Source assertions are not new attribution claims. No sole inventor or transitive actor-CVE inference.
{
  "record": {
    "id": "ATTACK:enterprise:T1090",
    "title": "Proxy",
    "type": "Technique",
    "source_url": "https://attack.mitre.org/techniques/T1090",
    "snapshot": "enterprise-attack-20.0.json",
    "status": "active",
    "rights": "Source metadata only; source notices retained; no operational prose or payloads",
    "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
    "stix_id": "attack-pattern--731f4f55-b6d0-41d1-a7a9-072a66389aea",
    "external_id": "T1090",
    "domain": "enterprise",
    "created": "2017-05-31T21:31:08.479Z",
    "modified": "2026-09-08T20:28:07.390Z",
    "version": "3.2",
    "aliases": [

    ],
    "tactics": [
      "command-and-control"
    ],
    "source_references": [
      {
        "source_name": "Trend Micro APT Attack Tools",
        "url": "http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/"
      }
    ]
  },
  "assertions": [
    {
      "id": "enterprise:relationship--02226352-d8cd-4b84-99bc-2df35f66f37a",
      "subject": "ATTACK:enterprise:S1210",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--02226352-d8cd-4b84-99bc-2df35f66f37a",
      "modified": "2026-09-08T20:28:07.819Z",
      "references": [
        {
          "source_name": "Cisco LotusBlossom 2025",
          "url": "https://blog.talosintelligence.com/lotus-blossom-espionage-group/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--060a6b38-18fb-46ac-97c1-b1c40d493b6c",
      "subject": "ATTACK:enterprise:S0198",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--060a6b38-18fb-46ac-97c1-b1c40d493b6c",
      "modified": "2026-09-08T20:28:07.855Z",
      "references": [
        {
          "source_name": "Red Canary NETWIRE January 2020",
          "url": "https://redcanary.com/blog/netwire-remote-access-trojan-on-linux/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--096d97b6-57d0-4722-a204-685fb48ed5ca",
      "subject": "ATTACK:enterprise:S1114",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--096d97b6-57d0-4722-a204-685fb48ed5ca",
      "modified": "2026-09-08T20:28:07.928Z",
      "references": [
        {
          "source_name": "Mandiant Cutting Edge Part 2 January 2024",
          "url": "https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"
        },
        {
          "source_name": "Mandiant Cutting Edge January 2024",
          "url": "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--12c19ecc-2d25-45c6-b13b-439220248d4e",
      "subject": "ATTACK:enterprise:S1212",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--12c19ecc-2d25-45c6-b13b-439220248d4e",
      "modified": "2026-09-08T20:28:07.963Z",
      "references": [
        {
          "source_name": "Group-IB RansomHub FEB 2025",
          "url": "https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--14ab71d4-a158-41f2-82d4-c70f3121fa11",
      "subject": "ATTACK:enterprise:S0669",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--14ab71d4-a158-41f2-82d4-c70f3121fa11",
      "modified": "2026-09-08T20:28:07.978Z",
      "references": [
        {
          "source_name": "MalwareBytes LazyScripter Feb 2021",
          "url": "https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1542332b-788b-4c1e-b5e5-69d032cb7814",
      "subject": "ATTACK:enterprise:G1017",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1542332b-788b-4c1e-b5e5-69d032cb7814",
      "modified": "2026-09-08T20:28:07.991Z",
      "references": [
        {
          "source_name": "CISA AA24-038A PRC Critical Infrastructure February 2024",
          "url": "https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"
        },
        {
          "source_name": "Microsoft Volt Typhoon May 2023",
          "url": "https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"
        },
        {
          "source_name": "Joint Cybersecurity Advisory Volt Typhoon June 2023",
          "url": "https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1a9510e3-0bb0-4469-bbf8-2d02a3a00d66",
      "subject": "ATTACK:enterprise:S0461",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1a9510e3-0bb0-4469-bbf8-2d02a3a00d66",
      "modified": "2026-09-08T20:28:08.005Z",
      "references": [
        {
          "source_name": "Proofpoint TA505 October 2019",
          "url": "https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1ab94260-498a-4090-85c9-54b89d8b6bb3",
      "subject": "ATTACK:enterprise:S0615",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1ab94260-498a-4090-85c9-54b89d8b6bb3",
      "modified": "2026-09-08T20:28:08.020Z",
      "references": [
        {
          "source_name": "CISA AR21-126A FIVEHANDS May 2021",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1b27cec5-241a-4c2e-a3db-e9cea241496c",
      "subject": "ATTACK:enterprise:S0040",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1b27cec5-241a-4c2e-a3db-e9cea241496c",
      "modified": "2026-09-08T20:28:08.033Z",
      "references": [
        {
          "source_name": "Operation Quantum Entanglement",
          "url": "https://web.archive.org/web/20210920193513/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-quantum-entanglement.pdf"
        },
        {
          "source_name": "NCSC Joint Report Public Tools",
          "url": "https://www.ncsc.gov.uk/report/joint-report-on-publicly-available-hacking-tools"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1b885f53-1194-472d-a120-381f000d7b53",
      "subject": "ATTACK:enterprise:S1144",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1b885f53-1194-472d-a120-381f000d7b53",
      "modified": "2026-09-08T20:28:08.050Z",
      "references": [
        {
          "source_name": "FRP GitHub",
          "url": "https://github.com/fatedier/frp"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1c401eba-48ed-4daa-a123-6b4752c84026",
      "subject": "ATTACK:enterprise:C0047",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1c401eba-48ed-4daa-a123-6b4752c84026",
      "modified": "2026-09-08T20:28:08.062Z",
      "references": [
        {
          "source_name": "Recorded Future RedDelta 2025",
          "url": "https://go.recordedfuture.com/hubfs/reports/cta-cn-2025-0109.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2050b131-d5e1-419c-ad85-660fba4004d7",
      "subject": "ATTACK:enterprise:G0034",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2050b131-d5e1-419c-ad85-660fba4004d7",
      "modified": "2026-09-08T20:28:08.076Z",
      "references": [
        {
          "source_name": "ESET Telebots Dec 2016",
          "url": "https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--20b9ce88-4d97-4395-b586-92732080808e",
      "subject": "ATTACK:enterprise:S1229",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--20b9ce88-4d97-4395-b586-92732080808e",
      "modified": "2026-09-08T20:28:08.122Z",
      "references": [
        {
          "source_name": "Havoc Framework Documentation",
          "url": "https://havocframework.com/docs/welcome"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2485b970-f934-4fdb-80a4-0e11c179845d",
      "subject": "ATTACK:enterprise:S0347",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2485b970-f934-4fdb-80a4-0e11c179845d",
      "modified": "2026-09-08T20:28:08.135Z",
      "references": [
        {
          "source_name": "TrendMicro Lazarus Nov 2018",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-continues-heists-mounts-attacks-on-financial-organizations-in-latin-america/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--284aadab-ec10-4869-8bdb-7258c19432c4",
      "subject": "ATTACK:enterprise:T1090.001",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--284aadab-ec10-4869-8bdb-7258c19432c4",
      "modified": "2026-09-08T20:28:42.188Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2bd05bbf-886e-4211-8aab-63cd8581a695",
      "subject": "ATTACK:enterprise:S0412",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2bd05bbf-886e-4211-8aab-63cd8581a695",
      "modified": "2026-09-08T20:28:08.159Z",
      "references": [
        {
          "source_name": "Talos ZxShell Oct 2014",
          "url": "https://blogs.cisco.com/security/talos/opening-zxshell"
        },
        {
          "source_name": "FireEye APT41 Aug 2019",
          "url": "https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2c78a913-5b17-4942-a6e9-8bfa4c24149b",
      "subject": "ATTACK:enterprise:T1090.003",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2c78a913-5b17-4942-a6e9-8bfa4c24149b",
      "modified": "2026-09-08T20:28:08.171Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2cf3d3a5-85ab-43d9-8462-684469f79c6a",
      "subject": "ATTACK:enterprise:T1090.004",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2cf3d3a5-85ab-43d9-8462-684469f79c6a",
      "modified": "2026-09-08T20:28:08.183Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2e162cdf-e917-4bc5-a2d2-1623e05d0b61",
      "subject": "ATTACK:enterprise:G0010",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2e162cdf-e917-4bc5-a2d2-1623e05d0b61",
      "modified": "2026-09-08T20:28:08.197Z",
      "references": [
        {
          "source_name": "ESET Turla PowerShell May 2019",
          "url": "https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--30bff73c-7c73-4d18-84ab-bf5033f63d34",
      "subject": "ATTACK:enterprise:C0048",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--30bff73c-7c73-4d18-84ab-bf5033f63d34",
      "modified": "2026-09-08T20:28:08.213Z",
      "references": [
        {
          "source_name": "Volexity UPSTYLE 2024",
          "url": "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--321703ba-7871-46c0-837e-6a2e1dc5aba9",
      "subject": "ATTACK:enterprise:S0376",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--321703ba-7871-46c0-837e-6a2e1dc5aba9",
      "modified": "2026-09-08T20:28:08.225Z",
      "references": [
        {
          "source_name": "US-CERT HOPLIGHT Apr 2019",
          "url": "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3393682e-22a6-4e27-b890-747f1392741b",
      "subject": "ATTACK:enterprise:G0052",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3393682e-22a6-4e27-b890-747f1392741b",
      "modified": "2026-09-08T20:28:08.236Z",
      "references": [
        {
          "source_name": "Microsoft POLONIUM June 2022",
          "url": "https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3504541e-cfcf-4b92-9de1-d34f1e814d40",
      "subject": "ATTACK:enterprise:G1054",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3504541e-cfcf-4b92-9de1-d34f1e814d40",
      "modified": "2026-09-08T20:28:08.250Z",
      "references": [
        {
          "source_name": "JPCERT MirrorFace JUL 2024",
          "url": "https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--384c2ef7-ae14-4ba2-ad86-bfeea3c14f33",
      "subject": "ATTACK:enterprise:S0670",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--384c2ef7-ae14-4ba2-ad86-bfeea3c14f33",
      "modified": "2026-09-08T20:28:08.262Z",
      "references": [
        {
          "source_name": "Check Point Warzone Feb 2020",
          "url": "https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3d16dbff-d1fc-42e0-b736-69ddee747ffe",
      "subject": "ATTACK:enterprise:T1090.002",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3d16dbff-d1fc-42e0-b736-69ddee747ffe",
      "modified": "2026-09-08T20:29:09.894Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3e16f380-633b-4d27-9249-9bcf25717f5a",
      "subject": "ATTACK:enterprise:S0508",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3e16f380-633b-4d27-9249-9bcf25717f5a",
      "modified": "2026-09-08T20:28:08.286Z",
      "references": [
        {
          "source_name": "Zdnet Ngrok September 2018",
          "url": "https://www.zdnet.com/article/sly-malware-author-hides-cryptomining-botnet-behind-ever-shifting-proxy-service/"
        },
        {
          "source_name": "MalwareBytes Ngrok February 2020",
          "url": "https://blog.malwarebytes.com/threat-analysis/2020/02/fraudsters-cloak-credit-card-skimmer-with-fake-content-delivery-network-ngrok-server/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--41fd4cc5-8d62-43f6-833b-1068a8f3003c",
      "subject": "ATTACK:enterprise:S1121",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--41fd4cc5-8d62-43f6-833b-1068a8f3003c",
      "modified": "2026-09-08T20:28:08.297Z",
      "references": [
        {
          "source_name": "Mandiant Cutting Edge Part 3 February 2024",
          "url": "https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4393f669-4e67-4cd6-a89b-52907138fca7",
      "subject": "ATTACK:enterprise:G1004",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4393f669-4e67-4cd6-a89b-52907138fca7",
      "modified": "2026-09-08T20:28:08.308Z",
      "references": [
        {
          "source_name": "MSTIC DEV-0537 Mar 2022",
          "url": "https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--46ab37b0-4a91-45d3-ac5a-7912494fcf10",
      "subject": "ATTACK:enterprise:S9044",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--46ab37b0-4a91-45d3-ac5a-7912494fcf10",
      "modified": "2026-09-08T20:28:08.320Z",
      "references": [
        {
          "source_name": "Artic Wolf Labs Kali365 Device Code April 2026",
          "url": "https://arcticwolf.com/resources/blog/token-bingo-dont-let-your-code-be-the-winner/"
        },
        {
          "source_name": "Huntress Kali365 Device Code June 2026",
          "url": "https://www.huntress.com/blog/kali365-device-code-phishing-kit"
        },
        {
          "source_name": "SpyCloud Kali365 June 2026",
          "url": "https://spycloud.com/blog/kali365-anatomy-of-a-microsoft365-phishing-as-a-service-kit/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4c26e6e8-8303-44ad-9e5d-452dff52858f",
      "subject": "ATTACK:enterprise:G0108",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4c26e6e8-8303-44ad-9e5d-452dff52858f",
      "modified": "2026-09-08T20:28:08.331Z",
      "references": [
        {
          "source_name": "RedCanary Mockingbird May 2020",
          "url": "https://redcanary.com/blog/blue-mockingbird-cryptominer/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4f895e31-5953-4d83-bfe0-f1606f3cc83e",
      "subject": "ATTACK:enterprise:S1189",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4f895e31-5953-4d83-bfe0-f1606f3cc83e",
      "modified": "2026-09-08T20:28:08.344Z",
      "references": [
        {
          "source_name": "GitHub Neo-reGeorg 2019",
          "url": "https://github.com/L-codes/Neo-reGeorg/blob/master/README-en.md"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5886efa7-c69d-4f66-949a-4979ca230f06",
      "subject": "ATTACK:enterprise:C0063",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5886efa7-c69d-4f66-949a-4979ca230f06",
      "modified": "2026-09-08T20:28:08.355Z",
      "references": [
        {
          "source_name": "CERT Polska",
          "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
        },
        {
          "source_name": "ESET DynoWiper Update JAN 2026",
          "url": "https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5b68c97c-8eb7-45eb-b2d2-a91bf0fff2a0",
      "subject": "ATTACK:enterprise:G1021",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5b68c97c-8eb7-45eb-b2d2-a91bf0fff2a0",
      "modified": "2026-09-08T20:28:08.366Z",
      "references": [
        {
          "source_name": "Sygnia Emperor Dragonfly October 2022",
          "url": "https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5d4cf656-ce12-4a52-93ad-0a0545c8a144",
      "subject": "ATTACK:enterprise:C0059",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5d4cf656-ce12-4a52-93ad-0a0545c8a144",
      "modified": "2026-09-08T20:28:08.377Z",
      "references": [
        {
          "source_name": "Google Salesforce JUN 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5ed5deda-543f-40f7-8f5d-df8f93c545e2",
      "subject": "ATTACK:enterprise:S0332",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5ed5deda-543f-40f7-8f5d-df8f93c545e2",
      "modified": "2026-09-08T20:28:08.390Z",
      "references": [
        {
          "source_name": "Riskiq Remcos Jan 2018",
          "url": "https://web.archive.org/web/20180124082756/https://www.riskiq.com/blog/labs/spear-phishing-turkish-defense-contractors/"
        },
        {
          "source_name": "Fortinet Remcos Campaign NOV 2024",
          "url": "https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5f6e76c5-732c-4bc8-9c17-ac1e58a5d88e",
      "subject": "ATTACK:enterprise:S0245",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5f6e76c5-732c-4bc8-9c17-ac1e58a5d88e",
      "modified": "2026-09-08T20:28:08.405Z",
      "references": [
        {
          "source_name": "US-CERT BADCALL",
          "url": "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-G.PDF"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--62d56cae-9131-4088-ad0a-810a731d2a9f",
      "subject": "ATTACK:enterprise:S1081",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--62d56cae-9131-4088-ad0a-810a731d2a9f",
      "modified": "2026-09-08T20:28:08.418Z",
      "references": [
        {
          "source_name": "BitDefender BADHATCH Mar 2021",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--660e8d4a-4de9-4566-92d7-0bd7e8e85d19",
      "subject": "ATTACK:enterprise:S1197",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--660e8d4a-4de9-4566-92d7-0bd7e8e85d19",
      "modified": "2026-09-08T20:28:08.430Z",
      "references": [
        {
          "source_name": "S2W Troll Stealer 2024",
          "url": "https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--69c1806d-e6ae-4c11-bce6-8fbebd8bbee5",
      "subject": "ATTACK:enterprise:S0108",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--69c1806d-e6ae-4c11-bce6-8fbebd8bbee5",
      "modified": "2026-09-08T20:28:08.441Z",
      "references": [
        {
          "source_name": "Securelist fileless attacks Feb 2017",
          "url": "https://securelist.com/fileless-attacks-against-enterprise-networks/77403/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6abb1f16-7e68-4b0d-a1ae-4001f5a7f87b",
      "subject": "ATTACK:enterprise:G1019",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6abb1f16-7e68-4b0d-a1ae-4001f5a7f87b",
      "modified": "2026-09-08T20:28:08.456Z",
      "references": [
        {
          "source_name": "MoustachedBouncer ESET August 2023",
          "url": "https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6e23cb4f-61dd-4a6a-8c25-7eb79c376558",
      "subject": "ATTACK:enterprise:S0435",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6e23cb4f-61dd-4a6a-8c25-7eb79c376558",
      "modified": "2026-09-08T20:28:08.472Z",
      "references": [
        {
          "source_name": "JPCert PLEAD Downloader June 2018",
          "url": "https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6f7ee9ba-fb3d-4f22-a78a-8003da718ec4",
      "subject": "ATTACK:enterprise:S0384",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6f7ee9ba-fb3d-4f22-a78a-8003da718ec4",
      "modified": "2026-09-08T20:28:08.490Z",
      "references": [
        {
          "source_name": "Dell Dridex Oct 2015",
          "url": "https://www.secureworks.com/research/dridex-bugat-v5-botnet-takeover-operation"
        },
        {
          "source_name": "Checkpoint Dridex Jan 2021",
          "url": "https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--74bb0ae9-589c-4479-9bd5-b9a71a20e82d",
      "subject": "ATTACK:enterprise:S0246",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--74bb0ae9-589c-4479-9bd5-b9a71a20e82d",
      "modified": "2026-09-08T20:28:08.503Z",
      "references": [
        {
          "source_name": "US-CERT HARDRAIN March 2018",
          "url": "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-F.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--75aa57b2-5d2e-49ec-9c26-317b361632c3",
      "subject": "ATTACK:enterprise:S0487",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--75aa57b2-5d2e-49ec-9c26-317b361632c3",
      "modified": "2026-09-08T20:28:08.516Z",
      "references": [
        {
          "source_name": "ESET ForSSHe December 2018",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7c119557-d417-4708-a024-5be9c4d4d86c",
      "subject": "ATTACK:enterprise:S0436",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7c119557-d417-4708-a024-5be9c4d4d86c",
      "modified": "2026-09-08T20:28:08.531Z",
      "references": [
        {
          "source_name": "JPCert BlackTech Malware September 2019",
          "url": "https://blogs.jpcert.or.jp/en/2019/09/tscookie-loader.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7c776fbc-592a-4643-bd4f-423546a4732e",
      "subject": "ATTACK:enterprise:G0124",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7c776fbc-592a-4643-bd4f-423546a4732e",
      "modified": "2026-09-08T20:28:08.542Z",
      "references": [
        {
          "source_name": "ESET Windigo Mar 2014",
          "url": "https://www.welivesecurity.com/2014/03/18/operation-windigo-the-vivisection-of-a-large-linux-server-side-credential-stealing-malware-campaign/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--81eaf78c-2282-4e86-baa9-820020a54031",
      "subject": "ATTACK:enterprise:G1005",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--81eaf78c-2282-4e86-baa9-820020a54031",
      "modified": "2026-09-08T20:28:08.554Z",
      "references": [
        {
          "source_name": "Microsoft POLONIUM June 2022",
          "url": "https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--82758a74-b7e2-4839-ad52-bdc6c57c0dba",
      "subject": "ATTACK:enterprise:S0378",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--82758a74-b7e2-4839-ad52-bdc6c57c0dba",
      "modified": "2026-09-08T20:28:08.567Z",
      "references": [
        {
          "source_name": "GitHub PoshC2",
          "url": "https://github.com/nettitude/PoshC2_Python"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--83491142-3547-4944-b208-2a94d8536008",
      "subject": "ATTACK:enterprise:G1045",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--83491142-3547-4944-b208-2a94d8536008",
      "modified": "2026-09-22T21:23:07.036Z",
      "references": [
        {
          "source_name": "CISA_AA25-239ASaltTyphoon_Sept2025",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--83e001e3-95d3-43d9-9f8c-8b954686287a",
      "subject": "ATTACK:enterprise:S0263",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--83e001e3-95d3-43d9-9f8c-8b954686287a",
      "modified": "2026-09-08T20:28:08.583Z",
      "references": [
        {
          "source_name": "US-CERT TYPEFRAME June 2018",
          "url": "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--86bf339d-20a1-45c2-bad8-12b264bc7c5b",
      "subject": "ATTACK:enterprise:S1187",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--86bf339d-20a1-45c2-bad8-12b264bc7c5b",
      "modified": "2026-09-08T20:28:08.596Z",
      "references": [
        {
          "source_name": "Fortinet reGeorg MAR 2019",
          "url": "https://www.fortiguard.com/encyclopedia/ips/47584/regeorg-http-tunnel"
        },
        {
          "source_name": "Mandiant APT29 Eye Spy Email Nov 22",
          "url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
        },
        {
          "source_name": "GitHub reGeorg 2016",
          "url": "https://github.com/xl7dev/WebShell/tree/master/reGeorg-master"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8756af3a-a756-4e0d-a537-8cab1e983b9b",
      "subject": "ATTACK:enterprise:C0017",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8756af3a-a756-4e0d-a537-8cab1e983b9b",
      "modified": "2026-09-08T20:28:08.608Z",
      "references": [
        {
          "source_name": "Mandiant APT41",
          "url": "https://www.mandiant.com/resources/apt41-us-state-governments"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--887fda04-92e9-4819-bf6c-5458348cc046",
      "subject": "ATTACK:enterprise:C0056",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--887fda04-92e9-4819-bf6c-5458348cc046",
      "modified": "2026-09-08T20:28:08.621Z",
      "references": [
        {
          "source_name": "Juniper RedPenguin MAR 2025",
          "url": "https://supportportal.juniper.net/sfc/servlet.shepherd/document/download/069Dp00000FzdmIIAR?operationContext=S1"
        },
        {
          "source_name": "Mandiant UNC3886 Juniper Routers MAR 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8fd75064-d1b8-4b8c-b9ea-5b65a1cc0ea8",
      "subject": "ATTACK:enterprise:S0283",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8fd75064-d1b8-4b8c-b9ea-5b65a1cc0ea8",
      "modified": "2026-09-08T20:28:08.632Z",
      "references": [
        {
          "source_name": "Kaspersky Adwind Feb 2016",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07195002/KL_AdwindPublicReport_2016.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--92b8dedc-360a-4763-bc31-5f7b0a698460",
      "subject": "ATTACK:enterprise:S0690",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--92b8dedc-360a-4763-bc31-5f7b0a698460",
      "modified": "2026-09-08T20:28:08.643Z",
      "references": [
        {
          "source_name": "Objective See Green Lambert for OSX Oct 2021",
          "url": "https://objective-see.com/blog/blog_0x68.html"
        },
        {
          "source_name": "Glitch-Cat Green Lambert ATTCK Oct 2021",
          "url": "https://web.archive.org/web/20211018145402/https://www.glitch-cat.com/blog/green-lambert-and-attack"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--93900b40-be44-48eb-92bc-c171a5ce5501",
      "subject": "ATTACK:enterprise:S1044",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--93900b40-be44-48eb-92bc-c171a5ce5501",
      "modified": "2026-09-08T20:28:08.656Z",
      "references": [
        {
          "source_name": "Bitdefender FunnyDream Campaign November 2020",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9df6635a-b3ed-494c-845e-b743e494861c",
      "subject": "ATTACK:enterprise:C0014",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9df6635a-b3ed-494c-845e-b743e494861c",
      "modified": "2026-09-08T20:28:08.669Z",
      "references": [
        {
          "source_name": "FoxIT Wocao December 2019",
          "url": "https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a01e0e7c-1694-4a6a-8fea-4d4d8a83e034",
      "subject": "ATTACK:enterprise:S0629",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a01e0e7c-1694-4a6a-8fea-4d4d8a83e034",
      "modified": "2026-09-08T20:28:08.679Z",
      "references": [
        {
          "source_name": "Bitdefender Naikon April 2021",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a03d084b-c216-4962-93e8-6c0dc8f0cb91",
      "subject": "ATTACK:enterprise:S0348",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a03d084b-c216-4962-93e8-6c0dc8f0cb91",
      "modified": "2026-09-08T20:28:08.690Z",
      "references": [
        {
          "source_name": "PaloAlto CardinalRat Apr 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a13feeb0-d376-4460-8335-f86c0f163d4b",
      "subject": "ATTACK:enterprise:S0273",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a13feeb0-d376-4460-8335-f86c0f163d4b",
      "modified": "2026-09-08T20:28:08.704Z",
      "references": [
        {
          "source_name": "TrendMicro Patchwork Dec 2017",
          "url": "https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a424a85c-a3c6-4d84-85f7-e55c8dbe21fc",
      "subject": "ATTACK:enterprise:M1037",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a424a85c-a3c6-4d84-85f7-e55c8dbe21fc",
      "modified": "2026-09-08T20:28:08.716Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a637133c-2b07-4e57-8822-5c3bc4b584d7",
      "subject": "ATTACK:enterprise:G0117",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a637133c-2b07-4e57-8822-5c3bc4b584d7",
      "modified": "2026-09-08T20:28:08.727Z",
      "references": [
        {
          "source_name": "CISA AA20-259A Iran-Based Actor September 2020",
          "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-259a"
        },
        {
          "source_name": "ClearSky Pay2Kitten December 2020",
          "url": "https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"
        },
        {
          "source_name": "Check Point Pay2Key November 2020",
          "url": "https://research.checkpoint.com/2020/ransomware-alert-pay2key/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--acde21f1-6ece-44c6-89b4-aee4a6cf0ae1",
      "subject": "ATTACK:enterprise:G1052",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--acde21f1-6ece-44c6-89b4-aee4a6cf0ae1",
      "modified": "2026-09-08T20:28:08.742Z",
      "references": [
        {
          "source_name": "Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025",
          "url": "https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b150e3fd-54c0-49ec-a41f-860e92712344",
      "subject": "ATTACK:enterprise:S0207",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b150e3fd-54c0-49ec-a41f-860e92712344",
      "modified": "2026-09-08T20:28:08.753Z",
      "references": [
        {
          "source_name": "Symantec Vasport May 2012",
          "url": "https://www.symantec.com/security_response/writeup.jsp?docid=2012-051606-5938-99"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b3bbe6c1-b715-418f-ae7c-17488948f9b8",
      "subject": "ATTACK:enterprise:G0069",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b3bbe6c1-b715-418f-ae7c-17488948f9b8",
      "modified": "2026-09-08T20:28:08.766Z",
      "references": [
        {
          "source_name": "FalconFeeds_Iran_Mar2026",
          "url": "https://falconfeeds.io/blogs/the-digital-redoubt-irans-national-information-network-cyber-conflict"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b7cba2d6-7f3e-4402-b195-a21b0cf5e5d2",
      "subject": "ATTACK:enterprise:C0058",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b7cba2d6-7f3e-4402-b195-a21b0cf5e5d2",
      "modified": "2026-09-08T20:28:08.781Z",
      "references": [
        {
          "source_name": "ESET ToolShell JUL 2025",
          "url": "https://www.welivesecurity.com/en/eset-research/toolshell-an-all-you-can-eat-buffet-for-threat-actors/"
        },
        {
          "source_name": "Microsoft SharePoint Exploit JUL 2025",
          "url": "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/#storm-2603"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ba218f25-8703-4042-98b0-42afe1c49503",
      "subject": "ATTACK:enterprise:S0262",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ba218f25-8703-4042-98b0-42afe1c49503",
      "modified": "2026-09-08T20:28:08.793Z",
      "references": [
        {
          "source_name": "GitHub QuasarRAT",
          "url": "https://github.com/quasar/QuasarRAT"
        },
        {
          "source_name": "Volexity Patchwork June 2018",
          "url": "https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--be2fde8e-796c-4647-9351-edd9c97fe2b3",
      "subject": "ATTACK:enterprise:S1190",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--be2fde8e-796c-4647-9351-edd9c97fe2b3",
      "modified": "2026-09-08T20:28:08.805Z",
      "references": [
        {
          "source_name": "WithSecure Kapeka 2024",
          "url": "https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Research-Kapeka.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bee75401-9e24-4c5d-9203-0b3cdca01cbf",
      "subject": "ATTACK:enterprise:G1006",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bee75401-9e24-4c5d-9203-0b3cdca01cbf",
      "modified": "2026-09-08T20:28:08.818Z",
      "references": [
        {
          "source_name": "TrendMicro EarthLusca 2022",
          "url": "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c00bdbcc-fc8d-4abf-9901-2a5cf291e763",
      "subject": "ATTACK:enterprise:G1015",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c00bdbcc-fc8d-4abf-9901-2a5cf291e763",
      "modified": "2026-09-08T20:28:08.828Z",
      "references": [
        {
          "source_name": "CrowdStrike Scattered Spider JUL 2025",
          "url": "https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"
        },
        {
          "source_name": "CISA Scattered Spider Advisory November 2023",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c1205923-690a-4bfb-9116-0a60eb931b26",
      "subject": "ATTACK:enterprise:G0059",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c1205923-690a-4bfb-9116-0a60eb931b26",
      "modified": "2026-09-08T20:28:08.839Z",
      "references": [
        {
          "source_name": "DFIR Phosphorus November 2021",
          "url": "https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c2bbf923-e30e-4888-894c-7c8ba655c753",
      "subject": "ATTACK:enterprise:S0386",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c2bbf923-e30e-4888-894c-7c8ba655c753",
      "modified": "2026-09-08T20:28:08.850Z",
      "references": [
        {
          "source_name": "NJCCIC Ursnif Sept 2016",
          "url": "https://www.cyber.nj.gov/threat-landscape/malware/trojans/ursnif"
        },
        {
          "source_name": "ProofPoint Ursnif Aug 2016",
          "url": "https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c7f1b492-eea7-45d1-ab78-6794c7560c67",
      "subject": "ATTACK:enterprise:S0456",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c7f1b492-eea7-45d1-ab78-6794c7560c67",
      "modified": "2026-09-08T20:28:08.861Z",
      "references": [
        {
          "source_name": "CheckPoint Naikon May 2020",
          "url": "https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c8df91dd-3060-4829-93a2-121b85b6c49b",
      "subject": "ATTACK:enterprise:S0268",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c8df91dd-3060-4829-93a2-121b85b6c49b",
      "modified": "2026-09-08T20:28:08.876Z",
      "references": [
        {
          "source_name": "Talos Bisonal Mar 2020",
          "url": "https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ca493dc3-e2ef-45ee-a352-6c7363bc6c57",
      "subject": "ATTACK:enterprise:S9051",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ca493dc3-e2ef-45ee-a352-6c7363bc6c57",
      "modified": "2026-09-23T22:28:49.974Z",
      "references": [
        {
          "source_name": "CarveyODonnellWelchHuntress_TheGentlemen_May2026",
          "url": "https://www.huntress.com/blog/the-gentlemen-ransomware-defense-evasion-ttps"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cb0931f7-4d6c-4f21-95a8-fd9d74ba30e0",
      "subject": "ATTACK:enterprise:G0096",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cb0931f7-4d6c-4f21-95a8-fd9d74ba30e0",
      "modified": "2026-09-08T20:28:08.888Z",
      "references": [
        {
          "source_name": "FireEye APT41 Aug 2019",
          "url": "https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d3234cf8-0ef7-4447-ae3a-9624f3229265",
      "subject": "ATTACK:enterprise:S0117",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d3234cf8-0ef7-4447-ae3a-9624f3229265",
      "modified": "2026-09-08T20:28:08.900Z",
      "references": [
        {
          "source_name": "Crowdstrike DNC June 2016",
          "url": "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d403d31c-59d6-42bf-91c5-728e14a3f60c",
      "subject": "ATTACK:enterprise:S1141",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d403d31c-59d6-42bf-91c5-728e14a3f60c",
      "modified": "2026-09-08T20:28:08.909Z",
      "references": [
        {
          "source_name": "ESET Turla Lunar toolset May 2024",
          "url": "https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d50b5687-ea69-40f9-86f3-eecd7e015bac",
      "subject": "ATTACK:enterprise:M1031",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d50b5687-ea69-40f9-86f3-eecd7e015bac",
      "modified": "2026-09-08T20:28:08.921Z",
      "references": [
        {
          "source_name": "University of Birmingham C2",
          "url": "https://arxiv.org/pdf/1408.1136"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d8e8d071-fa60-4b6d-a0a4-dc6102f229c8",
      "subject": "ATTACK:enterprise:S1099",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d8e8d071-fa60-4b6d-a0a4-dc6102f229c8",
      "modified": "2026-09-08T20:28:08.932Z",
      "references": [
        {
          "source_name": "Kaspersky ToddyCat June 2022",
          "url": "https://securelist.com/toddycat/106799/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e55f295e-3531-4f53-bd0e-2c51994d8b44",
      "subject": "ATTACK:enterprise:S1051",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e55f295e-3531-4f53-bd0e-2c51994d8b44",
      "modified": "2026-09-08T20:28:08.944Z",
      "references": [
        {
          "source_name": "Mandiant APT41",
          "url": "https://www.mandiant.com/resources/apt41-us-state-governments"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--eb8f0f7c-a37f-4c73-8c75-50d650ae5960",
      "subject": "ATTACK:enterprise:G0047",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--eb8f0f7c-a37f-4c73-8c75-50d650ae5960",
      "modified": "2026-09-08T20:28:08.956Z",
      "references": [
        {
          "source_name": "ESET Gamaredon Sept2024",
          "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f229e2fb-3105-4ae5-abe1-d100209f702c",
      "subject": "ATTACK:enterprise:M1020",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f229e2fb-3105-4ae5-abe1-d100209f702c",
      "modified": "2026-09-08T20:28:08.966Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f38960c1-2f2a-42d4-96f0-661d91062af3",
      "subject": "ATTACK:enterprise:C0027",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f38960c1-2f2a-42d4-96f0-661d91062af3",
      "modified": "2026-09-08T20:28:08.976Z",
      "references": [
        {
          "source_name": "Crowdstrike TELCO BPO Campaign December 2022",
          "url": "https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fd3fde9b-3e7b-4e74-baff-94dc573c8366",
      "subject": "ATTACK:enterprise:C0013",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1090",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fd3fde9b-3e7b-4e74-baff-94dc573c8366",
      "modified": "2026-09-08T20:28:08.989Z",
      "references": [
        {
          "source_name": "Bleeping Computer Op Sharpshooter March 2019",
          "url": "https://www.bleepingcomputer.com/news/security/op-sharpshooter-connected-to-north-koreas-lazarus-group/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    }
  ],
  "source_snapshot": {
    "file": "enterprise-attack-20.0.json",
    "url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
    "sha256": "81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352",
    "bytes": 55271014,
    "checked_at": "2026-10-16T03:31:39Z"
  },
  "notices_url": "https://aol.pm/source-notices.txt",
  "notices": "License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"
}

License
-------
The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,
development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce
MITRE's copyright designation and this license in any such copy.

"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation."

Disclaimers
-----------
MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part
of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover
full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or
variations on existing techniques not documented by ATT&CK.

ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE
ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,
AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT
THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR
FITNESS FOR A PARTICULAR PURPOSE.