{"record":{"id":"ATTACK:enterprise:T1113","title":"Screen Capture","type":"Technique","source_url":"https://attack.mitre.org/techniques/T1113","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--0259baeb-9f63-4c69-bf10-eb038c390688","external_id":"T1113","domain":"enterprise","created":"2017-05-31T21:31:25.060Z","modified":"2026-05-12T15:12:00.619Z","version":"1.1","aliases":[],"tactics":["collection"],"source_references":[{"source_name":"CopyFromScreen .NET","url":"https://docs.microsoft.com/en-us/dotnet/api/system.drawing.graphics.copyfromscreen?view=netframework-4.8"},{"source_name":"Antiquated Mac Malware","url":"https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/"}]},"assertions":[{"id":"enterprise:relationship--00cd22e3-0291-45e8-9d05-e3243f5d9eee","subject":"ATTACK:enterprise:S9031","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--00cd22e3-0291-45e8-9d05-e3243f5d9eee","modified":"2026-04-29T14:23:05.904Z","references":[{"source_name":"Palo Alto Ashen Lepus DEC 2025","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0471088d-7b45-4fec-8946-ae5bf463286b","subject":"ATTACK:enterprise:S0147","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0471088d-7b45-4fec-8946-ae5bf463286b","modified":"2026-04-29T14:23:05.909Z","references":[{"source_name":"Palo Alto Gamaredon Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"},{"source_name":"Unit 42 Gamaredon February 2022","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--05119f3a-ad4c-41a8-b4af-10813f657437","subject":"ATTACK:enterprise:G1055","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--05119f3a-ad4c-41a8-b4af-10813f657437","modified":"2026-07-31T18:48:25.151Z","references":[{"source_name":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--06b747a6-a3d2-441e-9a24-b79491be3647","subject":"ATTACK:enterprise:S0417","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--06b747a6-a3d2-441e-9a24-b79491be3647","modified":"2026-04-29T14:23:05.912Z","references":[{"source_name":"SecureList Griffon May 2019","url":"https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--073215cd-bc1e-48e8-8f3a-7d24f18b32c6","subject":"ATTACK:enterprise:S0044","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--073215cd-bc1e-48e8-8f3a-7d24f18b32c6","modified":"2026-06-13T12:07:50.831Z","references":[{"source_name":"Talos Seduploader Oct 2017","url":"https://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"},{"source_name":"Unit 42 Playbook Dec 2017","url":"https://web.archive.org/web/20230702043312/https://pan-unit42.github.io/playbook_viewer/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--08109d9e-3258-4b9b-8e1d-ea90d05c18b9","subject":"ATTACK:enterprise:S0331","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--08109d9e-3258-4b9b-8e1d-ea90d05c18b9","modified":"2026-04-29T14:23:05.914Z","references":[{"source_name":"Talos Agent Tesla Oct 2018","url":"https://blog.talosintelligence.com/2018/10/old-dog-new-tricks-analysing-new-rtf_15.html"},{"source_name":"DigiTrust Agent Tesla Jan 2017","url":"https://www.digitrustgroup.com/agent-tesla-keylogger/"},{"source_name":"Fortinet Agent Tesla April 2018","url":"https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html"},{"source_name":"Fortinet Agent Tesla June 2017","url":"https://www.fortinet.com/blog/threat-research/in-depth-analysis-of-net-malware-javaupdtr.html"},{"source_name":"Bitdefender Agent Tesla April 2020","url":"https://labs.bitdefender.com/2020/04/oil-gas-spearphishing-campaigns-drop-agent-tesla-spyware-in-advance-of-historic-opec-deal/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--08b30f76-ca12-4d2c-9345-ee51bfd54e9f","subject":"ATTACK:enterprise:G0035","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--08b30f76-ca12-4d2c-9345-ee51bfd54e9f","modified":"2026-07-31T20:48:28.315Z","references":[{"source_name":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"},{"source_name":"Symantec Dragonfly Sept 2017","url":"https://docs.broadcom.com/doc/dragonfly_threat_against_western_energy_suppliers"},{"source_name":"Gigamon Berserk Bear October 2021","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--09869965-8dcd-4c20-a997-c075b6ed0434","subject":"ATTACK:enterprise:S0192","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--09869965-8dcd-4c20-a997-c075b6ed0434","modified":"2026-04-29T14:23:05.916Z","references":[{"source_name":"GitHub Pupy","url":"https://github.com/n1nj4sec/pupy"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--09c63f56-1c5b-4195-9d1a-73b77865ffb8","subject":"ATTACK:enterprise:S0199","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--09c63f56-1c5b-4195-9d1a-73b77865ffb8","modified":"2026-04-29T14:23:05.917Z","references":[{"source_name":"FireEye APT33 Sept 2017","url":"https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0bd9fd2b-e2f7-48f1-8988-31c041691585","subject":"ATTACK:enterprise:S0094","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0bd9fd2b-e2f7-48f1-8988-31c041691585","modified":"2026-04-29T14:23:05.919Z","references":[{"source_name":"Symantec Dragonfly","url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"},{"source_name":"Secureworks Karagany July 2019","url":"https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0c1f6d5f-3094-4834-94a9-5a615e7c319c","subject":"ATTACK:enterprise:S0182","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0c1f6d5f-3094-4834-94a9-5a615e7c319c","modified":"2026-04-29T14:23:05.920Z","references":[{"source_name":"Microsoft FinFisher March 2018","url":"https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/"},{"source_name":"FinFisher Citation","url":"https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0eda9c73-fcf0-4796-8000-8dfea88887f4","subject":"ATTACK:enterprise:S1207","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0eda9c73-fcf0-4796-8000-8dfea88887f4","modified":"2026-04-29T14:23:05.924Z","references":[{"source_name":"Netskope XLoader 2022","url":"https://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails"},{"source_name":"Google XLoader 2017","url":"https://cloud.google.com/blog/topics/threat-intelligence/formbook-malware-distribution-campaigns/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0f64f141-1f0f-4374-879d-b08f0fda8979","subject":"ATTACK:enterprise:S0338","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0f64f141-1f0f-4374-879d-b08f0fda8979","modified":"2026-04-29T14:23:05.925Z","references":[{"source_name":"Zscaler Cobian Aug 2017","url":"https://www.zscaler.com/blogs/research/cobian-rat-backdoored-rat"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--11010986-1b4d-4158-b47d-bbff34306c98","subject":"ATTACK:enterprise:S0128","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--11010986-1b4d-4158-b47d-bbff34306c98","modified":"2026-04-29T14:23:05.927Z","references":[{"source_name":"Forcepoint Monsoon","url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"},{"source_name":"PaloAlto Patchwork Mar 2018","url":"https://researchcenter.paloaltonetworks.com/2018/03/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--145d2112-b679-4d72-b484-7524f944e128","subject":"ATTACK:enterprise:S0458","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--145d2112-b679-4d72-b484-7524f944e128","modified":"2026-04-29T14:23:05.932Z","references":[{"source_name":"Antiy CERT Ramsay April 2020","url":"https://www.programmersought.com/article/62493896999/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--147d2e66-25de-42ea-8592-eb51333f595c","subject":"ATTACK:enterprise:S0089","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--147d2e66-25de-42ea-8592-eb51333f595c","modified":"2026-04-29T14:23:05.932Z","references":[{"source_name":"Securelist BlackEnergy Nov 2014","url":"https://securelist.com/be2-custom-plugins-router-abuse-and-target-profiles/67353/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1557ceea-6626-41ab-935f-ae0f96723184","subject":"ATTACK:enterprise:S1196","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1557ceea-6626-41ab-935f-ae0f96723184","modified":"2026-04-29T14:23:05.933Z","references":[{"source_name":"S2W Troll Stealer 2024","url":"https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"},{"source_name":"Symantec Troll Stealer 2024","url":"https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--16d5d573-60bb-402c-88c3-2bc0af8388eb","subject":"ATTACK:enterprise:S0030","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--16d5d573-60bb-402c-88c3-2bc0af8388eb","modified":"2026-04-29T14:23:05.935Z","references":[{"source_name":"FireEye CARBANAK June 2017","url":"https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--177772b9-329e-4c43-95ed-f9ce99ae250c","subject":"ATTACK:enterprise:S1239","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--177772b9-329e-4c43-95ed-f9ce99ae250c","modified":"2026-04-29T14:23:05.936Z","references":[{"source_name":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--18ed716d-2865-4a7a-98f8-915f07c183dc","subject":"ATTACK:enterprise:S0644","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--18ed716d-2865-4a7a-98f8-915f07c183dc","modified":"2026-04-29T14:23:05.938Z","references":[{"source_name":"Talos Oblique RAT March 2021","url":"https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1957974e-1995-4d35-a32b-e355ae219ff8","subject":"ATTACK:enterprise:S0660","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1957974e-1995-4d35-a32b-e355ae219ff8","modified":"2026-04-29T14:23:05.939Z","references":[{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1e86ff72-2edc-4924-9f05-7e559b54ac82","subject":"ATTACK:enterprise:S1213","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1e86ff72-2edc-4924-9f05-7e559b54ac82","modified":"2026-04-29T14:23:05.946Z","references":[{"source_name":"Cybereason LumaStealer Undated","url":"https://www.cybereason.com/blog/threat-analysis-rise-of-lummastealer"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1f7e10b8-f8ea-4731-af67-7201452d32be","subject":"ATTACK:enterprise:S1050","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1f7e10b8-f8ea-4731-af67-7201452d32be","modified":"2026-04-29T14:23:05.947Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--21c130df-4123-4f57-9ea2-9ceac05af597","subject":"ATTACK:enterprise:S0363","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--21c130df-4123-4f57-9ea2-9ceac05af597","modified":"2026-04-29T14:23:05.951Z","references":[{"source_name":"Github PowerShell Empire","url":"https://github.com/PowerShellEmpire/Empire"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2723c701-96d8-44e9-96ce-34c57e50a68e","subject":"ATTACK:enterprise:S1122","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2723c701-96d8-44e9-96ce-34c57e50a68e","modified":"2026-04-29T14:23:05.958Z","references":[{"source_name":"ESET Security Mispadu Facebook Ads 2019","url":"https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/"},{"source_name":"Metabase Q Mispadu Trojan 2023","url":"https://www.metabaseq.com/mispadu-banking-trojan/"},{"source_name":"SCILabs Malteiro 2021","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"},{"source_name":"SCILabs URSA/Mispadu Evolution 2023","url":"https://blog.scilabs.mx/en/evolution-of-banking-trojan-ursa-mispadu/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--28d4a66d-2b1f-4662-9e8e-4ba8ff4bcaf0","subject":"ATTACK:enterprise:S0235","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--28d4a66d-2b1f-4662-9e8e-4ba8ff4bcaf0","modified":"2026-04-29T14:23:05.960Z","references":[{"source_name":"Lookout Dark Caracal Jan 2018","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--290c4e3b-00be-411f-b0c8-919e85e08a49","subject":"ATTACK:enterprise:S0113","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--290c4e3b-00be-411f-b0c8-919e85e08a49","modified":"2026-04-29T14:23:05.961Z","references":[{"source_name":"ESET Operation Groundbait","url":"http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2d840d1b-28d7-4387-86fd-6d3df8650171","subject":"ATTACK:enterprise:G0060","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2d840d1b-28d7-4387-86fd-6d3df8650171","modified":"2026-07-31T18:48:10.205Z","references":[{"source_name":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"},{"source_name":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2d920718-61fc-4e10-ad09-df0a00d69cd4","subject":"ATTACK:enterprise:S0017","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2d920718-61fc-4e10-ad09-df0a00d69cd4","modified":"2026-04-29T14:23:05.966Z","references":[{"source_name":"Mandiant APT1 Appendix","url":"https://www.mandiant.com/sites/default/files/2021-09/mandiant-apt1-report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2fb2a011-a35a-403a-a86b-d5489b1fa5c6","subject":"ATTACK:enterprise:S1016","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2fb2a011-a35a-403a-a86b-d5489b1fa5c6","modified":"2026-04-29T14:23:05.974Z","references":[{"source_name":"ESET DazzleSpy Jan 2022","url":"https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"},{"source_name":"Objective-See MacMa Nov 2021","url":"https://objective-see.org/blog/blog_0x69.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--33fb5b08-700d-4c29-a971-c7493b904d1a","subject":"ATTACK:enterprise:S1081","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--33fb5b08-700d-4c29-a971-c7493b904d1a","modified":"2026-04-29T14:23:05.988Z","references":[{"source_name":"BitDefender BADHATCH Mar 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--357dc150-9787-4b39-b18a-a0a38778a44f","subject":"ATTACK:enterprise:S1185","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--357dc150-9787-4b39-b18a-a0a38778a44f","modified":"2026-04-29T14:23:05.991Z","references":[{"source_name":"Huntress LightSpy macOS 2024","url":"https://www.huntress.com/blog/lightspy-malware-variant-targeting-macos"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--36cdeef3-a216-44cd-ad79-dd8085e86fc3","subject":"ATTACK:enterprise:S0385","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--36cdeef3-a216-44cd-ad79-dd8085e86fc3","modified":"2026-04-29T14:23:05.995Z","references":[{"source_name":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"},{"source_name":"Trend Micro njRAT 2018","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/autoit-compiled-worm-affecting-removable-media-delivers-fileless-version-of-bladabindi-njrat-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3982f2f1-8fdd-4ccd-84e6-6a13c919c4c9","subject":"ATTACK:enterprise:S0647","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3982f2f1-8fdd-4ccd-84e6-6a13c919c4c9","modified":"2026-04-29T14:23:05.999Z","references":[{"source_name":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3a0a1c4d-2b99-4c72-9aa1-d002c403ee63","subject":"ATTACK:enterprise:S1229","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3a0a1c4d-2b99-4c72-9aa1-d002c403ee63","modified":"2026-04-29T14:23:05.999Z","references":[{"source_name":"Immersive Labs Havoc C2 APR 2024","url":"https://www.immersivelabs.com/resources/blog/havoc-c2-framework-a-defensive-operators-guide"},{"source_name":"Zscaler Havoc FEB 2023","url":"https://www.zscaler.com/blogs/security-research/havoc-across-cyberspace"},{"source_name":"Havoc Framework Documentation","url":"https://havocframework.com/docs/welcome"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3a9117f6-9244-4d09-a69b-43afbb4d2998","subject":"ATTACK:enterprise:G0047","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3a9117f6-9244-4d09-a69b-43afbb4d2998","modified":"2026-07-31T18:47:47.549Z","references":[{"source_name":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source_name":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source_name":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3d1fe308-5bef-4e7a-9daa-333680a11d7b","subject":"ATTACK:enterprise:S0351","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3d1fe308-5bef-4e7a-9daa-333680a11d7b","modified":"2026-04-29T14:23:06.008Z","references":[{"source_name":"Unit42 Cannon Nov 2018","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3e2d4ce8-0006-4571-b8ea-dbfc4bf7302f","subject":"ATTACK:enterprise:S0251","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3e2d4ce8-0006-4571-b8ea-dbfc4bf7302f","modified":"2026-04-29T14:23:06.010Z","references":[{"source_name":"Unit42 Cannon Nov 2018","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"},{"source_name":"ESET Zebrocy Nov 2018","url":"https://www.welivesecurity.com/2018/11/20/sednit-whats-going-zebrocy/"},{"source_name":"Unit42 Sofacy Dec 2018","url":"https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/"},{"source_name":"ESET Zebrocy May 2019","url":"https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/"},{"source_name":"Accenture SNAKEMACKEREL Nov 2018","url":"https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"},{"source_name":"CISA Zebrocy Oct 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303b"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3edc3698-c8a9-4212-b34e-1f3a44fbd00d","subject":"ATTACK:enterprise:S0467","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3edc3698-c8a9-4212-b34e-1f3a44fbd00d","modified":"2026-04-29T14:23:06.010Z","references":[{"source_name":"Kaspersky TajMahal April 2019","url":"https://securelist.com/project-tajmahal/90240/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4183341a-f5ed-4914-9dc5-0eb7c1d6c4e6","subject":"ATTACK:enterprise:S0154","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4183341a-f5ed-4914-9dc5-0eb7c1d6c4e6","modified":"2026-04-29T14:23:06.014Z","references":[{"source_name":"cobaltstrike manual","url":"https://web.archive.org/web/20210825130434/https://cobaltstrike.com/downloads/csmanual38.pdf"},{"source_name":"Amnesty Intl. Ocean Lotus February 2021","url":"https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--45060bf9-f01b-48a2-8a03-082ad7e7945f","subject":"ATTACK:enterprise:S0546","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--45060bf9-f01b-48a2-8a03-082ad7e7945f","modified":"2026-04-29T14:23:06.020Z","references":[{"source_name":"Cybereason Molerats Dec 2020","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf"},{"source_name":"BleepingComputer Molerats Dec 2020","url":"https://www.bleepingcomputer.com/news/security/hacking-group-s-new-malware-abuses-google-and-facebook-services/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--45a1721f-67a3-479a-befe-d136ed0fdad3","subject":"ATTACK:enterprise:S0260","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--45a1721f-67a3-479a-befe-d136ed0fdad3","modified":"2026-04-29T14:23:06.020Z","references":[{"source_name":"ESET InvisiMole June 2018","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"},{"source_name":"ESET InvisiMole June 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--45cd89d8-68fd-42a2-94ba-7796a696bc47","subject":"ATTACK:enterprise:G0049","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--45cd89d8-68fd-42a2-94ba-7796a696bc47","modified":"2026-07-31T20:48:35.407Z","references":[{"source_name":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--48f662fe-1ba2-4c19-b782-dd06d9fb67fa","subject":"ATTACK:enterprise:G0007","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--48f662fe-1ba2-4c19-b782-dd06d9fb67fa","modified":"2026-07-31T20:48:44.605Z","references":[{"source_name":"ESET Sednit Part 2","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"},{"source_name":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"},{"source_name":"XAgentOSX 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/"},{"source_name":"Secureworks IRON TWILIGHT Active Measures March 2017","url":"https://www.secureworks.com/research/iron-twilight-supports-active-measures"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--48fb8267-5d68-467b-a2c0-8302cc15ebed","subject":"ATTACK:enterprise:S0153","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--48fb8267-5d68-467b-a2c0-8302cc15ebed","modified":"2026-04-29T14:23:06.025Z","references":[{"source_name":"Accenture Hogfish April 2018","url":"http://web.archive.org/web/20220810112638/https:/www.accenture.com/t20180423T055005Z_w_/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"},{"source_name":"FireEye APT10 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--494a0c44-2822-4f53-977e-f36a949d8258","subject":"ATTACK:enterprise:S0692","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--494a0c44-2822-4f53-977e-f36a949d8258","modified":"2026-04-29T14:23:06.025Z","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--49d50fde-cfbc-4007-befc-f4b22b9bc9f5","subject":"ATTACK:enterprise:S0495","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--49d50fde-cfbc-4007-befc-f4b22b9bc9f5","modified":"2026-04-29T14:23:06.026Z","references":[{"source_name":"Unit42 RDAT July 2020","url":"https://unit42.paloaltonetworks.com/oilrig-novel-c2-channel-steganography/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4ab6eb52-821c-45da-b7d9-63840fe657cf","subject":"ATTACK:enterprise:S0330","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4ab6eb52-821c-45da-b7d9-63840fe657cf","modified":"2026-04-29T14:23:06.027Z","references":[{"source_name":"GDATA Zeus Panda June 2017","url":"https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4b3274fe-1960-4d1e-91d1-2091e467c45b","subject":"ATTACK:enterprise:S0412","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4b3274fe-1960-4d1e-91d1-2091e467c45b","modified":"2026-04-29T14:23:06.028Z","references":[{"source_name":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4deeafce-daf7-4dc8-a949-80eaf086ca0e","subject":"ATTACK:enterprise:G1019","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4deeafce-daf7-4dc8-a949-80eaf086ca0e","modified":"2026-07-31T20:48:38.809Z","references":[{"source_name":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4e2f4bbd-ea3b-4996-bc2a-3d670d9f5cf5","subject":"ATTACK:enterprise:S0216","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4e2f4bbd-ea3b-4996-bc2a-3d670d9f5cf5","modified":"2026-04-29T14:23:06.032Z","references":[{"source_name":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4ea07638-aca6-400b-9979-26b9002e990c","subject":"ATTACK:enterprise:S0662","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4ea07638-aca6-400b-9979-26b9002e990c","modified":"2026-04-29T14:23:06.032Z","references":[{"source_name":"Profero APT27 December 2020","url":"https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4f2fb45a-8359-4c75-93ae-095fcf9f856e","subject":"ATTACK:enterprise:S0275","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4f2fb45a-8359-4c75-93ae-095fcf9f856e","modified":"2026-04-29T14:23:06.033Z","references":[{"source_name":"ESET MirrorFace 2025","url":"https://www.welivesecurity.com/en/eset-research/operation-akairyu-mirrorface-invites-europe-expo-2025-revives-anel-backdoor/"},{"source_name":"Trend Micro Earth Kasha Anel NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"},{"source_name":"Trend Micro Earth Kasha Updates APR 2025","url":"https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html"},{"source_name":"FireEye APT10 Sept 2018","url":"https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4f8e76b5-603e-4557-8635-465d988a4072","subject":"ATTACK:enterprise:S1063","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4f8e76b5-603e-4557-8635-465d988a4072","modified":"2026-04-29T14:23:06.034Z","references":[{"source_name":"Palo Alto Brute Ratel July 2022","url":"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--513f6b4c-c9b1-4339-910e-376b2a908689","subject":"ATTACK:enterprise:G0115","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--513f6b4c-c9b1-4339-910e-376b2a908689","modified":"2026-07-31T20:48:46.017Z","references":[{"source_name":"Tetra Defense Sodinokibi March 2020","url":"https://web.archive.org/web/20210414101816/https://tetradefense.com/incident-response-services/cause-and-effect-sodinokibi-ransomware-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--516fd2f8-a709-43f4-86e1-c753e28113e1","subject":"ATTACK:enterprise:S0680","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--516fd2f8-a709-43f4-86e1-c753e28113e1","modified":"2026-04-29T14:23:06.037Z","references":[{"source_name":"Kaspersky WIRTE November 2021","url":"https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5249b0e7-878e-44db-9d59-f162067f1852","subject":"ATTACK:enterprise:S0337","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5249b0e7-878e-44db-9d59-f162067f1852","modified":"2026-04-29T14:23:06.038Z","references":[{"source_name":"Unit 42 BadPatch Oct 2017","url":"https://researchcenter.paloaltonetworks.com/2017/10/unit42-badpatch/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--535b87bb-31fd-4e14-8279-c64c301e912d","subject":"ATTACK:enterprise:S0456","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--535b87bb-31fd-4e14-8279-c64c301e912d","modified":"2026-04-29T14:23:06.039Z","references":[{"source_name":"CheckPoint Naikon May 2020","url":"https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--536cdc1b-65c7-4236-8e2a-b0093495c9d9","subject":"ATTACK:enterprise:S1240","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--536cdc1b-65c7-4236-8e2a-b0093495c9d9","modified":"2026-04-29T14:23:06.039Z","references":[{"source_name":"McAfee RedLine Stealer April 2024","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/redline-stealer-a-novel-approach/"},{"source_name":"Splunk RedLine Stealer June 2023","url":"https://www.splunk.com/en_us/blog/security/do-not-cross-the-redline-stealer-detections-and-analysis.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--57733df2-7d2d-470a-afbb-8f48b7c53821","subject":"ATTACK:enterprise:S1153","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--57733df2-7d2d-470a-afbb-8f48b7c53821","modified":"2026-04-29T14:23:06.045Z","references":[{"source_name":"Kandji Cuckoo April 2024","url":"https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5797b454-e7cc-45a3-9bf1-7708d7286531","subject":"ATTACK:enterprise:S0476","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5797b454-e7cc-45a3-9bf1-7708d7286531","modified":"2026-04-29T14:23:06.045Z","references":[{"source_name":"Cybereason Valak May 2020","url":"https://www.cybereason.com/blog/valak-more-than-meets-the-eye"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--58d20f74-b41a-45c3-b6de-41a3d6cf86e0","subject":"ATTACK:enterprise:G1044","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--58d20f74-b41a-45c3-b6de-41a3d6cf86e0","modified":"2026-07-31T18:48:16.176Z","references":[{"source_name":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5b6293d5-f49c-4dbe-bef3-73bb346c3fe4","subject":"ATTACK:enterprise:S1159","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5b6293d5-f49c-4dbe-bef3-73bb346c3fe4","modified":"2026-04-29T14:23:06.050Z","references":[{"source_name":"Google Cloud APT41 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6184b127-47cf-43fc-880b-890554d9cc9a","subject":"ATTACK:enterprise:S0090","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6184b127-47cf-43fc-880b-890554d9cc9a","modified":"2026-04-29T14:23:06.058Z","references":[{"source_name":"Palo Alto Rover","url":"http://researchcenter.paloaltonetworks.com/2016/02/new-malware-rover-targets-indian-ambassador-to-afghanistan/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--638b21af-b5d5-44dd-9d14-ea3c2be3eb4e","subject":"ATTACK:enterprise:S0681","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--638b21af-b5d5-44dd-9d14-ea3c2be3eb4e","modified":"2026-04-29T14:23:06.060Z","references":[{"source_name":"BiZone Lizar May 2021","url":"https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"},{"source_name":"Threatpost Lizar May 2021","url":"https://threatpost.com/fin7-backdoor-ethical-hacking-tool/166194/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--65f7704a-358a-464d-b09b-fee5dd96adf3","subject":"ATTACK:enterprise:G0059","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--65f7704a-358a-464d-b09b-fee5dd96adf3","modified":"2026-07-31T18:48:28.523Z","references":[{"source_name":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--67731257-6a0a-46cf-8f7e-cc6793d5fdb9","subject":"ATTACK:enterprise:S1209","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--67731257-6a0a-46cf-8f7e-cc6793d5fdb9","modified":"2026-04-29T14:23:06.066Z","references":[{"source_name":"Microsoft Quick Assist 2024","url":"https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6c10bd99-6932-451d-b739-13adf1276a22","subject":"ATTACK:enterprise:S0643","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6c10bd99-6932-451d-b739-13adf1276a22","modified":"2026-04-29T14:23:06.072Z","references":[{"source_name":"Proofpoint Operation Transparent Tribe March 2016","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6db82410-1fcf-483a-be5b-cf09c361b4eb","subject":"ATTACK:enterprise:S0187","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6db82410-1fcf-483a-be5b-cf09c361b4eb","modified":"2026-04-29T14:23:06.074Z","references":[{"source_name":"Trend Micro Daserf Nov 2017","url":"http://blog.trendmicro.com/trendlabs-security-intelligence/redbaldknight-bronze-butler-daserf-backdoor-now-using-steganography/"},{"source_name":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6dbdaa06-8c0c-4b74-8274-1adbd80d0940","subject":"ATTACK:enterprise:S9020","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6dbdaa06-8c0c-4b74-8274-1adbd80d0940","modified":"2026-04-29T14:23:06.075Z","references":[{"source_name":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"},{"source_name":"Kaspersky LODEINFO Part II OCT 2022","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-ii/107745/"},{"source_name":"ITOCHU LODEINFO JAN 2024","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6f01abdc-bd94-4645-afed-8d3bd365bba4","subject":"ATTACK:enterprise:S0004","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6f01abdc-bd94-4645-afed-8d3bd365bba4","modified":"2026-04-29T14:23:06.076Z","references":[{"source_name":"Cylance Cleaver","url":"https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6f6b8a04-916e-4f33-8837-ff48e00e771b","subject":"ATTACK:enterprise:G0069","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6f6b8a04-916e-4f33-8837-ff48e00e771b","modified":"2026-07-31T20:48:29.898Z","references":[{"source_name":"Securelist MuddyWater Oct 2018","url":"https://securelist.com/muddywater/88059/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--717d87d5-df97-48a9-8766-c9a947541e1d","subject":"ATTACK:enterprise:S0115","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--717d87d5-df97-48a9-8766-c9a947541e1d","modified":"2026-04-29T14:23:06.080Z","references":[{"source_name":"Kaspersky Transparent Tribe August 2020","url":"https://securelist.com/transparent-tribe-part-1/98127/"},{"source_name":"Proofpoint Operation Transparent Tribe March 2016","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"},{"source_name":"Cisco Talos Transparent Tribe Education Campaign July 2022","url":"https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--71cd5162-6352-4e19-9a02-2d8510333f6a","subject":"ATTACK:enterprise:G1035","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--71cd5162-6352-4e19-9a02-2d8510333f6a","modified":"2026-07-31T18:48:03.111Z","references":[{"source_name":"CERT-UA WinterVivern 2023","url":"https://cert.gov.ua/article/3761104"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7201204c-d21f-4560-a3d1-c75fabacb4c4","subject":"ATTACK:enterprise:S0023","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7201204c-d21f-4560-a3d1-c75fabacb4c4","modified":"2026-04-29T14:23:06.081Z","references":[{"source_name":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7296e1e2-514d-4a6c-a1fe-18558a5e3b0f","subject":"ATTACK:enterprise:S0086","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7296e1e2-514d-4a6c-a1fe-18558a5e3b0f","modified":"2026-04-29T14:23:06.082Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7331b11d-1d5e-4275-ba7e-a83ec4a59259","subject":"ATTACK:enterprise:S0050","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7331b11d-1d5e-4275-ba7e-a83ec4a59259","modified":"2026-04-29T14:23:06.083Z","references":[{"source_name":"F-Secure Cosmicduke","url":"https://blog.f-secure.com/wp-content/uploads/2019/10/CosmicDuke.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--75a82c43-c3f2-4cec-a9cb-3407b03f27b7","subject":"ATTACK:enterprise:S0438","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--75a82c43-c3f2-4cec-a9cb-3407b03f27b7","modified":"2026-04-29T14:23:06.086Z","references":[{"source_name":"ESET Attor Oct 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--778765e1-7eb6-46b1-a370-6dfe09081ee3","subject":"ATTACK:enterprise:G0091","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--778765e1-7eb6-46b1-a370-6dfe09081ee3","modified":"2026-07-31T18:48:21.197Z","references":[{"source_name":"SecureList Silence Nov 2017","url":"https://securelist.com/the-silence/83009/"},{"source_name":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--77c31f47-883a-4381-a70e-96bd5f1371d3","subject":"ATTACK:enterprise:S1059","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--77c31f47-883a-4381-a70e-96bd5f1371d3","modified":"2026-04-29T14:23:06.089Z","references":[{"source_name":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"},{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--77fcf452-80a6-4922-99fa-896fe68a8c8a","subject":"ATTACK:enterprise:G1017","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--77fcf452-80a6-4922-99fa-896fe68a8c8a","modified":"2026-07-31T18:47:40.674Z","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--77fd0c13-d101-438a-a3fb-dfdcaa6e21ce","subject":"ATTACK:enterprise:S1064","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--77fd0c13-d101-438a-a3fb-dfdcaa6e21ce","modified":"2026-04-29T14:23:06.089Z","references":[{"source_name":"HP SVCReady Jun 2022","url":"https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--792c5ad3-87ca-473f-998b-654f29a5b10f","subject":"ATTACK:enterprise:S0194","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--792c5ad3-87ca-473f-998b-654f29a5b10f","modified":"2026-04-29T14:23:06.091Z","references":[{"source_name":"GitHub PowerSploit May 2012","url":"https://github.com/PowerShellMafia/PowerSploit"},{"source_name":"PowerSploit Documentation","url":"http://powersploit.readthedocs.io"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7ba62129-a4ba-42b4-9971-4a650682cb52","subject":"ATTACK:enterprise:S0143","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7ba62129-a4ba-42b4-9971-4a650682cb52","modified":"2026-04-29T14:23:06.095Z","references":[{"source_name":"Kaspersky Flame","url":"https://securelist.com/the-flame-questions-and-answers-51/34344/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7cd4244c-38ef-4396-a76d-0450b7f1a651","subject":"ATTACK:enterprise:S9007","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7cd4244c-38ef-4396-a76d-0450b7f1a651","modified":"2026-04-29T14:23:06.096Z","references":[{"source_name":"Gen Digital Kimsuky HTTPTroy October 2025","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7e1ace47-17af-4291-b5f1-6b3c64c8ea6d","subject":"ATTACK:enterprise:S1034","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7e1ace47-17af-4291-b5f1-6b3c64c8ea6d","modified":"2026-04-29T14:23:06.098Z","references":[{"source_name":"Cybereason StrifeWater Feb 2022","url":"https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8140f09f-af3b-45e1-ae7c-f2dc85b8930e","subject":"ATTACK:enterprise:S0257","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8140f09f-af3b-45e1-ae7c-f2dc85b8930e","modified":"2026-04-29T14:23:06.102Z","references":[{"source_name":"Unit 42 VERMIN Jan 2018","url":"https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--831afa86-aa1b-42d9-8c67-1c03f5879a42","subject":"ATTACK:enterprise:S1156","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--831afa86-aa1b-42d9-8c67-1c03f5879a42","modified":"2026-04-29T14:23:06.105Z","references":[{"source_name":"Talos Manjusaka 2022","url":"https://blog.talosintelligence.com/manjusaka-offensive-framework/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--83c4e8d9-1746-43eb-af67-71e10a24da6f","subject":"ATTACK:enterprise:S0386","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--83c4e8d9-1746-43eb-af67-71e10a24da6f","modified":"2026-04-29T14:23:06.105Z","references":[{"source_name":"TrendMicro Ursnif Mar 2015","url":"https://web.archive.org/web/20210719165945/https://www.trendmicro.com/en_us/research/15/c/ursnif-the-multifaceted-malware.html?_ga=2.165628854.808042651.1508120821-744063452.1505819992"},{"source_name":"TrendMicro BKDR_URSNIF.SM","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/BKDR_URSNIF.SM?_ga=2.129468940.1462021705.1559742358-1202584019.1549394279"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--85fda77f-5129-4de7-bc44-f81ccc46f6d9","subject":"ATTACK:enterprise:S1065","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--85fda77f-5129-4de7-bc44-f81ccc46f6d9","modified":"2026-04-29T14:23:06.108Z","references":[{"source_name":"MalwareBytes WoodyRAT Aug 2022","url":"https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8630a3fb-9f65-4c54-b3d6-c379d03029dc","subject":"ATTACK:enterprise:S0582","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8630a3fb-9f65-4c54-b3d6-c379d03029dc","modified":"2026-04-29T14:23:06.108Z","references":[{"source_name":"Proofpoint LookBack Malware Aug 2019","url":"https://www.proofpoint.com/us/threat-insight/post/lookback-malware-targets-united-states-utilities-sector-phishing-attacks"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8852f9e4-c2f1-4d24-8bc6-8539ec4180a5","subject":"ATTACK:enterprise:S0593","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8852f9e4-c2f1-4d24-8bc6-8539ec4180a5","modified":"2026-04-29T14:23:06.111Z","references":[{"source_name":"CISA EB Aug 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-239a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--89574823-b59e-4a8e-87b1-8bbb9531b603","subject":"ATTACK:enterprise:S1060","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--89574823-b59e-4a8e-87b1-8bbb9531b603","modified":"2026-04-29T14:23:06.113Z","references":[{"source_name":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8a039d93-db2d-4a98-81d4-357425574bab","subject":"ATTACK:enterprise:S0437","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8a039d93-db2d-4a98-81d4-357425574bab","modified":"2026-04-29T14:23:06.113Z","references":[{"source_name":"TrendMicro BlackTech June 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8bcc4714-800c-4d13-8b85-2bdf107f5fb4","subject":"ATTACK:enterprise:S0633","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8bcc4714-800c-4d13-8b85-2bdf107f5fb4","modified":"2026-04-29T14:23:06.116Z","references":[{"source_name":"GitHub Sliver Screen","url":"https://github.com/BishopFox/sliver/blob/master/implant/sliver/screen/screenshot_windows.go"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8d761618-146f-4219-9b50-a4ceca6b2210","subject":"ATTACK:enterprise:S0213","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8d761618-146f-4219-9b50-a4ceca6b2210","modified":"2026-04-29T14:23:06.118Z","references":[{"source_name":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"},{"source_name":"Unit 42 Nokki Oct 2018","url":"https://researchcenter.paloaltonetworks.com/2018/10/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8e69c855-db70-4b5e-866b-f9ce0b786156","subject":"ATTACK:enterprise:G0043","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8e69c855-db70-4b5e-866b-f9ce0b786156","modified":"2026-07-31T18:48:02.531Z","references":[{"source_name":"Citizen Lab Group5","url":"https://citizenlab.ca/2016/08/group5-syria/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9069440f-f2d0-4548-94a8-6759a31b1425","subject":"ATTACK:enterprise:S0663","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9069440f-f2d0-4548-94a8-6759a31b1425","modified":"2026-04-29T14:23:06.122Z","references":[{"source_name":"Trend Micro Iron Tiger April 2021","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--90ce2bf5-4fef-4d9d-b670-2a5ae8b7ba4d","subject":"ATTACK:enterprise:S0398","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--90ce2bf5-4fef-4d9d-b670-2a5ae8b7ba4d","modified":"2026-04-29T14:23:06.122Z","references":[{"source_name":"Unit42 Emissary Panda May 2019","url":"https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--91718be6-b03a-48fd-a1ab-a54d7148ffa2","subject":"ATTACK:enterprise:S1044","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--91718be6-b03a-48fd-a1ab-a54d7148ffa2","modified":"2026-04-29T14:23:06.123Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--924b50a5-3fae-496c-8167-610fa261a10f","subject":"ATTACK:enterprise:S1201","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--924b50a5-3fae-496c-8167-610fa261a10f","modified":"2026-04-29T14:23:06.124Z","references":[{"source_name":"Zscaler Kimsuky TRANSLATEXT","url":"https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--932beba4-bb6a-4174-abe3-353d2e39337c","subject":"ATTACK:enterprise:G0087","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--932beba4-bb6a-4174-abe3-353d2e39337c","modified":"2026-07-31T18:47:53.792Z","references":[{"source_name":"Symantec Chafer February 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"},{"source_name":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9532ee14-8d66-41c1-855a-209fbb3ee3af","subject":"ATTACK:enterprise:S0667","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9532ee14-8d66-41c1-855a-209fbb3ee3af","modified":"2026-04-29T14:23:06.128Z","references":[{"source_name":"ESET Gelsemium June 2021","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--97a68907-3642-4f23-aeae-55ad5bbd7b86","subject":"ATTACK:enterprise:S0277","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--97a68907-3642-4f23-aeae-55ad5bbd7b86","modified":"2026-04-29T14:23:06.132Z","references":[{"source_name":"objsee mac malware 2017","url":"https://objective-see.com/blog/blog_0x25.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--988a0f0f-b3dc-4ff7-8062-29d3975cb897","subject":"ATTACK:enterprise:S0332","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--988a0f0f-b3dc-4ff7-8062-29d3975cb897","modified":"2026-04-29T14:23:06.133Z","references":[{"source_name":"Riskiq Remcos Jan 2018","url":"https://web.archive.org/web/20180124082756/https://www.riskiq.com/blog/labs/spear-phishing-turkish-defense-contractors/"},{"source_name":"Fortinet Remcos Campaign NOV 2024","url":"https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9ae45b84-016d-4617-a4fd-3a309dc94b57","subject":"ATTACK:enterprise:S1090","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9ae45b84-016d-4617-a4fd-3a309dc94b57","modified":"2026-04-29T14:23:06.136Z","references":[{"source_name":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9cb17d40-fe0f-4b68-bac7-78778c8772d7","subject":"ATTACK:enterprise:S0381","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9cb17d40-fe0f-4b68-bac7-78778c8772d7","modified":"2026-04-29T14:23:06.139Z","references":[{"source_name":"Korean FSI TA505 2020","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a56aafe6-4a54-4ce5-b927-8b56826b3445","subject":"ATTACK:enterprise:S0167","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a56aafe6-4a54-4ce5-b927-8b56826b3445","modified":"2026-04-29T14:23:06.150Z","references":[{"source_name":"ClearSky Wilted Tulip July 2017","url":"http://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf"},{"source_name":"CopyKittens Nov 2015","url":"https://cdn2.hubspot.net/hubfs/1903456/Whitepapers/CopyKittens.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a6f8439f-bf5a-4e57-8ae5-758e5097a0ff","subject":"ATTACK:enterprise:S1148","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a6f8439f-bf5a-4e57-8ae5-758e5097a0ff","modified":"2026-04-29T14:23:06.152Z","references":[{"source_name":"Sekoia Raccoon2 2022","url":"https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis/"},{"source_name":"S2W Racoon 2022","url":"https://medium.com/s2wblog/raccoon-stealer-is-back-with-a-new-version-5f436e04b20d"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a724a449-cd4d-419a-90a0-cdd5927c60b7","subject":"ATTACK:enterprise:S0062","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a724a449-cd4d-419a-90a0-cdd5927c60b7","modified":"2026-04-29T14:23:06.153Z","references":[{"source_name":"Kaspersky MoleRATs April 2019","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a80ece05-37e1-4828-a9e8-27b30524960b","subject":"ATTACK:enterprise:S0234","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a80ece05-37e1-4828-a9e8-27b30524960b","modified":"2026-04-29T14:23:06.154Z","references":[{"source_name":"Lookout Dark Caracal Jan 2018","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"},{"source_name":"CheckPoint Bandook Nov 2020","url":"https://research.checkpoint.com/2020/bandook-signed-delivered/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a883e4c6-6a40-4660-9120-b2430099ccb6","subject":"ATTACK:enterprise:S0203","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a883e4c6-6a40-4660-9120-b2430099ccb6","modified":"2026-04-29T14:23:06.155Z","references":[{"source_name":"Symantec Hydraq Jan 2010","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2010-011114-1830-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ac773743-8f22-4193-a2de-b562e7a13709","subject":"ATTACK:enterprise:S0629","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ac773743-8f22-4193-a2de-b562e7a13709","modified":"2026-04-29T14:23:06.160Z","references":[{"source_name":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ade60661-8dfb-473a-8d12-014ba0273934","subject":"ATTACK:enterprise:S0088","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ade60661-8dfb-473a-8d12-014ba0273934","modified":"2026-04-29T14:23:06.162Z","references":[{"source_name":"Zscaler Kasidet","url":"http://research.zscaler.com/2016/01/malicious-office-files-dropping-kasidet.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--af7323ae-bb42-49fd-9c8d-218a1335f662","subject":"ATTACK:enterprise:S0356","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--af7323ae-bb42-49fd-9c8d-218a1335f662","modified":"2026-04-29T14:23:06.164Z","references":[{"source_name":"Talos Konni May 2017","url":"https://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b0a40611-da3c-4447-b0af-fa66f927b623","subject":"ATTACK:enterprise:S0032","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b0a40611-da3c-4447-b0af-fa66f927b623","modified":"2026-04-29T14:23:06.166Z","references":[{"source_name":"Nccgroup Gh0st April 2018","url":"https://research.nccgroup.com/2018/04/17/decoding-network-data-from-a-gh0st-rat-variant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b0b07276-d3d9-47ea-9fdd-412ed00325d9","subject":"ATTACK:enterprise:C0063","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b0b07276-d3d9-47ea-9fdd-412ed00325d9","modified":"2026-07-31T20:48:19.921Z","references":[{"source_name":"CERT Polska","url":"https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b2ae2606-fea8-4caf-a79e-91f09932d6d4","subject":"ATTACK:enterprise:S0265","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b2ae2606-fea8-4caf-a79e-91f09932d6d4","modified":"2026-04-29T14:23:06.169Z","references":[{"source_name":"Unit 42 Kazuar May 2017","url":"https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b2b873cd-8618-426e-9cae-9e6755acafad","subject":"ATTACK:enterprise:S0152","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b2b873cd-8618-426e-9cae-9e6755acafad","modified":"2026-04-29T14:23:06.169Z","references":[{"source_name":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b4795040-fe94-429a-9853-f30c09ba05aa","subject":"ATTACK:enterprise:S0151","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b4795040-fe94-429a-9853-f30c09ba05aa","modified":"2026-04-29T14:23:06.172Z","references":[{"source_name":"FireEye FIN7 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b5d200f9-2b85-46c8-980a-0692e49ccdfc","subject":"ATTACK:enterprise:S0455","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b5d200f9-2b85-46c8-980a-0692e49ccdfc","modified":"2026-04-29T14:23:06.174Z","references":[{"source_name":"FireEye Metamorfo Apr 2018","url":"https://www.fireeye.com/blog/threat-research/2018/04/metamorfo-campaign-targeting-brazilian-users.html"},{"source_name":"ESET Casbaneiro Oct 2019","url":"https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b81d449d-9ebd-4fb8-a77a-bb6bca93581b","subject":"ATTACK:enterprise:S0248","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b81d449d-9ebd-4fb8-a77a-bb6bca93581b","modified":"2026-04-29T14:23:06.177Z","references":[{"source_name":"ASERT Donot March 2018","url":"https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b8a7be73-89a5-4689-8eea-280b745bd3cc","subject":"ATTACK:enterprise:S0339","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b8a7be73-89a5-4689-8eea-280b745bd3cc","modified":"2026-04-29T14:23:06.177Z","references":[{"source_name":"Radware Micropsia July 2018","url":"https://www.radware.com/blog/security/2018/07/micropsia-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b8bab261-69f2-49b4-83df-c2f8997753b1","subject":"ATTACK:enterprise:S0649","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b8bab261-69f2-49b4-83df-c2f8997753b1","modified":"2026-04-29T14:23:06.177Z","references":[{"source_name":"FireEye Shining A Light on DARKSIDE May 2021","url":"https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"},{"source_name":"FireEye SMOKEDHAM June 2021","url":"https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bb39cbf2-a9dc-4c31-9fb9-b6c456c2005c","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bb39cbf2-a9dc-4c31-9fb9-b6c456c2005c","modified":"2026-04-29T14:23:06.181Z","references":[{"source_name":"CIRCL PlugX March 2013","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bd2f299e-e471-4f32-96b6-8dc32e872c74","subject":"ATTACK:enterprise:S0387","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bd2f299e-e471-4f32-96b6-8dc32e872c74","modified":"2026-04-29T14:23:06.184Z","references":[{"source_name":"PWC KeyBoys Feb 2017","url":"https://web.archive.org/web/20211129064701/https://www.pwc.co.uk/issues/cyber-security-services/research/the-keyboys-are-back-in-town.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bec2b0d9-b76e-4acb-a9a4-adebe4c854c0","subject":"ATTACK:enterprise:S0273","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bec2b0d9-b76e-4acb-a9a4-adebe4c854c0","modified":"2026-04-29T14:23:06.186Z","references":[{"source_name":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bf53c414-9ea5-4f56-8f73-eb7d2287f651","subject":"ATTACK:enterprise:G0094","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bf53c414-9ea5-4f56-8f73-eb7d2287f651","modified":"2026-07-31T20:48:25.412Z","references":[{"source_name":"Gen Digital Kimsuky HTTPTroy October 2025","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"},{"source_name":"Zscaler Kimsuky TRANSLATEXT","url":"https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c0223316-4b0b-461e-8947-01c0f5baeef2","subject":"ATTACK:enterprise:S0161","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c0223316-4b0b-461e-8947-01c0f5baeef2","modified":"2026-04-29T14:23:06.188Z","references":[{"source_name":"XAgentOSX 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c2888af5-ccdd-43f1-947c-1abd69272ec2","subject":"ATTACK:enterprise:S0271","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c2888af5-ccdd-43f1-947c-1abd69272ec2","modified":"2026-04-29T14:23:06.191Z","references":[{"source_name":"US-CERT KEYMARBLE Aug 2018","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-221A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c4d751fa-60cc-4254-9737-d7df6518eabe","subject":"ATTACK:enterprise:S0591","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c4d751fa-60cc-4254-9737-d7df6518eabe","modified":"2026-04-29T14:23:06.194Z","references":[{"source_name":"Anomali Static Kitten February 2021","url":"https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c4f4e2ba-5ad8-4787-8d69-cc6720619ac9","subject":"ATTACK:enterprise:S1142","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c4f4e2ba-5ad8-4787-8d69-cc6720619ac9","modified":"2026-04-29T14:23:06.194Z","references":[{"source_name":"ESET Turla Lunar toolset May 2024","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c4f662d6-7e47-4161-bf8d-dd445ae901b1","subject":"ATTACK:enterprise:S0240","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c4f662d6-7e47-4161-bf8d-dd445ae901b1","modified":"2026-04-29T14:23:06.194Z","references":[{"source_name":"Talos ROKRAT","url":"https://blog.talosintelligence.com/2017/04/introducing-rokrat.html"},{"source_name":"Talos ROKRAT 2","url":"https://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"},{"source_name":"Securelist ScarCruft May 2019","url":"https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/"},{"source_name":"NCCGroup RokRat Nov 2018","url":"https://research.nccgroup.com/2018/11/08/rokrat-analysis/"},{"source_name":"Malwarebytes RokRAT VBA January 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c67ddbdb-7e07-45b3-9f7d-5cdf959ac3b2","subject":"ATTACK:enterprise:S0379","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c67ddbdb-7e07-45b3-9f7d-5cdf959ac3b2","modified":"2026-04-29T14:23:06.197Z","references":[{"source_name":"Cylance Shaheen Nov 2018","url":"https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c784f835-5d15-4fc6-a7ad-88d1a9050159","subject":"ATTACK:enterprise:S0021","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c784f835-5d15-4fc6-a7ad-88d1a9050159","modified":"2026-04-29T14:23:06.198Z","references":[{"source_name":"FireEye Periscope March 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ca71a63a-4481-46d2-98b2-b83cce190380","subject":"ATTACK:enterprise:S0198","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ca71a63a-4481-46d2-98b2-b83cce190380","modified":"2026-04-29T14:23:06.202Z","references":[{"source_name":"Red Canary NETWIRE January 2020","url":"https://redcanary.com/blog/netwire-remote-access-trojan-on-linux/"},{"source_name":"FireEye NETWIRE March 2019","url":"https://www.mandiant.com/resources/blog/dissecting-netwire-phishing-campaigns-usage-process-hollowing"},{"source_name":"McAfee Netwire Mar 2015","url":"https://securingtomorrow.mcafee.com/mcafee-labs/netwire-rat-behind-recent-targeted-attacks/"},{"source_name":"Proofpoint NETWIRE December 2020","url":"https://www.proofpoint.com/us/blog/threat-insight/geofenced-netwire-campaigns"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cdb1549e-d3e6-4826-8f42-ca85fa9d08eb","subject":"ATTACK:enterprise:S0279","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cdb1549e-d3e6-4826-8f42-ca85fa9d08eb","modified":"2026-04-29T14:23:06.206Z","references":[{"source_name":"objsee mac malware 2017","url":"https://objective-see.com/blog/blog_0x25.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ce9f3239-13ee-4741-b839-8e7c68d5f9ef","subject":"ATTACK:enterprise:S1149","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ce9f3239-13ee-4741-b839-8e7c68d5f9ef","modified":"2026-04-29T14:23:06.208Z","references":[{"source_name":"Mandiant ROADSWEEP August 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d0eaa321-d917-4dee-aca4-6644ed2df1df","subject":"ATTACK:enterprise:S0622","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d0eaa321-d917-4dee-aca4-6644ed2df1df","modified":"2026-04-29T14:23:06.211Z","references":[{"source_name":"Malwarebytes Kimsuky June 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"},{"source_name":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d5b4ef43-ddb4-4f95-95b9-6a352700bb77","subject":"ATTACK:enterprise:S0375","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d5b4ef43-ddb4-4f95-95b9-6a352700bb77","modified":"2026-04-29T14:23:06.217Z","references":[{"source_name":"Securelist Remexi Jan 2019","url":"https://securelist.com/chafer-used-remexi-malware/89538/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d8a844bc-373b-44aa-831a-da33d1505ae3","subject":"ATTACK:enterprise:S0217","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d8a844bc-373b-44aa-831a-da33d1505ae3","modified":"2026-04-29T14:23:06.221Z","references":[{"source_name":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d9338b91-b07b-4ea1-9e2f-4fe06e58ce62","subject":"ATTACK:enterprise:S0428","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d9338b91-b07b-4ea1-9e2f-4fe06e58ce62","modified":"2026-04-29T14:23:06.222Z","references":[{"source_name":"Talos PoetRAT April 2020","url":"https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"},{"source_name":"Dragos Threat Report 2020","url":"https://hub.dragos.com/hubfs/Year-in-Review/Dragos_2020_ICS_Cybersecurity_Year_In_Review.pdf?hsCtaTracking=159c0fc3-92d8-425d-aeb8-12824f2297e8%7Cf163726d-579b-4996-9a04-44e5a124d770"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dd812f2c-a0a0-4543-af23-25e71c899bf4","subject":"ATTACK:enterprise:S0454","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dd812f2c-a0a0-4543-af23-25e71c899bf4","modified":"2026-04-29T14:23:06.227Z","references":[{"source_name":"Symantec Chafer Dec 2015","url":"https://www.symantec.com/connect/blogs/iran-based-attackers-use-back-door-threats-spy-middle-eastern-targets"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dd89d8a2-257a-47f9-8b55-8011ca53007b","subject":"ATTACK:enterprise:S0098","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dd89d8a2-257a-47f9-8b55-8011ca53007b","modified":"2026-04-29T14:23:06.227Z","references":[{"source_name":"Palo Alto T9000 Feb 2016","url":"http://researchcenter.paloaltonetworks.com/2016/02/t9000-advanced-modular-backdoor-uses-complex-anti-analysis-techniques/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dde11422-660a-42b1-b231-fb2fd98ed644","subject":"ATTACK:enterprise:S0674","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dde11422-660a-42b1-b231-fb2fd98ed644","modified":"2026-04-29T14:23:06.228Z","references":[{"source_name":"Check Point APT35 CharmPower January 2022","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e1a70685-4492-4866-a10b-7630be265c86","subject":"ATTACK:enterprise:S0484","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e1a70685-4492-4866-a10b-7630be265c86","modified":"2026-04-29T14:23:06.233Z","references":[{"source_name":"Prevx Carberp March 2011","url":"https://web.archive.org/web/20231227000328/http://pxnow.prevx.com/content/blog/carberp-a_modular_information_stealing_trojan.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e43ab91c-ad83-4469-8a8f-ce3337cdcb12","subject":"ATTACK:enterprise:S0657","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e43ab91c-ad83-4469-8a8f-ce3337cdcb12","modified":"2026-04-29T14:23:06.236Z","references":[{"source_name":"Volexity InkySquid BLUELIGHT August 2021","url":"https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e67e4cbe-e8f6-433b-a1d2-e869c35f6a52","subject":"ATTACK:enterprise:S0282","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e67e4cbe-e8f6-433b-a1d2-e869c35f6a52","modified":"2026-04-29T14:23:06.239Z","references":[{"source_name":"objsee mac malware 2017","url":"https://objective-see.com/blog/blog_0x25.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e6bdbd69-aa50-4540-9706-d91ca2de72d0","subject":"ATTACK:enterprise:S9058","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e6bdbd69-aa50-4540-9706-d91ca2de72d0","modified":"2026-09-28T16:46:29.218Z","references":[{"source_name":"Mandiant_UNC1549_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e7477fbb-361f-4502-99d4-75576d6d3ac7","subject":"ATTACK:enterprise:S0533","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e7477fbb-361f-4502-99d4-75576d6d3ac7","modified":"2026-04-29T14:23:06.240Z","references":[{"source_name":"CISA MAR SLOTHFULMEDIA October 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e769177d-17b8-443b-b939-206d724fbb40","subject":"ATTACK:enterprise:S0270","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e769177d-17b8-443b-b939-206d724fbb40","modified":"2026-04-29T14:23:06.240Z","references":[{"source_name":"Unit 42 DarkHydrus July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e8a1c5ce-e02f-44f6-939d-a77378f06890","subject":"ATTACK:enterprise:S0631","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e8a1c5ce-e02f-44f6-939d-a77378f06890","modified":"2026-04-29T14:23:06.242Z","references":[{"source_name":"Cybereason Chaes Nov 2020","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e93c8f61-b2c9-4877-8c2c-12bd37aa5a87","subject":"ATTACK:enterprise:S0223","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e93c8f61-b2c9-4877-8c2c-12bd37aa5a87","modified":"2026-04-29T14:23:06.243Z","references":[{"source_name":"FireEye MuddyWater Mar 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"},{"source_name":"TrendMicro POWERSTATS V3 June 2019","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ea2f957a-b144-4f06-b3fe-891df62f9444","subject":"ATTACK:enterprise:S0283","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ea2f957a-b144-4f06-b3fe-891df62f9444","modified":"2026-04-29T14:23:06.244Z","references":[{"source_name":"jRAT Symantec Aug 2018","url":"https://www.symantec.com/blogs/threat-intelligence/jrat-new-anti-parsing-techniques"},{"source_name":"Kaspersky Adwind Feb 2016","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07195002/KL_AdwindPublicReport_2016.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eb2f2175-9c0f-4217-b5da-7e29b882e4e2","subject":"ATTACK:enterprise:S0592","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eb2f2175-9c0f-4217-b5da-7e29b882e4e2","modified":"2026-04-29T14:23:06.245Z","references":[{"source_name":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ec8f73de-eab1-4d3b-88c0-7885716aa748","subject":"ATTACK:enterprise:G0070","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ec8f73de-eab1-4d3b-88c0-7885716aa748","modified":"2026-09-02T18:51:44.414Z","references":[{"source_name":"Lookout Dark Caracal Jan 2018","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ed522c9c-038b-43c0-af66-e81b954104f2","subject":"ATTACK:enterprise:S0184","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ed522c9c-038b-43c0-af66-e81b954104f2","modified":"2026-04-29T14:23:06.248Z","references":[{"source_name":"FireEye APT34 Dec 2017","url":"https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ed592480-2e4d-4604-aa8d-89bf58d72f6b","subject":"ATTACK:enterprise:S1087","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ed592480-2e4d-4604-aa8d-89bf58d72f6b","modified":"2026-04-29T14:23:06.248Z","references":[{"source_name":"AsyncRAT GitHub","url":"https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp/blob/master/README.md"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ed8a6815-fd13-4e73-9b17-6b4025c0861c","subject":"ATTACK:enterprise:S0344","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ed8a6815-fd13-4e73-9b17-6b4025c0861c","modified":"2026-04-29T14:23:06.248Z","references":[{"source_name":"Unit42 Azorult Nov 2018","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-new-wine-old-bottle-new-azorult-variant-found-findmyname-campaign-using-fallout-exploit-kit/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ee1b1aee-a635-4008-813d-fab125f0b0a5","subject":"ATTACK:enterprise:S0431","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ee1b1aee-a635-4008-813d-fab125f0b0a5","modified":"2026-04-29T14:23:06.249Z","references":[{"source_name":"Carbon Black HotCroissant April 2020","url":"https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f097324d-6665-4d2d-8d84-eb05bada0dd3","subject":"ATTACK:enterprise:S0380","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f097324d-6665-4d2d-8d84-eb05bada0dd3","modified":"2026-04-29T14:23:06.252Z","references":[{"source_name":"Kaspersky StoneDrill 2017","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f2f155f1-5152-4681-9c0b-b4a01968fa2e","subject":"ATTACK:enterprise:S0261","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f2f155f1-5152-4681-9c0b-b4a01968fa2e","modified":"2026-04-29T14:23:06.255Z","references":[{"source_name":"Symantec Catchamas April 2018","url":"https://web.archive.org/web/20190508165711/https://www-west.symantec.com/content/symantec/english/en/security-center/writeup.html/2018-040209-1742-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f3bfd1b7-84df-4832-87f1-12a5413eb008","subject":"ATTACK:enterprise:S1107","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f3bfd1b7-84df-4832-87f1-12a5413eb008","modified":"2026-04-29T14:23:06.256Z","references":[{"source_name":"NKAbuse SL","url":"https://securelist.com/unveiling-nkabuse/111512/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f443e72c-68a6-4d46-b2aa-96b1aafd5f6b","subject":"ATTACK:enterprise:G0046","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f443e72c-68a6-4d46-b2aa-96b1aafd5f6b","modified":"2026-07-31T20:48:32.285Z","references":[{"source_name":"DOJ FIN7 Aug 2018","url":"https://www.justice.gov/opa/press-release/file/1084361/download"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f44842c1-f17d-4bb0-8803-3eee13cf831e","subject":"ATTACK:enterprise:S0348","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f44842c1-f17d-4bb0-8803-3eee13cf831e","modified":"2026-04-29T14:23:06.257Z","references":[{"source_name":"PaloAlto CardinalRat Apr 2017","url":"https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f53a225d-093b-4d90-9916-1e5981dbf95a","subject":"ATTACK:enterprise:S0658","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f53a225d-093b-4d90-9916-1e5981dbf95a","modified":"2026-04-29T14:23:06.258Z","references":[{"source_name":"trendmicro xcsset xcode project 2020","url":"https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f590ef19-3b83-459d-993c-a599407b7ca0","subject":"ATTACK:enterprise:S0340","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f590ef19-3b83-459d-993c-a599407b7ca0","modified":"2026-04-29T14:23:06.259Z","references":[{"source_name":"Securelist Octopus Oct 2018","url":"https://securelist.com/octopus-infested-seas-of-central-asia/88200/"},{"source_name":"Security Affairs DustSquad Oct 2018","url":"https://securityaffairs.co/wordpress/77165/apt/russia-linked-apt-dustsquad.html"},{"source_name":"ESET Nomadic Octopus 2018","url":"https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f6d23c00-158e-4e39-bf9b-f18344cd0151","subject":"ATTACK:enterprise:S0148","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f6d23c00-158e-4e39-bf9b-f18344cd0151","modified":"2026-04-29T14:23:06.260Z","references":[{"source_name":"ESET RTM Feb 2017","url":"https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"},{"source_name":"Unit42 Redaman January 2019","url":"https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f7e3c06d-61a2-4008-89af-4380e7d71ced","subject":"ATTACK:enterprise:S0686","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f7e3c06d-61a2-4008-89af-4380e7d71ced","modified":"2026-04-29T14:23:06.262Z","references":[{"source_name":"Microsoft Actinium February 2022","url":"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fb99048f-bb37-47be-b2a5-d03d9ff087f1","subject":"ATTACK:enterprise:S0409","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fb99048f-bb37-47be-b2a5-d03d9ff087f1","modified":"2026-04-29T14:23:06.266Z","references":[{"source_name":"ESET Machete July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"},{"source_name":"Securelist Machete Aug 2014","url":"https://securelist.com/el-machete/66108/"},{"source_name":"Cylance Machete Mar 2017","url":"https://threatvector.cylance.com/en_us/home/el-machete-malware-attacks-cut-through-latam.html"},{"source_name":"360 Machete Sep 2020","url":"https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fc67e15c-ae09-45e1-925f-8a6b0e8ca4ab","subject":"ATTACK:enterprise:S0163","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fc67e15c-ae09-45e1-925f-8a6b0e8ca4ab","modified":"2026-04-29T14:23:06.267Z","references":[{"source_name":"f-secure janicab","url":"https://www.f-secure.com/weblog/archives/00002576.html"},{"source_name":"Janicab","url":"https://web.archive.org/web/20230331162455/https://www.thesafemac.com/new-signed-malware-called-janicab/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fdde7cd5-dd87-4280-b2df-6bd01fae8ea6","subject":"ATTACK:enterprise:S0652","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fdde7cd5-dd87-4280-b2df-6bd01fae8ea6","modified":"2026-04-29T14:23:06.270Z","references":[{"source_name":"Kaspersky Ferocious Kitten Jun 2021","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}