{"record":{"id":"ATTACK:enterprise:T1095","title":"Non-Application Layer Protocol","type":"Technique","source_url":"https://attack.mitre.org/techniques/T1095","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--c21d5a77-d422-4a69-acd7-2c53c1faa34b","external_id":"T1095","domain":"enterprise","created":"2017-05-31T21:31:10.728Z","modified":"2026-09-03T19:46:48.129Z","version":"2.4","aliases":[],"tactics":["command-and-control"],"source_references":[{"source_name":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"},{"source_name":"University of Birmingham C2","url":"https://arxiv.org/pdf/1408.1136"},{"source_name":"Cisco Synful Knock Evolution","url":"https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices"},{"source_name":"Microsoft ICMP","url":"http://support.microsoft.com/KB/170292"},{"source_name":"Cisco Blog Legacy Device Attacks","url":"https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954"},{"source_name":"Wikipedia OSI","url":"http://en.wikipedia.org/wiki/List_of_network_protocols_%28OSI_model%29"}]},"assertions":[{"id":"enterprise:relationship--0267872d-3408-409e-8ad8-d39b85ce6a99","subject":"ATTACK:enterprise:S1144","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0267872d-3408-409e-8ad8-d39b85ce6a99","modified":"2026-09-03T19:46:52.715Z","references":[{"source_name":"FRP GitHub","url":"https://github.com/fatedier/frp"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--04610729-6f83-48d4-9f5b-1c1c4a39df3a","subject":"ATTACK:enterprise:S0352","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--04610729-6f83-48d4-9f5b-1c1c4a39df3a","modified":"2026-09-03T19:46:52.790Z","references":[{"source_name":"Unit42 OceanLotus 2017","url":"https://unit42.paloaltonetworks.com/unit42-new-improved-macos-backdoor-oceanlotus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--077ab82e-3847-4dab-80e2-5dc0ea7d8e9e","subject":"ATTACK:enterprise:S0504","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--077ab82e-3847-4dab-80e2-5dc0ea7d8e9e","modified":"2026-09-03T19:46:52.925Z","references":[{"source_name":"Cyberreason Anchor December 2019","url":"https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--090813dc-b370-42e1-a211-4d9e3247968a","subject":"ATTACK:enterprise:S0076","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--090813dc-b370-42e1-a211-4d9e3247968a","modified":"2026-09-03T19:46:53.114Z","references":[{"source_name":"Scarlet Mimic Jan 2016","url":"http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0997f41a-0232-4331-8a11-11a6433d8343","subject":"ATTACK:enterprise:S0456","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0997f41a-0232-4331-8a11-11a6433d8343","modified":"2026-09-03T19:46:53.231Z","references":[{"source_name":"CheckPoint Naikon May 2020","url":"https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0b932e1a-e0a1-4123-bcfe-6957b9ef2409","subject":"ATTACK:enterprise:S0660","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0b932e1a-e0a1-4123-bcfe-6957b9ef2409","modified":"2026-09-03T19:46:53.371Z","references":[{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--15025556-2b38-40de-98a0-e231a16a7949","subject":"ATTACK:enterprise:G0047","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--15025556-2b38-40de-98a0-e231a16a7949","modified":"2026-09-03T19:46:53.593Z","references":[{"source_name":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--151da49e-c3ee-4615-b62e-c8a3c93a32a6","subject":"ATTACK:enterprise:S1016","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--151da49e-c3ee-4615-b62e-c8a3c93a32a6","modified":"2026-09-03T19:46:53.718Z","references":[{"source_name":"ESET DazzleSpy Jan 2022","url":"https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1984ba26-2309-49db-8c42-75951d0ef678","subject":"ATTACK:enterprise:S0155","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1984ba26-2309-49db-8c42-75951d0ef678","modified":"2026-09-03T19:46:53.865Z","references":[{"source_name":"FireEye APT32 May 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1aee2c50-660a-42ee-816d-5823ade525f3","subject":"ATTACK:enterprise:S0666","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1aee2c50-660a-42ee-816d-5823ade525f3","modified":"2026-09-03T19:46:54.059Z","references":[{"source_name":"ESET Gelsemium June 2021","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1b814125-87a8-4860-bf42-b43787216312","subject":"ATTACK:enterprise:S1204","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1b814125-87a8-4860-bf42-b43787216312","modified":"2026-09-03T19:46:54.188Z","references":[{"source_name":"Lumen J-Magic JAN 2025","url":"https://blog.lumen.com/the-j-magic-show-magic-packets-and-where-to-find-them/"},{"source_name":"Hartrell cd00r 2002","url":"https://www.giac.org/paper/gcih/342/handle-cd00r-invisible-backdoor/103631"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--20c30f4a-ff6f-4861-a88a-77d437374994","subject":"ATTACK:enterprise:S0436","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--20c30f4a-ff6f-4861-a88a-77d437374994","modified":"2026-09-03T19:46:54.293Z","references":[{"source_name":"JPCert BlackTech Malware September 2019","url":"https://blogs.jpcert.or.jp/en/2019/09/tscookie-loader.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2302de7d-8c9a-4a92-93d3-e4b00c40b22d","subject":"ATTACK:enterprise:S1100","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2302de7d-8c9a-4a92-93d3-e4b00c40b22d","modified":"2026-09-03T19:46:54.463Z","references":[{"source_name":"Kaspersky ToddyCat June 2022","url":"https://securelist.com/toddycat/106799/"},{"source_name":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--24a917f3-08c0-4ba1-955d-7e9c65dc26f7","subject":"ATTACK:enterprise:S1203","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--24a917f3-08c0-4ba1-955d-7e9c65dc26f7","modified":"2026-09-03T19:46:54.556Z","references":[{"source_name":"Lumen J-Magic JAN 2025","url":"https://blog.lumen.com/the-j-magic-show-magic-packets-and-where-to-find-them/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2b218139-1e96-4e15-9ac3-8d83b4aff072","subject":"ATTACK:enterprise:G1045","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2b218139-1e96-4e15-9ac3-8d83b4aff072","modified":"2026-09-22T21:23:31.301Z","references":[{"source_name":"CISA_AA25-239ASaltTyphoon_Sept2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2eaea386-ee0f-42c4-bca1-ce2d22062f98","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2eaea386-ee0f-42c4-bca1-ce2d22062f98","modified":"2026-09-03T19:46:54.637Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2fe54d3f-0ac2-4579-8e78-81dc11b6386e","subject":"ATTACK:enterprise:S1029","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2fe54d3f-0ac2-4579-8e78-81dc11b6386e","modified":"2026-09-03T19:46:54.826Z","references":[{"source_name":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--300b191d-6832-48ae-ad82-040f066cac08","subject":"ATTACK:enterprise:S1105","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--300b191d-6832-48ae-ad82-040f066cac08","modified":"2026-09-03T19:46:54.898Z","references":[{"source_name":"NCSC-NL COATHANGER Feb 2024","url":"https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear/TLP-CLEAR+MIVD+AIVD+Advisory+COATHANGER.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--32ca8347-dcb9-47c6-a3c3-23e15d03fe68","subject":"ATTACK:enterprise:S1121","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--32ca8347-dcb9-47c6-a3c3-23e15d03fe68","modified":"2026-09-03T19:46:54.997Z","references":[{"source_name":"Mandiant Cutting Edge Part 3 February 2024","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--337835d7-bd03-48ae-bb34-9cf85ffbd4e4","subject":"ATTACK:enterprise:S1189","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--337835d7-bd03-48ae-bb34-9cf85ffbd4e4","modified":"2026-09-03T19:46:55.191Z","references":[{"source_name":"GitHub Neo-reGeorg 2019","url":"https://github.com/L-codes/Neo-reGeorg/blob/master/README-en.md"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--345c6135-7557-4292-8214-66618ba17edd","subject":"ATTACK:enterprise:S0055","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--345c6135-7557-4292-8214-66618ba17edd","modified":"2026-09-03T19:46:55.286Z","references":[{"source_name":"Aquino RARSTONE","url":"http://blog.trendmicro.com/trendlabs-security-intelligence/rarstone-found-in-targeted-attacks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3717f0c2-0963-4b6c-9603-bb01c06b9fe6","subject":"ATTACK:enterprise:S0022","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3717f0c2-0963-4b6c-9603-bb01c06b9fe6","modified":"2026-09-03T19:46:55.385Z","references":[{"source_name":"Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023","url":"https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--37b9ae2f-a386-41aa-90be-497de2d580f5","subject":"ATTACK:enterprise:S0502","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--37b9ae2f-a386-41aa-90be-497de2d580f5","modified":"2026-09-03T19:46:55.462Z","references":[{"source_name":"NSA/FBI Drovorub August 2020","url":"https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3957be97-305f-4d42-9978-868cb83918a2","subject":"ATTACK:enterprise:S0260","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3957be97-305f-4d42-9978-868cb83918a2","modified":"2026-09-03T19:46:55.674Z","references":[{"source_name":"ESET InvisiMole June 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3c6ad797-8dba-4dee-8930-d35e26a782da","subject":"ATTACK:enterprise:C0047","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3c6ad797-8dba-4dee-8930-d35e26a782da","modified":"2026-09-03T19:46:55.790Z","references":[{"source_name":"Recorded Future RedDelta 2025","url":"https://go.recordedfuture.com/hubfs/reports/cta-cn-2025-0109.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3f424011-cde1-4ed5-b067-3cb4d6193d72","subject":"ATTACK:enterprise:S1060","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3f424011-cde1-4ed5-b067-3cb4d6193d72","modified":"2026-09-03T19:46:55.926Z","references":[{"source_name":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--40622bce-ea51-4744-9240-4a4c4bf83753","subject":"ATTACK:enterprise:S0430","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--40622bce-ea51-4744-9240-4a4c4bf83753","modified":"2026-09-03T19:46:56.065Z","references":[{"source_name":"Chronicle Winnti for Linux May 2019","url":"https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--418bde38-35eb-44bc-a454-ad7d2918bda5","subject":"ATTACK:enterprise:M1031","predicate":"mitigates","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--418bde38-35eb-44bc-a454-ad7d2918bda5","modified":"2026-09-03T19:46:56.154Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--432e82e0-54e5-487b-a538-6fc49d7cfc5c","subject":"ATTACK:enterprise:S0681","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--432e82e0-54e5-487b-a538-6fc49d7cfc5c","modified":"2026-09-03T19:46:56.285Z","references":[{"source_name":"SekoiaBourhis_DiceLoader_Feb2024","url":"https://blog.sekoia.io/unveiling-the-intricacies-of-diceloader/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--43edcf0f-1f37-48b6-aa89-aa845611e0f3","subject":"ATTACK:enterprise:G1003","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--43edcf0f-1f37-48b6-aa89-aa845611e0f3","modified":"2026-09-03T19:46:56.448Z","references":[{"source_name":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"},{"source_name":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--44494749-870a-4ca5-beee-85d88f78a693","subject":"ATTACK:enterprise:S1114","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--44494749-870a-4ca5-beee-85d88f78a693","modified":"2026-09-03T19:46:56.527Z","references":[{"source_name":"Mandiant Cutting Edge Part 2 January 2024","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--45754d15-9deb-467f-801d-84c0a8a00238","subject":"ATTACK:enterprise:S9023","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--45754d15-9deb-467f-801d-84c0a8a00238","modified":"2026-09-03T19:46:56.611Z","references":[{"source_name":"ESET HiddenFace 2024","url":"https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_2_8_Breitenbacher_en.pdf"},{"source_name":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"},{"source_name":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--45ef2a23-61b6-4f78-9d86-58a2d50a4ee0","subject":"ATTACK:enterprise:S1059","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--45ef2a23-61b6-4f78-9d86-58a2d50a4ee0","modified":"2026-09-03T19:46:56.688Z","references":[{"source_name":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"},{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4b387706-db60-46d2-bba4-148571381e60","subject":"ATTACK:enterprise:S0630","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4b387706-db60-46d2-bba4-148571381e60","modified":"2026-09-03T19:46:56.758Z","references":[{"source_name":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4bd30351-b64b-47cb-897b-951b76ca668b","subject":"ATTACK:enterprise:S0455","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4bd30351-b64b-47cb-897b-951b76ca668b","modified":"2026-09-03T19:46:56.838Z","references":[{"source_name":"FireEye Metamorfo Apr 2018","url":"https://www.fireeye.com/blog/threat-research/2018/04/metamorfo-campaign-targeting-brazilian-users.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4ee54acd-fc04-43c2-8cf6-2200a802d0b9","subject":"ATTACK:enterprise:S0125","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4ee54acd-fc04-43c2-8cf6-2200a802d0b9","modified":"2026-09-03T19:46:56.942Z","references":[{"source_name":"Symantec Remsec IOCs","url":"http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/Symantec_Remsec_IOCs.pdf"},{"source_name":"Kaspersky ProjectSauron Full Report","url":"https://securelist.com/files/2016/07/The-ProjectSauron-APT_research_KL.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4fb5c14c-5a08-4116-bbb7-d6822649dfa0","subject":"ATTACK:enterprise:S0141","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4fb5c14c-5a08-4116-bbb7-d6822649dfa0","modified":"2026-09-03T19:46:57.008Z","references":[{"source_name":"Novetta Winnti April 2015","url":"https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--51c5e624-d08e-4750-91f9-fdc98ec56552","subject":"ATTACK:enterprise:S0149","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--51c5e624-d08e-4750-91f9-fdc98ec56552","modified":"2026-09-03T19:46:57.090Z","references":[{"source_name":"Palo Alto MoonWind March 2017","url":"http://researchcenter.paloaltonetworks.com/2017/03/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--55b8f35b-7ccc-4da7-9ab1-40fe148cd182","subject":"ATTACK:enterprise:S0394","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--55b8f35b-7ccc-4da7-9ab1-40fe148cd182","modified":"2026-09-03T19:46:57.162Z","references":[{"source_name":"Intezer HiddenWasp Map 2019","url":"https://www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--568964d5-6205-4d46-9d14-2914ba349afd","subject":"ATTACK:enterprise:C0029","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--568964d5-6205-4d46-9d14-2914ba349afd","modified":"2026-09-03T19:46:57.233Z","references":[{"source_name":"Mandiant Cutting Edge Part 3 February 2024","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5bd757cd-ec5b-46f9-8ddf-05673370e494","subject":"ATTACK:enterprise:C0034","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5bd757cd-ec5b-46f9-8ddf-05673370e494","modified":"2026-09-03T19:46:57.288Z","references":[{"source_name":"Mandiant-Sandworm-Ukraine-2022","url":"https://www.mandiant.com/resources/blog/sandworm-disrupts-power-ukraine-operational-technology"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5be3684a-cb63-4328-bba0-22f14298b920","subject":"ATTACK:enterprise:S0515","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5be3684a-cb63-4328-bba0-22f14298b920","modified":"2026-09-03T19:46:57.335Z","references":[{"source_name":"CISA WellMail July 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198c"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5e168a94-8882-4e6d-bc61-e86588b52242","subject":"ATTACK:enterprise:S0699","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5e168a94-8882-4e6d-bc61-e86588b52242","modified":"2026-09-03T19:46:57.391Z","references":[{"source_name":"Mythc Documentation","url":"https://docs.mythic-c2.net/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5e53b45b-ca14-4e8b-8c76-0cf9cb572a92","subject":"ATTACK:enterprise:S0083","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5e53b45b-ca14-4e8b-8c76-0cf9cb572a92","modified":"2026-09-03T19:46:57.437Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--647cf3e6-dcb2-4da2-a60d-b3118cb966bc","subject":"ATTACK:enterprise:S1084","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--647cf3e6-dcb2-4da2-a60d-b3118cb966bc","modified":"2026-09-03T19:46:57.489Z","references":[{"source_name":"Mandiant APT29 Eye Spy Email Nov 22","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--66200ea6-03b8-4c4f-a1d4-9041ddc70d8a","subject":"ATTACK:enterprise:S0556","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--66200ea6-03b8-4c4f-a1d4-9041ddc70d8a","modified":"2026-09-03T19:46:57.530Z","references":[{"source_name":"Check Point Pay2Key November 2020","url":"https://research.checkpoint.com/2020/ransomware-alert-pay2key/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--67f82f6c-18f1-4f1e-8352-b7ecf8839ea2","subject":"ATTACK:enterprise:S0172","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--67f82f6c-18f1-4f1e-8352-b7ecf8839ea2","modified":"2026-09-03T19:46:57.591Z","references":[{"source_name":"Palo Alto Reaver Nov 2017","url":"https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6b9778e3-14f7-4609-8621-d24e2a40c032","subject":"ATTACK:enterprise:S0615","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6b9778e3-14f7-4609-8621-d24e2a40c032","modified":"2026-09-03T19:46:57.636Z","references":[{"source_name":"BlackBerry CostaRicto November 2020","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"},{"source_name":"FireEye FiveHands April 2021","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6c0f270a-cf44-4d71-a398-1d822f1d48ac","subject":"ATTACK:enterprise:S1099","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6c0f270a-cf44-4d71-a398-1d822f1d48ac","modified":"2026-09-03T19:46:57.680Z","references":[{"source_name":"Kaspersky ToddyCat June 2022","url":"https://securelist.com/toddycat/106799/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6daa0c15-e73b-4b0f-8069-8f89638bf6fd","subject":"ATTACK:enterprise:C0021","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6daa0c15-e73b-4b0f-8069-8f89638bf6fd","modified":"2026-09-03T19:46:57.724Z","references":[{"source_name":"FireEye APT29 Nov 2018","url":"https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6fabc88f-9582-4658-807c-7ec583edbd5e","subject":"ATTACK:enterprise:G1022","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6fabc88f-9582-4658-807c-7ec583edbd5e","modified":"2026-09-03T19:46:57.773Z","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7b510a6f-3e11-49b3-bf97-a1ca24bca663","subject":"ATTACK:enterprise:S0501","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7b510a6f-3e11-49b3-bf97-a1ca24bca663","modified":"2026-09-03T19:46:57.828Z","references":[{"source_name":"ESET PipeMon May 2020","url":"https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7bf27f61-0191-4c20-ae96-96c38322470d","subject":"ATTACK:enterprise:S0234","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7bf27f61-0191-4c20-ae96-96c38322470d","modified":"2026-09-03T19:46:57.868Z","references":[{"source_name":"CheckPoint Bandook Nov 2020","url":"https://research.checkpoint.com/2020/bandook-signed-delivered/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7e9168ae-f0dd-4223-bc4b-9f94b08f99ac","subject":"ATTACK:enterprise:S0262","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7e9168ae-f0dd-4223-bc4b-9f94b08f99ac","modified":"2026-09-03T19:46:57.912Z","references":[{"source_name":"CISA AR18-352A Quasar RAT December 2018","url":"https://www.cisa.gov/uscert/ncas/analysis-reports/AR18-352A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--86576242-a9d1-4fd8-82a2-0e7d09d57513","subject":"ATTACK:enterprise:C0035","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--86576242-a9d1-4fd8-82a2-0e7d09d57513","modified":"2026-09-03T19:46:57.951Z","references":[{"source_name":"Lumen KVBotnet 2023","url":"https://blog.lumen.com/routers-roasting-on-an-open-firewall-the-kv-botnet-investigation/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--88640feb-d423-4861-ac34-cb7a8fe4bfac","subject":"ATTACK:enterprise:G0129","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--88640feb-d423-4861-ac34-cb7a8fe4bfac","modified":"2026-09-03T19:46:57.994Z","references":[{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8ad2d1c5-aa94-4c32-94c8-8ffb9d11f54a","subject":"ATTACK:enterprise:M1047","predicate":"mitigates","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8ad2d1c5-aa94-4c32-94c8-8ffb9d11f54a","modified":"2026-09-03T19:46:58.042Z","references":[{"source_name":"Google Cloud Threat Intelligence ESXi Hardening 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-detection-containment-hardening"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8f8adede-8b7a-460d-b852-b52328df178a","subject":"ATTACK:enterprise:S0032","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8f8adede-8b7a-460d-b852-b52328df178a","modified":"2026-09-03T19:46:58.093Z","references":[{"source_name":"Gh0stRAT ATT March 2019","url":"https://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9acd9add-9b08-45dd-8135-98e62eb708e2","subject":"ATTACK:enterprise:M1037","predicate":"mitigates","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9acd9add-9b08-45dd-8135-98e62eb708e2","modified":"2026-09-03T19:46:58.133Z","references":[{"source_name":"Broadcom VMCI Firewall","url":"https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/7-0/vsphere-virtual-machine-administration-guide-7-0/configuring-virtual-machine-hardwarevm-admin/virtual-machine-network-configurationvm-admin/serial-port-configurationvm-admin/configure-the-virtual-machine-communication-interface-firewallvm-admin.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a726ffe8-d192-4f40-be21-ba2ffe32c670","subject":"ATTACK:enterprise:S0596","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a726ffe8-d192-4f40-be21-ba2ffe32c670","modified":"2026-09-03T19:46:58.173Z","references":[{"source_name":"Kaspersky ShadowPad Aug 2017","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a7cdf456-9ad0-402b-a914-5f1ebcd873a3","subject":"ATTACK:enterprise:S0461","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a7cdf456-9ad0-402b-a914-5f1ebcd873a3","modified":"2026-09-03T19:46:58.217Z","references":[{"source_name":"Proofpoint TA505 October 2019","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a877e5c0-3fe6-40bb-bd02-ef4a9465aba3","subject":"ATTACK:enterprise:S1031","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a877e5c0-3fe6-40bb-bd02-ef4a9465aba3","modified":"2026-09-03T19:46:58.265Z","references":[{"source_name":"Unit 42 PingPull Jun 2022","url":"https://unit42.paloaltonetworks.com/pingpull-gallium/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aaea7acb-2ae2-4527-ac83-6a56eb7cc6b3","subject":"ATTACK:enterprise:S1239","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aaea7acb-2ae2-4527-ac83-6a56eb7cc6b3","modified":"2026-09-03T19:46:58.319Z","references":[{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ae3c0dc8-de95-40bc-bced-a3c61d7ad605","subject":"ATTACK:enterprise:S0335","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ae3c0dc8-de95-40bc-bced-a3c61d7ad605","modified":"2026-09-03T19:46:58.371Z","references":[{"source_name":"ESET Carbon Mar 2017","url":"https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b23da7b5-0d2d-4cfa-a2ad-ea89d86fecc6","subject":"ATTACK:enterprise:S0629","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b23da7b5-0d2d-4cfa-a2ad-ea89d86fecc6","modified":"2026-09-03T19:46:58.425Z","references":[{"source_name":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b2a42d95-fc64-4e6f-95d9-7b24334bccd4","subject":"ATTACK:enterprise:M1030","predicate":"mitigates","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b2a42d95-fc64-4e6f-95d9-7b24334bccd4","modified":"2026-09-03T19:46:58.464Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b41abaa3-a21f-4d2c-9c60-c90c4f360b00","subject":"ATTACK:enterprise:S0034","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b41abaa3-a21f-4d2c-9c60-c90c4f360b00","modified":"2026-09-03T19:46:58.497Z","references":[{"source_name":"FireEye APT30","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b46d0c20-61f1-4ab4-be3b-fa7dace805f0","subject":"ATTACK:enterprise:S0582","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b46d0c20-61f1-4ab4-be3b-fa7dace805f0","modified":"2026-09-03T19:46:58.548Z","references":[{"source_name":"Proofpoint LookBack Malware Aug 2019","url":"https://www.proofpoint.com/us/threat-insight/post/lookback-malware-targets-united-states-utilities-sector-phishing-attacks"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b499e6f7-77bc-422b-b7ef-058d223a69e6","subject":"ATTACK:enterprise:S0268","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b499e6f7-77bc-422b-b7ef-058d223a69e6","modified":"2026-09-03T19:46:58.623Z","references":[{"source_name":"Talos Bisonal Mar 2020","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b4cec817-37bb-4b1f-b165-26241efdcea0","subject":"ATTACK:enterprise:S0650","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b4cec817-37bb-4b1f-b165-26241efdcea0","modified":"2026-09-03T19:46:58.657Z","references":[{"source_name":"Kaspersky QakBot September 2021","url":"https://securelist.com/qakbot-technical-analysis/103931/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b720dc1e-50b1-44f6-8c3e-2c6f78ef3497","subject":"ATTACK:enterprise:S1153","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b720dc1e-50b1-44f6-8c3e-2c6f78ef3497","modified":"2026-09-03T19:46:58.694Z","references":[{"source_name":"Kandji Cuckoo April 2024","url":"https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b7f887ee-e0e5-4cab-9898-6dfed9b86f31","subject":"ATTACK:enterprise:S1078","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b7f887ee-e0e5-4cab-9898-6dfed9b86f31","modified":"2026-09-03T19:46:58.733Z","references":[{"source_name":"netlab360 rotajakiro vs oceanlotus","url":"https://blog.netlab.360.com/rotajakiro_linux_version_of_oceanlotus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b80f4569-d64a-48d4-9ff1-a4e4768e000c","subject":"ATTACK:enterprise:S1219","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b80f4569-d64a-48d4-9ff1-a4e4768e000c","modified":"2026-09-03T19:46:58.759Z","references":[{"source_name":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"},{"source_name":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b832110a-0610-4489-9729-a89064b8d61b","subject":"ATTACK:enterprise:S1142","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b832110a-0610-4489-9729-a89064b8d61b","modified":"2026-09-03T19:46:58.779Z","references":[{"source_name":"ESET Turla Lunar toolset May 2024","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b9b0e376-f249-432f-a0d3-dfa259b4757a","subject":"ATTACK:enterprise:S0043","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b9b0e376-f249-432f-a0d3-dfa259b4757a","modified":"2026-09-03T19:46:58.814Z","references":[{"source_name":"FireEye admin@338","url":"https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--baec7508-d69a-4e06-8bf7-6d85d95830c7","subject":"ATTACK:enterprise:S1163","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--baec7508-d69a-4e06-8bf7-6d85d95830c7","modified":"2026-09-03T19:46:58.847Z","references":[{"source_name":"PWC Sea Turtle 2023","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/tortoise-and-malwahare.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c4adb795-a847-47e0-a629-2c430d43974d","subject":"ATTACK:enterprise:S1221","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c4adb795-a847-47e0-a629-2c430d43974d","modified":"2026-09-03T19:46:58.872Z","references":[{"source_name":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c4aec6a5-2c11-45a2-8c79-8cccf85179cb","subject":"ATTACK:enterprise:S0221","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c4aec6a5-2c11-45a2-8c79-8cccf85179cb","modified":"2026-09-03T19:46:58.899Z","references":[{"source_name":"Umbreon Trend Micro","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/pokemon-themed-umbreon-linux-rootkit-hits-x86-arm-systems/?_ga=2.180041126.367598458.1505420282-1759340220.1502477046"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c52eb151-c8c5-45f1-984b-d99a12ca05cf","subject":"ATTACK:enterprise:S0021","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c52eb151-c8c5-45f1-984b-d99a12ca05cf","modified":"2026-09-03T19:46:58.931Z","references":[{"source_name":"Fidelis Turbo","url":"https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2016/2016.02.29.Turbo_Campaign_Derusbi/TA_Fidelis_Turbo_1602_0.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c65d4006-003c-4aff-a8c7-bd5834678b58","subject":"ATTACK:enterprise:G1013","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c65d4006-003c-4aff-a8c7-bd5834678b58","modified":"2026-09-03T19:46:58.945Z","references":[{"source_name":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c83da269-9c77-4941-bf69-8e79bdfa5edf","subject":"ATTACK:enterprise:G0068","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c83da269-9c77-4941-bf69-8e79bdfa5edf","modified":"2026-09-03T19:46:58.962Z","references":[{"source_name":"Microsoft PLATINUM June 2017","url":"https://cloudblogs.microsoft.com/microsoftsecure/2017/06/07/platinum-continues-to-evolve-find-ways-to-maintain-invisibility/?source=mmpc"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c8c8c0bc-0240-4cd1-aff3-edbe19a91e57","subject":"ATTACK:enterprise:S9001","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c8c8c0bc-0240-4cd1-aff3-edbe19a91e57","modified":"2026-09-03T19:46:58.983Z","references":[{"source_name":"AhnLab_SystemBC_Apr2022","url":"https://asec.ahnlab.com/en/33600/"},{"source_name":"SophosGnGal_SystemBC_Dec2020","url":"https://news.sophos.com/en-us/2020/12/16/systembc/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c904b6b7-52f4-42fe-b921-bb5a490c0c3f","subject":"ATTACK:enterprise:S0154","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c904b6b7-52f4-42fe-b921-bb5a490c0c3f","modified":"2026-09-03T19:46:59.002Z","references":[{"source_name":"Talos Cobalt Strike September 2020","url":"https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--caa3a157-248d-4866-8299-e3f9f5becd83","subject":"ATTACK:enterprise:S1200","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--caa3a157-248d-4866-8299-e3f9f5becd83","modified":"2026-09-03T19:46:59.023Z","references":[{"source_name":"Cybereason StealBit Exfiltration Tool","url":"https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cbe08a78-7997-4aef-9b29-b4b002accbc3","subject":"ATTACK:enterprise:S0662","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cbe08a78-7997-4aef-9b29-b4b002accbc3","modified":"2026-09-03T19:46:59.043Z","references":[{"source_name":"Profero APT27 December 2020","url":"https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf"},{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cbf2f9fe-e61b-4a04-a135-d1f6c4ec6cc3","subject":"ATTACK:enterprise:C0014","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cbf2f9fe-e61b-4a04-a135-d1f6c4ec6cc3","modified":"2026-09-03T19:46:59.056Z","references":[{"source_name":"FoxIT Wocao December 2019","url":"https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cd9ce33c-994d-4378-96b3-10cce4bdf8fa","subject":"ATTACK:enterprise:G1048","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cd9ce33c-994d-4378-96b3-10cce4bdf8fa","modified":"2026-09-03T19:46:59.075Z","references":[{"source_name":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"},{"source_name":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"},{"source_name":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ce59452d-d258-435f-aa91-329de56eba8e","subject":"ATTACK:enterprise:S0587","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ce59452d-d258-435f-aa91-329de56eba8e","modified":"2026-09-03T19:46:59.101Z","references":[{"source_name":"Kaspersky Turla Penquin December 2014","url":"https://securelist.com/the-penquin-turla-2/67962/"},{"source_name":"Leonardo Turla Penquin May 2020","url":"https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cef7d272-ee0c-4379-9d7b-63adf1f40252","subject":"ATTACK:enterprise:S0084","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cef7d272-ee0c-4379-9d7b-63adf1f40252","modified":"2026-09-03T19:46:59.120Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d580bb98-25fb-4cf4-9b3f-79b007939202","subject":"ATTACK:enterprise:S0670","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d580bb98-25fb-4cf4-9b3f-79b007939202","modified":"2026-09-03T19:46:59.136Z","references":[{"source_name":"Check Point Warzone Feb 2020","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d661c7eb-11bb-4ef4-804e-665cc361789c","subject":"ATTACK:enterprise:S1063","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d661c7eb-11bb-4ef4-804e-665cc361789c","modified":"2026-09-03T19:46:59.153Z","references":[{"source_name":"Palo Alto Brute Ratel July 2022","url":"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d6c628b9-789a-416b-8abe-cd457e566346","subject":"ATTACK:enterprise:S0115","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d6c628b9-789a-416b-8abe-cd457e566346","modified":"2026-09-03T19:46:59.167Z","references":[{"source_name":"Proofpoint Operation Transparent Tribe March 2016","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"},{"source_name":"Kaspersky Transparent Tribe August 2020","url":"https://securelist.com/transparent-tribe-part-1/98127/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d6cb7440-c39c-4bc2-b30e-5264a7f8753c","subject":"ATTACK:enterprise:G0037","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d6cb7440-c39c-4bc2-b30e-5264a7f8753c","modified":"2026-09-03T19:46:59.191Z","references":[{"source_name":"Trend Micro FIN6 October 2019","url":"https://www.trendmicro.com/en_us/research/19/j/fin6-compromised-e-commerce-platform-via-magecart-to-inject-credit-card-skimmers-into-thousands-of-online-shops.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d92f4be1-6745-45a2-bfbb-c4cb227682d2","subject":"ATTACK:enterprise:G0135","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d92f4be1-6745-45a2-bfbb-c4cb227682d2","modified":"2026-09-03T19:46:59.214Z","references":[{"source_name":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d942783e-906f-4d2c-963b-1cc2f8429ff1","subject":"ATTACK:enterprise:S1073","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d942783e-906f-4d2c-963b-1cc2f8429ff1","modified":"2026-09-03T19:46:59.234Z","references":[{"source_name":"Cybereason Royal December 2022","url":"https://www.cybereason.com/blog/royal-ransomware-analysis"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--da6e7647-cfe3-4ba9-af97-d442ffed09cd","subject":"ATTACK:enterprise:S1140","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--da6e7647-cfe3-4ba9-af97-d442ffed09cd","modified":"2026-09-03T19:46:59.250Z","references":[{"source_name":"Google TAG COLDRIVER January 2024","url":"https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dd2c9cb1-9c5a-4c97-83e4-4beee309a7cb","subject":"ATTACK:enterprise:S0498","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dd2c9cb1-9c5a-4c97-83e4-4beee309a7cb","modified":"2026-09-03T19:46:59.272Z","references":[{"source_name":"SentinelOne Lazarus macOS July 2020","url":"https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--df4b49f1-71ca-4744-8554-47bf36174d89","subject":"ATTACK:enterprise:G0022","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--df4b49f1-71ca-4744-8554-47bf36174d89","modified":"2026-09-03T19:46:59.294Z","references":[{"source_name":"FireEye Operation Double Tap","url":"https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e506c970-b916-4107-9f52-133b2e1b4e6f","subject":"ATTACK:enterprise:C0056","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e506c970-b916-4107-9f52-133b2e1b4e6f","modified":"2026-09-03T19:46:59.327Z","references":[{"source_name":"Censys RedPenguin MAR 2025","url":"https://censys.com/blog/junos-and-redpenguin"},{"source_name":"Juniper RedPenguin MAR 2025","url":"https://supportportal.juniper.net/sfc/servlet.shepherd/document/download/069Dp00000FzdmIIAR?operationContext=S1"},{"source_name":"Mandiant UNC3886 Juniper Routers MAR 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e7ac3ee3-a014-4b07-9bad-b93d3d1d0f4b","subject":"ATTACK:enterprise:S0019","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e7ac3ee3-a014-4b07-9bad-b93d3d1d0f4b","modified":"2026-09-03T19:46:59.348Z","references":[{"source_name":"Kaspersky Regin","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070305/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e7f27ed5-a90a-49c0-bd81-a10a98f77574","subject":"ATTACK:enterprise:G1002","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e7f27ed5-a90a-49c0-bd81-a10a98f77574","modified":"2026-09-03T19:46:59.366Z","references":[{"source_name":"Forcepoint BITTER Pakistan Oct 2016","url":"https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e88cccd3-9559-4b33-adff-268e74bc932f","subject":"ATTACK:enterprise:S1187","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e88cccd3-9559-4b33-adff-268e74bc932f","modified":"2026-09-03T19:46:59.392Z","references":[{"source_name":"Fortinet reGeorg MAR 2019","url":"https://www.fortiguard.com/encyclopedia/ips/47584/regeorg-http-tunnel"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e8b7172d-ae96-4334-98f5-3bfc71122474","subject":"ATTACK:enterprise:C0039","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e8b7172d-ae96-4334-98f5-3bfc71122474","modified":"2026-09-03T19:46:59.414Z","references":[{"source_name":"Lumen Versa 2024","url":"https://blog.lumen.com/taking-the-crossroads-the-versa-director-zero-day-exploitation/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e9500f3a-11d5-46f5-96d8-14313b95142e","subject":"ATTACK:enterprise:S1051","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e9500f3a-11d5-46f5-96d8-14313b95142e","modified":"2026-09-03T19:46:59.437Z","references":[{"source_name":"Mandiant APT41","url":"https://www.mandiant.com/resources/apt41-us-state-governments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e98a8ed8-24eb-4390-b528-5e023eafe69e","subject":"ATTACK:enterprise:S1227","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e98a8ed8-24eb-4390-b528-5e023eafe69e","modified":"2026-09-03T19:46:59.464Z","references":[{"source_name":"Zscaler","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eaf4c445-8af9-48b7-9971-01a371145fde","subject":"ATTACK:enterprise:S0198","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eaf4c445-8af9-48b7-9971-01a371145fde","modified":"2026-09-03T19:46:59.489Z","references":[{"source_name":"Red Canary NETWIRE January 2020","url":"https://redcanary.com/blog/netwire-remote-access-trojan-on-linux/"},{"source_name":"Unit 42 NETWIRE April 2020","url":"https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eeb6919d-5296-4438-a87a-651fd23ab580","subject":"ATTACK:enterprise:S1245","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eeb6919d-5296-4438-a87a-651fd23ab580","modified":"2026-09-03T19:46:59.520Z","references":[{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f503c254-b86c-433e-8107-585c53f23b6e","subject":"ATTACK:enterprise:G0125","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f503c254-b86c-433e-8107-585c53f23b6e","modified":"2026-09-03T19:46:59.556Z","references":[{"source_name":"Microsoft HAFNIUM March 2020","url":"https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fc99ba1c-8782-4864-9009-77f8338cb3ed","subject":"ATTACK:enterprise:S1044","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fc99ba1c-8782-4864-9009-77f8338cb3ed","modified":"2026-09-03T19:46:59.587Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fce7fac2-91da-4903-95dc-fb54650c0859","subject":"ATTACK:enterprise:S0158","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fce7fac2-91da-4903-95dc-fb54650c0859","modified":"2026-09-03T19:46:59.612Z","references":[{"source_name":"FireEye APT32 May 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fee0eb4c-b629-45ea-ae20-d8f037fd658e","subject":"ATTACK:enterprise:S1049","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fee0eb4c-b629-45ea-ae20-d8f037fd658e","modified":"2026-09-03T19:46:59.653Z","references":[{"source_name":"Mandiant UNC3890 Aug 2022","url":"https://www.mandiant.com/resources/blog/suspected-iranian-actor-targeting-israeli-shipping"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ff5b6f0f-df63-4561-8c62-4894b3e424b7","subject":"ATTACK:enterprise:S0011","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ff5b6f0f-df63-4561-8c62-4894b3e424b7","modified":"2026-09-03T19:46:59.681Z","references":[{"source_name":"CISA MAR-10292089-1.v2 TAIDOOR August 2021","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ffcb5325-43d1-4b54-a9a5-f785c628136e","subject":"ATTACK:enterprise:S1085","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ffcb5325-43d1-4b54-a9a5-f785c628136e","modified":"2026-09-03T19:46:59.707Z","references":[{"source_name":"Bitdefender Sardonic Aug 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}