":[{"source_name":"Unit 42 Siloscape Jun 2021","url":"https://unit42.paloaltonetworks.com/siloscape/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ba65edc3-e0ef-477f-92c8-ffa2e2a943c5","subject":"ATTACK:enterprise:G0087","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ba65edc3-e0ef-477f-92c8-ffa2e2a943c5","modified":"2026-07-31T18:47:53.920Z","references":[{"source_name":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bad38b14-93b7-42a3-b0a3-6170aa895734","subject":"ATTACK:enterprise:G1022","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bad38b14-93b7-42a3-b0a3-6170aa895734","modified":"2026-07-31T18:48:14.356Z","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bae19e73-3612-42a3-be35-5f5b2adfc5b7","subject":"ATTACK:enterprise:S1034","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bae19e73-3612-42a3-be35-5f5b2adfc5b7","modified":"2026-04-29T14:23:06.180Z","references":[{"source_name":"Cybereason StrifeWater Feb 2022","url":"https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bc72acee-e417-4de8-8084-153e141917b6","subject":"ATTACK:enterprise:S0079","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bc72acee-e417-4de8-8084-153e141917b6","modified":"2026-04-29T14:23:06.182Z","references":[{"source_name":"Scarlet Mimic Jan 2016","url":"http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bc74cabe-b8bc-4873-a6ff-e16d8f91299f","subject":"ATTACK:enterprise:S0657","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bc74cabe-b8bc-4873-a6ff-e16d8f91299f","modified":"2026-04-29T14:23:06.182Z","references":[{"source_name":"Volexity InkySquid BLUELIGHT August 2021","url":"https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bcc26139-8236-4703-9b71-a261e7642dc6","subject":"ATTACK:enterprise:S9067","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bcc26139-8236-4703-9b71-a261e7642dc6","modified":"2026-10-01T21:53:46.109Z","references":[{"source_name":"Mandiant_UNC1549_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bd610e42-b791-4322-8451-5fab556b6c28","subject":"ATTACK:enterprise:S1043","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bd610e42-b791-4322-8451-5fab556b6c28","modified":"2026-04-29T14:23:06.184Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bd745d11-93d8-45db-8a68-08a52383375a","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bd745d11-93d8-45db-8a68-08a52383375a","modified":"2026-07-31T20:48:47.122Z","references":[{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bee5895c-6671-4563-831b-38cb510e29fe","subject":"ATTACK:enterprise:S0692","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bee5895c-6671-4563-831b-38cb510e29fe","modified":"2026-04-29T14:23:06.186Z","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bfc84868-c168-4db4-be39-641cfab0619a","subject":"ATTACK:enterprise:G0012","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bfc84868-c168-4db4-be39-641cfab0619a","modified":"2026-07-31T18:48:12.032Z","references":[{"source_name":"Microsoft DUBNIUM July 2016","url":"https://www.microsoft.com/security/blog/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bfd1c3ca-ea2c-4b0e-8b0a-815b8ebb4dfb","subject":"ATTACK:enterprise:S0467","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bfd1c3ca-ea2c-4b0e-8b0a-815b8ebb4dfb","modified":"2026-04-29T14:23:06.187Z","references":[{"source_name":"Kaspersky TajMahal April 2019","url":"https://securelist.com/project-tajmahal/90240/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bfe5c795-c95c-4387-b3d9-813078e7e99a","subject":"ATTACK:enterprise:S1058","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bfe5c795-c95c-4387-b3d9-813078e7e99a","modified":"2026-04-29T14:23:06.188Z","references":[{"source_name":"Microsoft Prestige ransomware October 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c108cde7-50d1-4472-9061-0055abcba3f6","subject":"ATTACK:enterprise:S1198","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c108cde7-50d1-4472-9061-0055abcba3f6","modified":"2026-04-29T14:23:06.189Z","references":[{"source_name":"Symantec Troll Stealer 2024","url":"https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c33b2278-04ef-4506-8406-37700b797af6","subject":"ATTACK:enterprise:G1040","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c33b2278-04ef-4506-8406-37700b797af6","modified":"2026-07-31T18:48:25.936Z","references":[{"source_name":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c388ff7b-98ec-4f91-97a3-b4fb1772e661","subject":"ATTACK:enterprise:S9052","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c388ff7b-98ec-4f91-97a3-b4fb1772e661","modified":"2026-09-24T18:51:43.161Z","references":[{"source_name":"CheckPoint_NimbusManticore_May2026","url":"https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c3ee174d-fd40-4636-97b2-afe80854f987","subject":"ATTACK:enterprise:S0157","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c3ee174d-fd40-4636-97b2-afe80854f987","modified":"2026-04-29T14:23:06.193Z","references":[{"source_name":"FireEye APT32 May 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c767aaab-168c-4585-af3e-f4fb95fede69","subject":"ATTACK:enterprise:S0592","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c767aaab-168c-4585-af3e-f4fb95fede69","modified":"2026-04-29T14:23:06.198Z","references":[{"source_name":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c7fee556-41c2-43bd-a732-e11ff34fb129","subject":"ATTACK:enterprise:S0203","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c7fee556-41c2-43bd-a732-e11ff34fb129","modified":"2026-04-29T14:23:06.199Z","references":[{"source_name":"Symantec Trojan.Hydraq Jan 2010","url":"https://www.symantec.com/connect/blogs/trojanhydraq-incident"},{"source_name":"Symantec Hydraq Jan 2010","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2010-011114-1830-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c85dc67b-42f9-4fdd-a91c-7fc24ef4c9fe","subject":"ATTACK:enterprise:S1242","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c85dc67b-42f9-4fdd-a91c-7fc24ef4c9fe","modified":"2026-04-29T14:23:06.199Z","references":[{"source_name":"Trend Micro Agenda Ransomware AUG 2022","url":"https://www.trendmicro.com/en_us/research/22/h/new-golang-ransomware-agenda-customizes-attacks.html"},{"source_name":"Trend Micro Agenda Ransomware OCT 2025","url":"https://www.trendmicro.com/en_us/research/25/j/agenda-ransomware-deploys-linux-variant-on-windows-systems.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c8b0afbb-12eb-4b45-a1e1-b11755de2976","subject":"ATTACK:enterprise:S0142","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c8b0afbb-12eb-4b45-a1e1-b11755de2976","modified":"2026-04-29T14:23:06.200Z","references":[{"source_name":"Cylance Shell Crew Feb 2017","url":"https://www.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c9349d94-ea50-4446-a50e-bb920812aded","subject":"ATTACK:enterprise:S0011","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c9349d94-ea50-4446-a50e-bb920812aded","modified":"2026-04-29T14:23:06.200Z","references":[{"source_name":"CISA MAR-10292089-1.v2 TAIDOOR August 2021","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ca295c89-bee0-4702-b0e1-61416023bacb","subject":"ATTACK:enterprise:G0045","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ca295c89-bee0-4702-b0e1-61416023bacb","modified":"2026-07-31T18:47:44.520Z","references":[{"source_name":"Symantec Cicada November 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ca2f6580-fb02-4687-b514-94bad87f7bf8","subject":"ATTACK:enterprise:S0520","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ca2f6580-fb02-4687-b514-94bad87f7bf8","modified":"2026-04-29T14:23:06.201Z","references":[{"source_name":"US-CERT BLINDINGCAN Aug 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"},{"source_name":"NHS UK BLINDINGCAN Aug 2020","url":"https://digital.nhs.uk/cyber-alerts/2020/cc-3603"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ca5fef73-8710-4c03-a9ea-2012d6287cae","subject":"ATTACK:enterprise:S9020","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ca5fef73-8710-4c03-a9ea-2012d6287cae","modified":"2026-04-29T14:23:06.202Z","references":[{"source_name":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"},{"source_name":"ITOCHU LODEINFO JAN 2024","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--caef212a-7ed2-4cb9-a155-7ce79a9784b8","subject":"ATTACK:enterprise:S0266","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--caef212a-7ed2-4cb9-a155-7ce79a9784b8","modified":"2026-04-29T14:23:06.202Z","references":[{"source_name":"S2 Grupo TrickBot June 2017","url":"https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf"},{"source_name":"Trend Micro Trickbot Nov 2018","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-shows-off-new-trick-password-grabber-module/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cafaa08a-1f40-40cb-a3fd-c507a1cc6e40","subject":"ATTACK:enterprise:S0332","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cafaa08a-1f40-40cb-a3fd-c507a1cc6e40","modified":"2026-04-29T14:23:06.202Z","references":[{"source_name":"Riskiq Remcos Jan 2018","url":"https://web.archive.org/web/20180124082756/https://www.riskiq.com/blog/labs/spear-phishing-turkish-defense-contractors/"},{"source_name":"Fortinet Remcos Campaign NOV 2024","url":"https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cb11835b-c16e-4877-8769-806277b994fc","subject":"ATTACK:enterprise:S1060","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cb11835b-c16e-4877-8769-806277b994fc","modified":"2026-04-29T14:23:06.203Z","references":[{"source_name":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cb61aee9-03ac-4170-bfcc-3dda0f12f9f0","subject":"ATTACK:enterprise:S1246","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cb61aee9-03ac-4170-bfcc-3dda0f12f9f0","modified":"2026-04-29T14:23:06.203Z","references":[{"source_name":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"},{"source_name":"Socket HexEval BeaverTail Contagious Interview June 2025","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"},{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cb62e09c-5092-418e-99d3-ab7b5fc73017","subject":"ATTACK:enterprise:S0582","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cb62e09c-5092-418e-99d3-ab7b5fc73017","modified":"2026-04-29T14:23:06.203Z","references":[{"source_name":"Proofpoint LookBack Malware Aug 2019","url":"https://www.proofpoint.com/us/threat-insight/post/lookback-malware-targets-united-states-utilities-sector-phishing-attacks"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cbc2cb80-8f07-46dd-b167-3f237e39f39d","subject":"ATTACK:enterprise:S0456","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cbc2cb80-8f07-46dd-b167-3f237e39f39d","modified":"2026-04-29T14:23:06.204Z","references":[{"source_name":"CheckPoint Naikon May 2020","url":"https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cca42159-8fb2-4278-b6f9-e4a6550a99d7","subject":"ATTACK:enterprise:S1234","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cca42159-8fb2-4278-b6f9-e4a6550a99d7","modified":"2026-04-29T14:23:06.205Z","references":[{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ccb67d98-71d6-4a26-86b6-281174ca07b0","subject":"ATTACK:enterprise:S0088","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ccb67d98-71d6-4a26-86b6-281174ca07b0","modified":"2026-04-29T14:23:06.205Z","references":[{"source_name":"Zscaler Kasidet","url":"http://research.zscaler.com/2016/01/malicious-office-files-dropping-kasidet.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cdd92791-3bc2-4a1f-89b4-3eced4aa667f","subject":"ATTACK:enterprise:G0094","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cdd92791-3bc2-4a1f-89b4-3eced4aa667f","modified":"2026-07-31T20:48:25.504Z","references":[{"source_name":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source_name":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source_name":"Securelist Kimsuky Sept 2013","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"},{"source_name":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cde9af4e-4bf9-4235-9d27-496eb78e3608","subject":"ATTACK:enterprise:S0458","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cde9af4e-4bf9-4235-9d27-496eb78e3608","modified":"2026-04-29T14:23:06.207Z","references":[{"source_name":"Eset Ramsay May 2020","url":"https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"},{"source_name":"Antiy CERT Ramsay April 2020","url":"https://www.programmersought.com/article/62493896999/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ce67a5bb-66a8-4926-ae72-64ef08040770","subject":"ATTACK:enterprise:S1022","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ce67a5bb-66a8-4926-ae72-64ef08040770","modified":"2026-04-29T14:23:06.207Z","references":[{"source_name":"CrowdStrike IceApple May 2022","url":"https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ce85101e-baca-4a1a-9352-9c9db89706a4","subject":"ATTACK:enterprise:S1028","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ce85101e-baca-4a1a-9352-9c9db89706a4","modified":"2026-04-29T14:23:06.208Z","references":[{"source_name":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cf249a85-b0e9-4264-899f-164cdfa5a7c8","subject":"ATTACK:enterprise:G0125","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cf249a85-b0e9-4264-899f-164cdfa5a7c8","modified":"2026-07-31T18:47:44.785Z","references":[{"source_name":"Rapid7 HAFNIUM Mar 2021","url":"https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cfaf6b8e-1ee0-40bf-8a60-27f9c68d86c5","subject":"ATTACK:enterprise:S0448","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cfaf6b8e-1ee0-40bf-8a60-27f9c68d86c5","modified":"2026-04-29T14:23:06.209Z","references":[{"source_name":"McAfee Sharpshooter December 2018","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d0332cfa-d932-4bc3-b661-9cd72c00b390","subject":"ATTACK:enterprise:S0035","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d0332cfa-d932-4bc3-b661-9cd72c00b390","modified":"2026-04-29T14:23:06.210Z","references":[{"source_name":"FireEye APT30","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d0a2aa1e-a824-47b8-99a5-c2d026c9432d","subject":"ATTACK:enterprise:S0587","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d0a2aa1e-a824-47b8-99a5-c2d026c9432d","modified":"2026-04-29T14:23:06.211Z","references":[{"source_name":"Leonardo Turla Penquin May 2020","url":"https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d0c60722-e668-4597-a25f-f7e1eb1a5962","subject":"ATTACK:enterprise:S0409","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d0c60722-e668-4597-a25f-f7e1eb1a5962","modified":"2026-04-29T14:23:06.211Z","references":[{"source_name":"ESET Machete July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"},{"source_name":"Cylance Machete Mar 2017","url":"https://threatvector.cylance.com/en_us/home/el-machete-malware-attacks-cut-through-latam.html"},{"source_name":"360 Machete Sep 2020","url":"https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d26769f7-5e2d-4aa4-b6bb-a7b72e601a22","subject":"ATTACK:enterprise:C0063","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d26769f7-5e2d-4aa4-b6bb-a7b72e601a22","modified":"2026-07-31T20:48:19.990Z","references":[{"source_name":"CERT Polska","url":"https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d3d69fb7-c6f3-43d7-bb38-ac26fe22b5be","subject":"ATTACK:enterprise:S1150","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d3d69fb7-c6f3-43d7-bb38-ac26fe22b5be","modified":"2026-04-29T14:23:06.215Z","references":[{"source_name":"CISA Iran Albanian Attacks September 2022","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a"},{"source_name":"Mandiant ROADSWEEP August 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"},{"source_name":"Microsoft Albanian Government Attacks September 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d412ff4a-d9d0-44a9-b8b3-36a650f18036","subject":"ATTACK:enterprise:S0148","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d412ff4a-d9d0-44a9-b8b3-36a650f18036","modified":"2026-04-29T14:23:06.215Z","references":[{"source_name":"Unit42 Redaman January 2019","url":"https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d466eac7-775f-4f63-98cc-31d719ea109d","subject":"ATTACK:enterprise:S9059","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d466eac7-775f-4f63-98cc-31d719ea109d","modified":"2026-09-28T18:43:37.823Z","references":[{"source_name":"Mandiant_UNC1549_Feb2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d4c9b3cb-44ca-47be-b10f-2371ef1c23df","subject":"ATTACK:enterprise:S0356","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d4c9b3cb-44ca-47be-b10f-2371ef1c23df","modified":"2026-04-29T14:23:06.216Z","references":[{"source_name":"Talos Konni May 2017","url":"https://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d4ca926c-6976-4ee8-a5b0-89aa11931bea","subject":"ATTACK:enterprise:S0153","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d4ca926c-6976-4ee8-a5b0-89aa11931bea","modified":"2026-04-29T14:23:06.216Z","references":[{"source_name":"FireEye APT10 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"},{"source_name":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d618ef5e-5d76-4014-8c86-9357c4c7f749","subject":"ATTACK:enterprise:G0142","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d618ef5e-5d76-4014-8c86-9357c4c7f749","modified":"2026-07-31T20:48:37.650Z","references":[{"source_name":"TrendMicro Confucius APT Aug 2021","url":"https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d6624fc4-3aed-47c9-a4d9-aafc008f876f","subject":"ATTACK:enterprise:S0670","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d6624fc4-3aed-47c9-a4d9-aafc008f876f","modified":"2026-04-29T14:23:06.218Z","references":[{"source_name":"Check Point Warzone Feb 2020","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d67b8cc9-00e4-4f9b-8771-03a34739e01b","subject":"ATTACK:enterprise:S1167","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d67b8cc9-00e4-4f9b-8771-03a34739e01b","modified":"2026-04-29T14:23:06.218Z","references":[{"source_name":"SentinelOne AcidPour 2024","url":"https://www.sentinelone.com/labs/acidpour-new-embedded-wiper-variant-of-acidrain-appears-in-ukraine/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d9416afb-0aeb-4ee3-bd96-dc331f40f37d","subject":"ATTACK:enterprise:G0096","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d9416afb-0aeb-4ee3-bd96-dc331f40f37d","modified":"2026-07-31T20:48:27.586Z","references":[{"source_name":"FireEye APT41 March 2020","url":"https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--da68918d-d389-4e05-a5fa-980888e57157","subject":"ATTACK:enterprise:S9015","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--da68918d-d389-4e05-a5fa-980888e57157","modified":"2026-04-29T14:23:06.223Z","references":[{"source_name":"CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025","url":"https://www.crowdstrike.com/en-us/blog/warp-panda-cloud-threats/"},{"source_name":"CISA BRICKSTORM UNC5221 AR25-338A February 2026","url":"https://www.cisa.gov/news-events/analysis-reports/ar25-338a"},{"source_name":"Picus Security BRICKSTORM UNC5221 October 2025","url":"https://www.picussecurity.com/resource/blog/brickstorm-malware-unc5221-targets-tech-and-legal-sectors-in-the-united-states"},{"source_name":"Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement"},{"source_name":"NVISO BRICKSTORM April 2025","url":"https://blog.nviso.eu/wp-content/uploads/2025/04/NVISO-BRICKSTORM-Report.pdf"},{"source_name":"Google BRICKSTORM September 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--db0b0cf9-cb49-43ed-aa61-d4215d1775b8","subject":"ATTACK:enterprise:G0044","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--db0b0cf9-cb49-43ed-aa61-d4215d1775b8","modified":"2026-07-31T18:48:18.789Z","references":[{"source_name":"Kaspersky Winnti April 2013","url":"https://securelist.com/winnti-more-than-just-a-game/37029/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dbc22e6e-df81-4f17-924e-3ce456ee2f16","subject":"ATTACK:enterprise:S1125","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dbc22e6e-df81-4f17-924e-3ce456ee2f16","modified":"2026-04-29T14:23:06.225Z","references":[{"source_name":"AcidRain JAGS 2022","url":"https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dbc56199-173e-4325-af52-ee6fd26dbdb6","subject":"ATTACK:enterprise:S1018","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dbc56199-173e-4325-af52-ee6fd26dbdb6","modified":"2026-04-29T14:23:06.225Z","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dd88acc4-a6c0-43ac-9967-6158469d97bb","subject":"ATTACK:enterprise:S0630","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dd88acc4-a6c0-43ac-9967-6158469d97bb","modified":"2026-04-29T14:23:06.227Z","references":[{"source_name":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ddbbd283-6874-4348-82c7-98df6d59ac41","subject":"ATTACK:enterprise:S0277","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ddbbd283-6874-4348-82c7-98df6d59ac41","modified":"2026-04-29T14:23:06.228Z","references":[{"source_name":"objsee mac malware 2017","url":"https://objective-see.com/blog/blog_0x25.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--de15c868-b002-415c-937b-b365e4c60597","subject":"ATTACK:enterprise:S0658","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--de15c868-b002-415c-937b-b365e4c60597","modified":"2026-04-29T14:23:06.228Z","references":[{"source_name":"Application Bundle Manipulation Brandon Dalton","url":"https://redcanary.com/blog/mac-application-bundles/"},{"source_name":"Microsoft March 2025 XCSSET","url":"https://www.microsoft.com/en-us/security/blog/2025/03/11/new-xcsset-malware-adds-new-obfuscation-persistence-techniques-to-infect-xcode-projects/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--de7c6e69-dd8f-4063-aaa2-569ab767629e","subject":"ATTACK:enterprise:S0344","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--de7c6e69-dd8f-4063-aaa2-569ab767629e","modified":"2026-04-29T14:23:06.229Z","references":[{"source_name":"Unit42 Azorult Nov 2018","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-new-wine-old-bottle-new-azorult-variant-found-findmyname-campaign-using-fallout-exploit-kit/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--deaf1941-b388-44e5-a8e9-09da85bf1067","subject":"ATTACK:enterprise:C0035","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--deaf1941-b388-44e5-a8e9-09da85bf1067","modified":"2026-07-31T18:47:18.521Z","references":[{"source_name":"Lumen KVBotnet 2023","url":"https://blog.lumen.com/routers-roasting-on-an-open-firewall-the-kv-botnet-investigation/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dee2ef91-fe07-423a-8ad3-551c99b7a112","subject":"ATTACK:enterprise:S1109","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dee2ef91-fe07-423a-8ad3-551c99b7a112","modified":"2026-04-29T14:23:06.229Z","references":[{"source_name":"Mandiant Pulse Secure Zero-Day April 2021","url":"https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--df0cfac5-fe50-4cc3-bc47-9a1d49c53e0a","subject":"ATTACK:enterprise:S0375","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--df0cfac5-fe50-4cc3-bc47-9a1d49c53e0a","modified":"2026-04-29T14:23:06.229Z","references":[{"source_name":"Securelist Remexi Jan 2019","url":"https://securelist.com/chafer-used-remexi-malware/89538/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e0922165-ba76-4dc0-8625-b77a82818d77","subject":"ATTACK:enterprise:G1035","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e0922165-ba76-4dc0-8625-b77a82818d77","modified":"2026-07-31T18:48:03.334Z","references":[{"source_name":"ESET WinterVivern 2023","url":"https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e2116500-b22a-44f6-ad5b-c3e579a67491","subject":"ATTACK:enterprise:G0124","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e2116500-b22a-44f6-ad5b-c3e579a67491","modified":"2026-07-31T18:47:56.466Z","references":[{"source_name":"ESET ForSSHe December 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e260b882-0f57-4e44-b6fe-efaefccd1c3f","subject":"ATTACK:enterprise:S0615","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e260b882-0f57-4e44-b6fe-efaefccd1c3f","modified":"2026-04-29T14:23:06.233Z","references":[{"source_name":"BlackBerry CostaRicto November 2020","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e28f72fc-86ae-481a-9181-d06380eeb859","subject":"ATTACK:enterprise:S1135","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e28f72fc-86ae-481a-9181-d06380eeb859","modified":"2026-04-29T14:23:06.234Z","references":[{"source_name":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e2f772c3-0822-4c4c-8a8d-51094349ccc5","subject":"ATTACK:enterprise:S1096","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e2f772c3-0822-4c4c-8a8d-51094349ccc5","modified":"2026-04-29T14:23:06.234Z","references":[{"source_name":"Trend Micro Cheerscrypt May 2022","url":"https://www.trendmicro.com/en_se/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e3417dc3-f784-4306-8466-65a0067b63f1","subject":"ATTACK:enterprise:G0026","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e3417dc3-f784-4306-8466-65a0067b63f1","modified":"2026-07-31T18:47:50.883Z","references":[{"source_name":"PaloAlto DNS Requests May 2016","url":"https://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e64a09d0-4205-4aca-8acb-f6926233d107","subject":"ATTACK:enterprise:S0113","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e64a09d0-4205-4aca-8acb-f6926233d107","modified":"2026-04-29T14:23:06.238Z","references":[{"source_name":"ESET Operation Groundbait","url":"http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e67b8df0-ca16-467a-9d42-57ac9dee685a","subject":"ATTACK:enterprise:S9035","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e67b8df0-ca16-467a-9d42-57ac9dee685a","modified":"2026-04-29T14:23:06.239Z","references":[{"source_name":"Splunk LAMEHUG SEP 2025","url":"https://www.splunk.com/en_us/blog/security/lamehug-ai-driven-malware-llm-cyber-intrusion-analysis.html"},{"source_name":"Nov AI Threat Tracker","url":"https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e76a5485-4008-4096-820c-87b7dede9e02","subject":"ATTACK:enterprise:S0497","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e76a5485-4008-4096-820c-87b7dede9e02","modified":"2026-04-29T14:23:06.240Z","references":[{"source_name":"TrendMicro macOS Dacls May 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e80f97df-4984-4e62-bba6-1333d4c2c977","subject":"ATTACK:enterprise:S0434","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e80f97df-4984-4e62-bba6-1333d4c2c977","modified":"2026-04-29T14:23:06.241Z","references":[{"source_name":"QiAnXin APT-C-36 Feb2019","url":"https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e8906575-d90c-4d56-9fb7-bba3560bbeba","subject":"ATTACK:enterprise:S0330","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e8906575-d90c-4d56-9fb7-bba3560bbeba","modified":"2026-04-29T14:23:06.242Z","references":[{"source_name":"GDATA Zeus Panda June 2017","url":"https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e90717f3-fad2-4978-be15-7dfb647d034d","subject":"ATTACK:enterprise:S0090","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e90717f3-fad2-4978-be15-7dfb647d034d","modified":"2026-04-29T14:23:06.242Z","references":[{"source_name":"Palo Alto Rover","url":"http://researchcenter.paloaltonetworks.com/2016/02/new-malware-rover-targets-indian-ambassador-to-afghanistan/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ea6a1c47-237a-4bc6-a048-9f45dd48fe02","subject":"ATTACK:enterprise:S0512","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ea6a1c47-237a-4bc6-a048-9f45dd48fe02","modified":"2026-04-29T14:23:06.244Z","references":[{"source_name":"ESET Dukes October 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ec095867-cb54-4fcf-b2c7-00e805bf7500","subject":"ATTACK:enterprise:S0444","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ec095867-cb54-4fcf-b2c7-00e805bf7500","modified":"2026-04-29T14:23:06.246Z","references":[{"source_name":"FOX-IT May 2016 Mofang","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ed8b5029-835d-492c-a1f4-10ccbf084a76","subject":"ATTACK:enterprise:S0124","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ed8b5029-835d-492c-a1f4-10ccbf084a76","modified":"2026-04-29T14:23:06.248Z","references":[{"source_name":"Palo Alto DNS Requests","url":"http://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--edda676e-bd01-4983-b491-bf6c5d9a84db","subject":"ATTACK:enterprise:G1023","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--edda676e-bd01-4983-b491-bf6c5d9a84db","modified":"2026-07-31T18:48:17.629Z","references":[{"source_name":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ee683bba-698d-4fde-be42-1aa7e3ed3211","subject":"ATTACK:enterprise:S1148","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ee683bba-698d-4fde-be42-1aa7e3ed3211","modified":"2026-04-29T14:23:06.249Z","references":[{"source_name":"Sekoia Raccoon2 2022","url":"https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis/"},{"source_name":"S2W Racoon 2022","url":"https://medium.com/s2wblog/raccoon-stealer-is-back-with-a-new-version-5f436e04b20d"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--efba0428-a817-4783-b04f-a9af95362c5e","subject":"ATTACK:enterprise:S1121","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--efba0428-a817-4783-b04f-a9af95362c5e","modified":"2026-04-29T14:23:06.251Z","references":[{"source_name":"Mandiant Cutting Edge Part 3 February 2024","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f0026b7c-9a9a-468d-a152-1b214efe066a","subject":"ATTACK:enterprise:G0117","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f0026b7c-9a9a-468d-a152-1b214efe066a","modified":"2026-07-31T18:48:17.907Z","references":[{"source_name":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f16f6118-810f-4e08-9178-001156c95b53","subject":"ATTACK:enterprise:S1016","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f16f6118-810f-4e08-9178-001156c95b53","modified":"2026-04-29T14:23:06.253Z","references":[{"source_name":"ESET DazzleSpy Jan 2022","url":"https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f1aa297a-1b61-4bfc-9e4b-18b4b82b4d8c","subject":"ATTACK:enterprise:S1073","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f1aa297a-1b61-4bfc-9e4b-18b4b82b4d8c","modified":"2026-04-29T14:23:06.254Z","references":[{"source_name":"Cybereason Royal December 2022","url":"https://www.cybereason.com/blog/royal-ransomware-analysis"},{"source_name":"Kroll Royal Deep Dive February 2023","url":"https://www.kroll.com/en/insights/publications/cyber/royal-ransomware-deep-dive"},{"source_name":"Trend Micro Royal Linux ESXi February 2023","url":"https://www.trendmicro.com/en_us/research/23/b/royal-ransomware-expands-attacks-by-targeting-linux-esxi-servers.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f45f18e9-4a0c-4f22-8ef6-5a18314535ea","subject":"ATTACK:enterprise:S0455","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f45f18e9-4a0c-4f22-8ef6-5a18314535ea","modified":"2026-04-29T14:23:06.257Z","references":[{"source_name":"Medium Metamorfo Apr 2020","url":"https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767"},{"source_name":"Fortinet Metamorfo Feb 2020","url":"https://www.fortinet.com/blog/threat-research/another-metamorfo-variant-targeting-customers-of-financial-institutions"},{"source_name":"FireEye Metamorfo Apr 2018","url":"https://www.fireeye.com/blog/threat-research/2018/04/metamorfo-campaign-targeting-brazilian-users.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f4a42928-1bf7-4177-b798-1fd254acc522","subject":"ATTACK:enterprise:S1191","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f4a42928-1bf7-4177-b798-1fd254acc522","modified":"2026-04-29T14:23:06.257Z","references":[{"source_name":"Palo Alto Howling Scorpius DEC 2024","url":"https://unit42.paloaltonetworks.com/threat-assessment-howling-scorpius-akira-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f5d2b140-1267-405b-8085-e02c135504f9","subject":"ATTACK:enterprise:S1089","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f5d2b140-1267-405b-8085-e02c135504f9","modified":"2026-04-29T14:23:06.259Z","references":[{"source_name":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f6fe7167-0788-4062-9f59-d8ee8398db15","subject":"ATTACK:enterprise:S1068","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f6fe7167-0788-4062-9f59-d8ee8398db15","modified":"2026-04-29T14:23:06.261Z","references":[{"source_name":"Microsoft BlackCat Jun 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f7484ee2-6d98-4f5b-8788-2cf1675b349d","subject":"ATTACK:enterprise:S0226","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f7484ee2-6d98-4f5b-8788-2cf1675b349d","modified":"2026-04-29T14:23:06.261Z","references":[{"source_name":"Talos Smoke Loader July 2018","url":"https://blog.talosintelligence.com/2018/07/smoking-guns-smoke-loader-learned-new.html#more"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f757a567-97b2-41b0-b58a-1530156ba457","subject":"ATTACK:enterprise:S0275","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f757a567-97b2-41b0-b58a-1530156ba457","modified":"2026-04-29T14:23:06.261Z","references":[{"source_name":"FireEye APT10 Sept 2018","url":"https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f761e63a-5c5a-47e3-8256-08bd299f329e","subject":"ATTACK:enterprise:S0128","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f761e63a-5c5a-47e3-8256-08bd299f329e","modified":"2026-04-29T14:23:06.261Z","references":[{"source_name":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f7f5185d-3e7a-4b5c-8a54-44eac8083780","subject":"ATTACK:enterprise:S9002","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f7f5185d-3e7a-4b5c-8a54-44eac8083780","modified":"2026-04-29T14:23:06.262Z","references":[{"source_name":"Halcyon_CloakRansomware_Dec2024","url":"https://www.halcyon.ai/blog/cloak-ransomware-variant-exhibits-advanced-persistence-evasion-and-vhd-extraction-capabilities"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f8a21871-d67b-4e89-82db-580d117d28fb","subject":"ATTACK:enterprise:G0077","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f8a21871-d67b-4e89-82db-580d117d28fb","modified":"2026-07-31T18:47:49.414Z","references":[{"source_name":"Symantec Leafminer July 2018","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f9773935-853e-4d5e-9345-9587fd77340d","subject":"ATTACK:enterprise:S0062","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f9773935-853e-4d5e-9345-9587fd77340d","modified":"2026-04-29T14:23:06.264Z","references":[{"source_name":"DustySky","url":"https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"},{"source_name":"Kaspersky MoleRATs April 2019","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f97798e2-ec1a-4cad-ab07-f61ef6cb8f78","subject":"ATTACK:enterprise:G1016","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f97798e2-ec1a-4cad-ab07-f61ef6cb8f78","modified":"2026-07-31T18:48:31.603Z","references":[{"source_name":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f9c13c35-a493-4733-b51c-ab4857692e18","subject":"ATTACK:enterprise:S0443","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f9c13c35-a493-4733-b51c-ab4857692e18","modified":"2026-04-29T14:23:06.264Z","references":[{"source_name":"FireEye MESSAGETAP October 2019","url":"https://www.fireeye.com/blog/threat-research/2019/10/messagetap-who-is-reading-your-text-messages.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fa6292a2-c184-4bc9-a37f-0c1ac61e1135","subject":"ATTACK:enterprise:G0010","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fa6292a2-c184-4bc9-a37f-0c1ac61e1135","modified":"2026-07-31T18:48:04.446Z","references":[{"source_name":"Kaspersky Turla","url":"https://securelist.com/the-epic-turla-operation/65545/"},{"source_name":"ESET ComRAT May 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"},{"source_name":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fb819161-4916-4f25-ad81-eab9f02a337e","subject":"ATTACK:enterprise:S0638","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fb819161-4916-4f25-ad81-eab9f02a337e","modified":"2026-04-29T14:23:06.266Z","references":[{"source_name":"McAfee Babuk February 2021","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-babuk-ransomware.pdf"},{"source_name":"Trend Micro Ransomware February 2021","url":"https://www.trendmicro.com/en_us/research/21/b/new-in-ransomware.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fbfa0807-ce03-4448-a50d-f0337d2446f2","subject":"ATTACK:enterprise:S0020","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fbfa0807-ce03-4448-a50d-f0337d2446f2","modified":"2026-04-29T14:23:06.267Z","references":[{"source_name":"Rapid7 HAFNIUM Mar 2021","url":"https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"},{"source_name":"FireEye Periscope March 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fc268488-a74d-4100-917f-be04cc81826b","subject":"ATTACK:enterprise:S1044","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fc268488-a74d-4100-917f-be04cc81826b","modified":"2026-04-29T14:23:06.267Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fc4dd2b6-63a0-46fe-bfc4-90e58e5d1422","subject":"ATTACK:enterprise:G0060","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fc4dd2b6-63a0-46fe-bfc4-90e58e5d1422","modified":"2026-07-31T18:48:11.150Z","references":[{"source_name":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fc825f8c-ee7a-4b03-9d67-cd736d61b893","subject":"ATTACK:enterprise:S0022","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fc825f8c-ee7a-4b03-9d67-cd736d61b893","modified":"2026-04-29T14:23:06.268Z","references":[{"source_name":"Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023","url":"https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fe1c5e06-ea4b-4286-af2d-984a095f7924","subject":"ATTACK:enterprise:S0263","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fe1c5e06-ea4b-4286-af2d-984a095f7924","modified":"2026-04-29T14:23:06.270Z","references":[{"source_name":"US-CERT TYPEFRAME June 2018","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ff83e828-168e-4702-8682-63f8e9633a48","subject":"ATTACK:enterprise:S9051","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ff83e828-168e-4702-8682-63f8e9633a48","modified":"2026-09-23T17:04:52.350Z","references":[{"source_name":"MSTI_GentelmenRansomware_May2026","url":"https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ffb9fa57-09be-4812-ae15-b7b16b024811","subject":"ATTACK:enterprise:S1200","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ffb9fa57-09be-4812-ae15-b7b16b024811","modified":"2026-04-29T14:23:06.272Z","references":[{"source_name":"Cybereason StealBit Exfiltration Tool","url":"https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool"},{"source_name":"FBI Lockbit 2.0 FEB 2022","url":"https://www.ic3.gov/CSA/2022/220204.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}