{"record":{"id":"ATTACK:enterprise:T1204.002","title":"Malicious File","type":"Subtechnique","source_url":"https://attack.mitre.org/techniques/T1204/002","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--232b7f21-adf9-4b42-b936-b9d6f7df856e","external_id":"T1204.002","domain":"enterprise","created":"2020-03-11T14:49:36.954Z","modified":"2026-05-12T15:12:00.623Z","version":"1.6","aliases":[],"tactics":["execution"],"source_references":[{"source_name":"Password Protected Word Docs","url":"https://www.bleepingcomputer.com/news/security/psa-dont-open-spam-containing-password-protected-word-docs/"},{"source_name":"Mandiant Trojanized Windows 10","url":"https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government"}]},"assertions":[{"id":"enterprise:relationship--01653d7c-2616-4ccc-9bab-225e897b01f2","subject":"ATTACK:enterprise:G1026","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--01653d7c-2616-4ccc-9bab-225e897b01f2","modified":"2026-07-31T18:48:15.888Z","references":[{"source_name":"SCILabs Malteiro 2021","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--08c45e87-edef-455d-a15a-4612f2312e29","subject":"ATTACK:enterprise:S0669","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--08c45e87-edef-455d-a15a-4612f2312e29","modified":"2026-04-29T14:23:05.915Z","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0b4b6ab2-df1f-4142-bbfa-5f26980d805b","subject":"ATTACK:enterprise:C0037","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0b4b6ab2-df1f-4142-bbfa-5f26980d805b","modified":"2026-07-31T18:47:23.283Z","references":[{"source_name":"TrendMicro Pikabot 2024","url":"https://www.trendmicro.com/en_us/research/24/a/a-look-into-pikabot-spam-wave-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0baf5506-35fb-4508-ba9a-09ca2962df43","subject":"ATTACK:enterprise:S0356","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0baf5506-35fb-4508-ba9a-09ca2962df43","modified":"2026-04-29T14:23:05.919Z","references":[{"source_name":"Malwarebytes Konni Aug 2021","url":"https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0c9b6c09-8fc9-42c7-bfd7-316e9bbfa271","subject":"ATTACK:enterprise:G0005","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0c9b6c09-8fc9-42c7-bfd7-316e9bbfa271","modified":"2026-07-31T18:48:18.094Z","references":[{"source_name":"Moran 2014","url":"https://www.fireeye.com/blog/threat-research/2014/09/darwins-favorite-apt-group-2.html"},{"source_name":"Trend Micro IXESHE 2012","url":"https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0d1cb122-5195-4d04-b5c9-85f4747886fa","subject":"ATTACK:enterprise:S0453","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0d1cb122-5195-4d04-b5c9-85f4747886fa","modified":"2026-04-29T14:23:05.921Z","references":[{"source_name":"Malwarebytes Pony April 2016","url":"https://blog.malwarebytes.com/threat-analysis/2015/11/no-money-but-pony-from-a-mail-to-a-trojan-horse/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0e37d046-454c-4463-b27f-f348ef6f817e","subject":"ATTACK:enterprise:G0094","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0e37d046-454c-4463-b27f-f348ef6f817e","modified":"2026-07-31T20:48:24.454Z","references":[{"source_name":"Gen Digital Kimsuky HTTPTroy October 2025","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"},{"source_name":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source_name":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"},{"source_name":"Cybereason Kimsuky November 2020","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"},{"source_name":"Malwarebytes Kimsuky June 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"},{"source_name":"VirusBulletin Kimsuky October 2019","url":"https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-kimsuky-group-tracking-king-spearphishing/"},{"source_name":"NaumaanProofpoint_GlobalClickFix_April2025","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"},{"source_name":"ThreatConnect Kimsuky September 2020","url":"https://threatconnect.com/blog/kimsuky-phishing-operations-putting-in-work/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0f880e99-efaa-4e85-91c3-cac3d81d6b9a","subject":"ATTACK:enterprise:G0095","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0f880e99-efaa-4e85-91c3-cac3d81d6b9a","modified":"2026-07-31T18:47:49.791Z","references":[{"source_name":"Cylance Machete Mar 2017","url":"https://threatvector.cylance.com/en_us/home/el-machete-malware-attacks-cut-through-latam.html"},{"source_name":"Securelist Machete Aug 2014","url":"https://securelist.com/el-machete/66108/"},{"source_name":"ESET Machete July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"},{"source_name":"360 Machete Sep 2020","url":"https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--110ef143-aff1-4e73-abc2-cceaeab69c60","subject":"ATTACK:enterprise:S0631","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--110ef143-aff1-4e73-abc2-cceaeab69c60","modified":"2026-04-29T14:23:05.927Z","references":[{"source_name":"Cybereason Chaes Nov 2020","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--11670d59-3a21-4dec-bec4-9e6e8de8d89a","subject":"ATTACK:enterprise:S1064","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--11670d59-3a21-4dec-bec4-9e6e8de8d89a","modified":"2026-04-29T14:23:05.928Z","references":[{"source_name":"HP SVCReady Jun 2022","url":"https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1262d88d-0eb1-4d19-b84a-9793ef3e4d03","subject":"ATTACK:enterprise:G0066","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1262d88d-0eb1-4d19-b84a-9793ef3e4d03","modified":"2026-07-31T18:47:35.778Z","references":[{"source_name":"CSM Elderwood Sept 2012","url":"https://www.csmonitor.com/USA/2012/0914/Stealing-US-business-secrets-Experts-ID-two-huge-cyber-gangs-in-China"},{"source_name":"Symantec Elderwood Sept 2012","url":"https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--13189e47-4ae9-49ea-8c0f-605177626ada","subject":"ATTACK:enterprise:G0134","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--13189e47-4ae9-49ea-8c0f-605177626ada","modified":"2026-07-31T18:48:24.013Z","references":[{"source_name":"Proofpoint Operation Transparent Tribe March 2016","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"},{"source_name":"Kaspersky Transparent Tribe August 2020","url":"https://securelist.com/transparent-tribe-part-1/98127/"},{"source_name":"Talos Oblique RAT March 2021","url":"https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html"},{"source_name":"Talos Transparent Tribe May 2021","url":"https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html"},{"source_name":"Unit 42 ProjectM March 2016","url":"https://unit42.paloaltonetworks.com/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--13646672-412d-43e8-bd07-f54ef34d79f3","subject":"ATTACK:enterprise:C0060","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--13646672-412d-43e8-bd07-f54ef34d79f3","modified":"2026-07-31T18:47:26.854Z","references":[{"source_name":"ESET MirrorFace 2025","url":"https://www.welivesecurity.com/en/eset-research/operation-akairyu-mirrorface-invites-europe-expo-2025-revives-anel-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--14dbc3a9-5e47-454a-805c-b8e22659362f","subject":"ATTACK:enterprise:G0035","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--14dbc3a9-5e47-454a-805c-b8e22659362f","modified":"2026-07-31T20:48:28.340Z","references":[{"source_name":"Gigamon Berserk Bear October 2021","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--178dda13-999c-481f-8a1b-8dc062d7b0ff","subject":"ATTACK:enterprise:G0090","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--178dda13-999c-481f-8a1b-8dc062d7b0ff","modified":"2026-07-31T20:48:52.371Z","references":[{"source_name":"Check Point Wirte NOV 2024","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"},{"source_name":"Palo Alto Ashen Lepus DEC 2025","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"},{"source_name":"Kaspersky WIRTE November 2021","url":"https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1873a6d4-fc01-4fd5-aa85-ded977998eab","subject":"ATTACK:enterprise:S0670","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1873a6d4-fc01-4fd5-aa85-ded977998eab","modified":"2026-04-29T14:23:05.938Z","references":[{"source_name":"Check Point Warzone Feb 2020","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"},{"source_name":"Uptycs Confucius APT Jan 2021","url":"https://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--19b364c2-100b-489c-a48b-fd7829fa5e1e","subject":"ATTACK:enterprise:G1052","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--19b364c2-100b-489c-a48b-fd7829fa5e1e","modified":"2026-07-31T18:47:54.440Z","references":[{"source_name":"SecurityScorecard Contagious Interview October 2024","url":"https://securityscorecard.com/blog/inside-a-north-korean-phishing-operation-targeting-devops-employees/"},{"source_name":"SecurityScorecard Contagious Interview FamousChollima October 2024","url":"https://securityscorecard.com/blog/the-job-offer-that-wasnt-how-we-stopped-an-espionage-plot/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--19ca041f-64be-42f8-9ed1-361410a4c28b","subject":"ATTACK:enterprise:S0637","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--19ca041f-64be-42f8-9ed1-361410a4c28b","modified":"2026-04-29T14:23:05.940Z","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1bf08293-5342-4736-b3a9-c1f160ad9c81","subject":"ATTACK:enterprise:G0048","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1bf08293-5342-4736-b3a9-c1f160ad9c81","modified":"2026-07-31T18:48:17.329Z","references":[{"source_name":"Group IB RTM August 2019","url":"https://www.group-ib.com/blog/rtm"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1c306018-7f22-4080-81c5-939bd0bd81be","subject":"ATTACK:enterprise:G1007","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1c306018-7f22-4080-81c5-939bd0bd81be","modified":"2026-07-31T18:47:59.424Z","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1cd41777-3d65-4e39-8de7-3951d1568c16","subject":"ATTACK:enterprise:S0331","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1cd41777-3d65-4e39-8de7-3951d1568c16","modified":"2026-04-29T14:23:05.944Z","references":[{"source_name":"Bitdefender Agent Tesla April 2020","url":"https://labs.bitdefender.com/2020/04/oil-gas-spearphishing-campaigns-drop-agent-tesla-spyware-in-advance-of-historic-opec-deal/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1d56986b-e6fd-4624-87b4-5e0dd9f05c2f","subject":"ATTACK:enterprise:S0499","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1d56986b-e6fd-4624-87b4-5e0dd9f05c2f","modified":"2026-04-29T14:23:05.945Z","references":[{"source_name":"FireEye Hancitor","url":"https://www.fireeye.com/blog/threat-research/2016/09/hancitor_aka_chanit.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1fb7af43-604f-4ef7-9594-a61fa7f1d9bc","subject":"ATTACK:enterprise:S9031","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1fb7af43-604f-4ef7-9594-a61fa7f1d9bc","modified":"2026-04-29T14:23:05.948Z","references":[{"source_name":"Palo Alto Ashen Lepus DEC 2025","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--20118b8d-dc6e-4c71-8d99-789901c10e73","subject":"ATTACK:enterprise:S0428","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--20118b8d-dc6e-4c71-8d99-789901c10e73","modified":"2026-04-29T14:23:05.948Z","references":[{"source_name":"Talos PoetRAT April 2020","url":"https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--20599767-204a-4cbf-ada7-0f931ee925e4","subject":"ATTACK:enterprise:G0099","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--20599767-204a-4cbf-ada7-0f931ee925e4","modified":"2026-07-31T18:48:18.344Z","references":[{"source_name":"Check Point Blind Eagle MAR 2025","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"},{"source_name":"Recorded Future TAG-144 AUG 2025","url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"},{"source_name":"Zscaler BlindEagle DEC 2025","url":"https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"},{"source_name":"QiAnXin APT-C-36 Feb2019","url":"https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--219dcd0b-a6fe-47d4-99b9-24d945b1f168","subject":"ATTACK:enterprise:S0367","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--219dcd0b-a6fe-47d4-99b9-24d945b1f168","modified":"2026-04-29T14:23:05.951Z","references":[{"source_name":"Trend Micro Banking Malware Jan 2019","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-banking-malware-uses-network-sniffing-for-data-theft/"},{"source_name":"Carbon Black Emotet Apr 2019","url":"https://www.carbonblack.com/2019/04/24/cb-tau-threat-intelligence-notification-emotet-utilizing-wmi-to-launch-powershell-encoded-code/"},{"source_name":"IBM IcedID November 2017","url":"https://securityintelligence.com/new-banking-trojan-icedid-discovered-by-ibm-x-force-research/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--21cd565f-4cdc-46d6-95b3-32b2d618674e","subject":"ATTACK:enterprise:S0455","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--21cd565f-4cdc-46d6-95b3-32b2d618674e","modified":"2026-04-29T14:23:05.951Z","references":[{"source_name":"FireEye Metamorfo Apr 2018","url":"https://www.fireeye.com/blog/threat-research/2018/04/metamorfo-campaign-targeting-brazilian-users.html"},{"source_name":"ESET Casbaneiro Oct 2019","url":"https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--23ebaddf-0f99-4ed9-9aa4-39577490fa81","subject":"ATTACK:enterprise:S1026","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--23ebaddf-0f99-4ed9-9aa4-39577490fa81","modified":"2026-04-29T14:23:05.954Z","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--24021025-b5db-4ebb-89cb-49fe5c4d709e","subject":"ATTACK:enterprise:G1012","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--24021025-b5db-4ebb-89cb-49fe5c4d709e","modified":"2026-07-31T18:47:51.227Z","references":[{"source_name":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2552aaa5-2cd7-4940-a428-220412851242","subject":"ATTACK:enterprise:G0084","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2552aaa5-2cd7-4940-a428-220412851242","modified":"2026-07-31T18:47:47.648Z","references":[{"source_name":"Symantec Gallmaker Oct 2018","url":"https://www.symantec.com/blogs/threat-intelligence/gallmaker-attack-group"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--283ba7b1-cd3b-44e9-bfae-70023c53d446","subject":"ATTACK:enterprise:G0081","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--283ba7b1-cd3b-44e9-bfae-70023c53d446","modified":"2026-07-31T18:47:57.007Z","references":[{"source_name":"Anomali Pirate Panda April 2020","url":"https://www.anomali.com/blog/anomali-suspects-that-china-backed-apt-pirate-panda-may-be-seeking-access-to-vietnam-government-data-center#When:15:00:00Z"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--285ab221-15cf-4215-aa68-a8e74b635633","subject":"ATTACK:enterprise:G0070","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--285ab221-15cf-4215-aa68-a8e74b635633","modified":"2026-09-02T18:51:44.252Z","references":[{"source_name":"Lookout Dark Caracal Jan 2018","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2a58bdf1-2421-434d-938a-28d096f31736","subject":"ATTACK:enterprise:G1039","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2a58bdf1-2421-434d-938a-28d096f31736","modified":"2026-07-31T18:48:06.000Z","references":[{"source_name":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source_name":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"},{"source_name":"trendmicro_redcurl","url":"https://www.trendmicro.com/en_us/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2af5de71-33c3-49d2-9f3e-4fd90919e228","subject":"ATTACK:enterprise:S0634","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2af5de71-33c3-49d2-9f3e-4fd90919e228","modified":"2026-04-29T14:23:05.963Z","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2b91534d-4687-457b-bcb0-96be9357fa6d","subject":"ATTACK:enterprise:G0079","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2b91534d-4687-457b-bcb0-96be9357fa6d","modified":"2026-07-31T20:48:37.169Z","references":[{"source_name":"Unit 42 DarkHydrus July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"},{"source_name":"Unit 42 Playbook Dec 2017","url":"https://web.archive.org/web/20230702043312/https://pan-unit42.github.io/playbook_viewer/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2f58bb9b-17cd-4f5a-a055-891710ed9ab8","subject":"ATTACK:enterprise:S9026","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2f58bb9b-17cd-4f5a-a055-891710ed9ab8","modified":"2026-04-29T14:23:05.971Z","references":[{"source_name":"Trend Micro Earth Kasha Anel NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--301ea2aa-e593-4e19-b3d1-7cf7734611ec","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--301ea2aa-e593-4e19-b3d1-7cf7734611ec","modified":"2026-04-29T14:23:05.976Z","references":[{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source_name":"EclecticIQ Mustang Panda PlugX","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3350f278-af37-4183-b1be-8d79abce27ac","subject":"ATTACK:enterprise:G0068","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3350f278-af37-4183-b1be-8d79abce27ac","modified":"2026-07-31T18:48:27.860Z","references":[{"source_name":"Microsoft PLATINUM April 2016","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--33666771-34e3-41a9-8e98-57a99e92c40a","subject":"ATTACK:enterprise:C0016","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--33666771-34e3-41a9-8e98-57a99e92c40a","modified":"2026-07-31T20:48:14.625Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--350e9dad-4dd3-450f-b649-60340710505a","subject":"ATTACK:enterprise:G0045","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--350e9dad-4dd3-450f-b649-60340710505a","modified":"2026-07-31T18:47:43.722Z","references":[{"source_name":"Accenture Hogfish April 2018","url":"http://web.archive.org/web/20220810112638/https:/www.accenture.com/t20180423T055005Z_w_/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"},{"source_name":"FireEye APT10 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"},{"source_name":"FireEye APT10 Sept 2018","url":"https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"},{"source_name":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"},{"source_name":"District Court of NY APT10 Indictment December 2018","url":"https://www.justice.gov/opa/page/file/1122671/download"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--354551e4-c6aa-495a-aba5-b7437c485d34","subject":"ATTACK:enterprise:G0127","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--354551e4-c6aa-495a-aba5-b7437c485d34","modified":"2026-07-31T18:48:10.088Z","references":[{"source_name":"Unit 42 TA551 Jan 2021","url":"https://unit42.paloaltonetworks.com/ta551-shathak-icedid/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--36693ec3-9b3c-4129-af32-b8372c75211c","subject":"ATTACK:enterprise:G1001","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--36693ec3-9b3c-4129-af32-b8372c75211c","modified":"2026-07-31T20:48:51.719Z","references":[{"source_name":"ClearSky Siamesekitten August 2021","url":"https://www.clearskysec.com/siamesekitten/"},{"source_name":"Dragos Hexane","url":"https://dragos.com/resource/hexane/"},{"source_name":"SecureWorks August 2019","url":"https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"},{"source_name":"Zscaler Lyceum DnsSystem June 2022","url":"https://www.zscaler.com/blogs/security-research/lyceum-net-dns-backdoor"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3683548e-0331-4407-98b0-82253efc0b09","subject":"ATTACK:enterprise:S0373","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3683548e-0331-4407-98b0-82253efc0b09","modified":"2026-04-29T14:23:05.994Z","references":[{"source_name":"Securelist Brazilian Banking Malware July 2020","url":"https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--38a6e4b2-40c2-41f2-a415-7fbf586cc232","subject":"ATTACK:enterprise:S0198","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--38a6e4b2-40c2-41f2-a415-7fbf586cc232","modified":"2026-04-29T14:23:05.997Z","references":[{"source_name":"Unit 42 NETWIRE April 2020","url":"https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/"},{"source_name":"FireEye NETWIRE March 2019","url":"https://www.mandiant.com/resources/blog/dissecting-netwire-phishing-campaigns-usage-process-hollowing"},{"source_name":"Proofpoint NETWIRE December 2020","url":"https://www.proofpoint.com/us/blog/threat-insight/geofenced-netwire-campaigns"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3aacea96-941f-4a1d-8981-36d2a0e62cf3","subject":"ATTACK:enterprise:G0061","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3aacea96-941f-4a1d-8981-36d2a0e62cf3","modified":"2026-07-31T18:48:29.496Z","references":[{"source_name":"FireEye Obfuscation June 2017","url":"https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html"},{"source_name":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"},{"source_name":"FireEye Fin8 May 2016","url":"https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3d6e0a95-3265-4a0c-aee1-feff2807489b","subject":"ATTACK:enterprise:G0027","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3d6e0a95-3265-4a0c-aee1-feff2807489b","modified":"2026-07-31T18:48:28.687Z","references":[{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3da23733-c783-4743-8238-5fc96714409b","subject":"ATTACK:enterprise:S0665","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3da23733-c783-4743-8238-5fc96714409b","modified":"2026-04-29T14:23:06.009Z","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3db909a5-8ae8-4ab4-9aa9-910e90155cf3","subject":"ATTACK:enterprise:S0660","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3db909a5-8ae8-4ab4-9aa9-910e90155cf3","modified":"2026-04-29T14:23:06.009Z","references":[{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--403e9797-7824-4840-87ad-b975023d9199","subject":"ATTACK:enterprise:S0650","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--403e9797-7824-4840-87ad-b975023d9199","modified":"2026-04-29T14:23:06.012Z","references":[{"source_name":"Crowdstrike Qakbot October 2020","url":"https://www.crowdstrike.com/blog/duck-hunting-with-falcon-complete-qakbot-zip-based-campaign/"},{"source_name":"Cyberint Qakbot May 2021","url":"https://blog.cyberint.com/qakbot-banking-trojan"},{"source_name":"Group IB Ransomware September 2020","url":"https://web.archive.org/web/20220119114433/https://groupib.pathfactory.com/ransomware-reports/prolock_wp"},{"source_name":"Kaspersky QakBot September 2021","url":"https://securelist.com/qakbot-technical-analysis/103931/"},{"source_name":"Trend Micro Qakbot May 2020","url":"https://www.trendmicro.com/vinfo/ph/security/news/cybercrime-and-digital-threats/qakbot-resurges-spreads-through-vbs-files"},{"source_name":"Microsoft Ransomware as a Service","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"},{"source_name":"ATT QakBot April 2021","url":"https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot"},{"source_name":"Kroll Qakbot June 2020","url":"https://www.kroll.com/en/insights/publications/cyber/qakbot-malware-exfiltrating-emails-thread-hijacking-attacks"},{"source_name":"Trend Micro Qakbot December 2020","url":"https://success.trendmicro.com/en-US/solution/KA-0011282"},{"source_name":"Deep Instinct Black Basta August 2022","url":"https://www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4127f483-dbd5-4189-84a8-209f04259443","subject":"ATTACK:enterprise:S1183","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4127f483-dbd5-4189-84a8-209f04259443","modified":"2026-04-29T14:23:06.014Z","references":[{"source_name":"DCSO StrelaStealer 2022","url":"https://medium.com/@DCSO_CyTec/shortandmalicious-strelastealer-aims-for-mail-credentials-a4c3e78c8abc"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--42f078b7-f1ad-4507-9774-a4673a4c4acd","subject":"ATTACK:enterprise:C0001","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--42f078b7-f1ad-4507-9774-a4673a4c4acd","modified":"2026-07-31T18:47:18.891Z","references":[{"source_name":"Talos Frankenstein June 2019","url":"https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--445c926e-e0fb-4ac1-ba70-4ed45a68c592","subject":"ATTACK:enterprise:G1002","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--445c926e-e0fb-4ac1-ba70-4ed45a68c592","modified":"2026-07-31T20:48:39.528Z","references":[{"source_name":"Forcepoint BITTER Pakistan Oct 2016","url":"https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"},{"source_name":"Cisco Talos Bitter Bangladesh May 2022","url":"https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--471ea836-ef54-4306-b131-cf66de5811c4","subject":"ATTACK:enterprise:G0137","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--471ea836-ef54-4306-b131-cf66de5811c4","modified":"2026-07-31T18:47:59.528Z","references":[{"source_name":"Kaspersky Ferocious Kitten Jun 2021","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--47415b89-a254-49a8-95c4-7efae85cac2c","subject":"ATTACK:enterprise:G0067","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--47415b89-a254-49a8-95c4-7efae85cac2c","modified":"2026-07-31T18:47:55.257Z","references":[{"source_name":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--48cff69b-577c-4837-b894-95b19f255134","subject":"ATTACK:enterprise:C0005","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--48cff69b-577c-4837-b894-95b19f255134","modified":"2026-07-31T18:47:22.579Z","references":[{"source_name":"ESET Operation Spalax Jan 2021","url":"https://www.welivesecurity.com/2021/01/12/operation-spalax-targeted-malware-attacks-colombia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--49430af3-18b0-40e1-a500-5deab8ea8e48","subject":"ATTACK:enterprise:S1100","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--49430af3-18b0-40e1-a500-5deab8ea8e48","modified":"2026-04-29T14:23:06.025Z","references":[{"source_name":"Kaspersky ToddyCat June 2022","url":"https://securelist.com/toddycat/106799/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4995fdc6-d705-48dc-a2e3-c6797ba2439f","subject":"ATTACK:enterprise:G0140","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4995fdc6-d705-48dc-a2e3-c6797ba2439f","modified":"2026-07-31T18:48:13.285Z","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--49be75c9-8484-492e-9ebc-f81d2e203e4e","subject":"ATTACK:enterprise:G0056","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--49be75c9-8484-492e-9ebc-f81d2e203e4e","modified":"2026-07-31T20:48:51.255Z","references":[{"source_name":"Talos Promethium June 2020","url":"https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"},{"source_name":"Bitdefender StrongPity June 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--49d6508c-f350-4376-ba32-f64693d7fd10","subject":"ATTACK:enterprise:G0092","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--49d6508c-f350-4376-ba32-f64693d7fd10","modified":"2026-07-31T18:48:05.429Z","references":[{"source_name":"IBM TA505 April 2020","url":"https://web.archive.org/web/20200420201624/https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/"},{"source_name":"Trend Micro TA505 June 2019","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/shifting-tactics-breaking-down-ta505-groups-use-of-html-rats-and-other-techniques-in-latest-campaigns/"},{"source_name":"Proofpoint TA505 Sep 2017","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter"},{"source_name":"ProofPoint SettingContent-ms July 2018","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-abusing-settingcontent-ms-within-pdf-files-distribute-flawedammyy-rat"},{"source_name":"Proofpoint TA505 June 2018","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-shifts-times"},{"source_name":"Proofpoint TA505 Mar 2018","url":"https://www.proofpoint.com/us/threat-insight/post/leaked-ammyy-admin-source-code-turned-malware"},{"source_name":"Cybereason TA505 April 2019","url":"https://www.cybereason.com/blog/threat-actor-ta505-targets-financial-enterprises-using-lolbins-and-a-new-backdoor-malware"},{"source_name":"Proofpoint TA505 Jan 2019","url":"https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505"},{"source_name":"Proofpoint TA505 October 2019","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4a98aeee-5b53-43ca-a75a-5839792756d7","subject":"ATTACK:enterprise:C0015","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4a98aeee-5b53-43ca-a75a-5839792756d7","modified":"2026-07-31T18:47:25.270Z","references":[{"source_name":"DFIR Conti Bazar Nov 2021","url":"https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4baffcd6-9cdc-4f1e-9b54-4084e7dc2c42","subject":"ATTACK:enterprise:S0635","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4baffcd6-9cdc-4f1e-9b54-4084e7dc2c42","modified":"2026-04-29T14:23:06.029Z","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4e50db0c-4e54-4266-b675-3b279ec45427","subject":"ATTACK:enterprise:G0087","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4e50db0c-4e54-4266-b675-3b279ec45427","modified":"2026-07-31T18:47:53.522Z","references":[{"source_name":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"},{"source_name":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"},{"source_name":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"},{"source_name":"Symantec Chafer February 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4e7d7d9e-c3d5-4a9d-a948-d50724932321","subject":"ATTACK:enterprise:G1033","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4e7d7d9e-c3d5-4a9d-a948-d50724932321","modified":"2026-07-31T20:48:42.641Z","references":[{"source_name":"Google TAG COLDRIVER January 2024","url":"https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4f5d4ab0-6514-4a99-a5b9-456c903e4717","subject":"ATTACK:enterprise:S1122","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4f5d4ab0-6514-4a99-a5b9-456c903e4717","modified":"2026-04-29T14:23:06.033Z","references":[{"source_name":"ESET Security Mispadu Facebook Ads 2019","url":"https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/"},{"source_name":"Metabase Q Mispadu Trojan 2023","url":"https://www.metabaseq.com/mispadu-banking-trojan/"},{"source_name":"SCILabs Malteiro 2021","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4f99a9ac-ccd8-4c9b-9893-0703ba60543c","subject":"ATTACK:enterprise:S1075","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4f99a9ac-ccd8-4c9b-9893-0703ba60543c","modified":"2026-04-29T14:23:06.034Z","references":[{"source_name":"Mandiant Suspected Turla Campaign February 2023","url":"https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4ff8a2ad-2e69-4933-a5f4-201c891eef87","subject":"ATTACK:enterprise:G0126","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4ff8a2ad-2e69-4933-a5f4-201c891eef87","modified":"2026-07-31T18:47:56.485Z","references":[{"source_name":"Malwarebytes Higaisa 2020","url":"https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"},{"source_name":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--503c4b74-7ca5-45e3-bb11-85a99ca1810f","subject":"ATTACK:enterprise:G0075","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--503c4b74-7ca5-45e3-bb11-85a99ca1810f","modified":"2026-07-31T18:48:26.983Z","references":[{"source_name":"Rancor Unit42 June 2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--510caea2-109f-4936-96e9-3e8125f39b27","subject":"ATTACK:enterprise:S1142","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--510caea2-109f-4936-96e9-3e8125f39b27","modified":"2026-04-29T14:23:06.036Z","references":[{"source_name":"ESET Turla Lunar toolset May 2024","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--51656ee5-4d21-42c9-9719-826645b3508f","subject":"ATTACK:enterprise:S0476","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--51656ee5-4d21-42c9-9719-826645b3508f","modified":"2026-04-29T14:23:06.036Z","references":[{"source_name":"Unit 42 Valak July 2020","url":"https://unit42.paloaltonetworks.com/valak-evolution/"},{"source_name":"SentinelOne Valak June 2020","url":"https://assets.sentinelone.com/labs/sentinel-one-valak-i"},{"source_name":"Cybereason Valak May 2020","url":"https://www.cybereason.com/blog/valak-more-than-meets-the-eye"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--53e1bf2f-7ab4-4173-879b-9975618c4527","subject":"ATTACK:enterprise:G0102","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--53e1bf2f-7ab4-4173-879b-9975618c4527","modified":"2026-07-31T20:48:50.176Z","references":[{"source_name":"CrowdStrike Grim Spider May 2019","url":"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"},{"source_name":"CrowdStrike Wizard Spider October 2020","url":"https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"},{"source_name":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--54e6596d-ca80-4406-93f3-5fab013bc913","subject":"ATTACK:enterprise:S0531","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--54e6596d-ca80-4406-93f3-5fab013bc913","modified":"2026-04-29T14:23:06.041Z","references":[{"source_name":"IBM Grandoreiro April 2020","url":"https://securityintelligence.com/posts/grandoreiro-malware-now-targeting-banks-in-spain/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--557288c3-8463-4900-b2e5-aa9856d428cd","subject":"ATTACK:enterprise:S0402","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--557288c3-8463-4900-b2e5-aa9856d428cd","modified":"2026-04-29T14:23:06.042Z","references":[{"source_name":"Carbon Black Shlayer Feb 2019","url":"https://blogs.vmware.com/security/2020/02/vmware-carbon-black-tau-threat-analysis-shlayer-macos.html"},{"source_name":"Intego Shlayer Feb 2018","url":"https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--557d3feb-0699-429e-bc83-ff114cf138ef","subject":"ATTACK:enterprise:G0049","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--557d3feb-0699-429e-bc83-ff114cf138ef","modified":"2026-07-31T20:48:35.478Z","references":[{"source_name":"Check Point APT34 April 2021","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"},{"source_name":"ClearSky OilRig Jan 2017","url":"http://www.clearskysec.com/oilrig/"},{"source_name":"Unit 42 OopsIE! Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"},{"source_name":"Unit 42 QUADAGENT July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"},{"source_name":"Crowdstrike Helix Kitten Nov 2018","url":"https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--55fb787a-6622-43c7-a47d-48b4db7e8d81","subject":"ATTACK:enterprise:G0034","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--55fb787a-6622-43c7-a47d-48b4db7e8d81","modified":"2026-07-31T20:48:32.904Z","references":[{"source_name":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"},{"source_name":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--56d37b60-03e0-4aac-b106-0350c2a4ec46","subject":"ATTACK:enterprise:G0059","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--56d37b60-03e0-4aac-b106-0350c2a4ec46","modified":"2026-07-31T18:48:28.428Z","references":[{"source_name":"ClearSky Kittens Back 3 August 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/The-Kittens-are-Back-in-Town-3.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--57c8dc86-93a0-43d6-a47c-f0f5892948b3","subject":"ATTACK:enterprise:S1014","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--57c8dc86-93a0-43d6-a47c-f0f5892948b3","modified":"2026-04-29T14:23:06.045Z","references":[{"source_name":"ClearSky Siamesekitten August 2021","url":"https://www.clearskysec.com/siamesekitten/"},{"source_name":"SecureWorks August 2019","url":"https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--59b6b000-c8c5-4b4a-8801-5102de111111","subject":"ATTACK:enterprise:G0085","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--59b6b000-c8c5-4b4a-8801-5102de111111","modified":"2026-07-31T20:48:48.749Z","references":[{"source_name":"FireEye Hacking FIN4 Video Dec 2014","url":"https://www2.fireeye.com/WBNR-14Q4NAMFIN4.html"},{"source_name":"FireEye Hacking FIN4 Dec 2014","url":"https://web.archive.org/web/20220313062515/https://www.mandiant.com/sites/default/files/2021-09/rpt-fin4.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5a817bea-020f-47f5-8bf3-80e0c8bdef79","subject":"ATTACK:enterprise:S1240","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5a817bea-020f-47f5-8bf3-80e0c8bdef79","modified":"2026-04-29T14:23:06.049Z","references":[{"source_name":"ESET RedLine Stealer November 2024","url":"https://www.welivesecurity.com/en/eset-research/life-crooked-redline-analyzing-infamous-infostealers-backend/"},{"source_name":"Kroll RedLine Stealer August 2024","url":"https://www.kroll.com/en/publications/cyber/redlinestealer-malware"},{"source_name":"McAfee RedLine Stealer April 2024","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/redline-stealer-a-novel-approach/"},{"source_name":"Veriti RedLine Stealer MAAS April 2023","url":"https://veriti.ai/blog/veriti-research/from-chatgpt-to-redline-stealer-the-dark-side-of-openai-and-google-bard/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5b078c2e-229d-4ef0-8e46-2164354caee9","subject":"ATTACK:enterprise:G0080","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5b078c2e-229d-4ef0-8e46-2164354caee9","modified":"2026-07-31T18:48:22.938Z","references":[{"source_name":"Talos Cobalt Group July 2018","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"},{"source_name":"Unit 42 Cobalt Gang Oct 2018","url":"https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--60b2b967-6481-4842-9904-547a7c626ea6","subject":"ATTACK:enterprise:S0390","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--60b2b967-6481-4842-9904-547a7c626ea6","modified":"2026-04-29T14:23:06.057Z","references":[{"source_name":"Flashpoint FIN 7 March 2019","url":"https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--60dd06c7-788f-45e7-8845-3bb1cb4f2c17","subject":"ATTACK:enterprise:S1018","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--60dd06c7-788f-45e7-8845-3bb1cb4f2c17","modified":"2026-04-29T14:23:06.057Z","references":[{"source_name":"Malwarebytes Saint Bot April 2021","url":"https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/"},{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--60e4698b-a16d-4a40-8473-4d88e2e70881","subject":"ATTACK:enterprise:M1038","predicate":"mitigates","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--60e4698b-a16d-4a40-8473-4d88e2e70881","modified":"2026-04-29T14:23:06.057Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--639bd473-be74-4ddb-bfc1-eaa2574df975","subject":"ATTACK:enterprise:S0496","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--639bd473-be74-4ddb-bfc1-eaa2574df975","modified":"2026-04-29T14:23:06.060Z","references":[{"source_name":"G Data Sodinokibi June 2019","url":"https://www.gdatasoftware.com/blog/2019/06/31724-strange-bits-sodinokibi-spam-cinarat-and-fake-g-data"},{"source_name":"McAfee REvil October 2019","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-crescendo/"},{"source_name":"Picus Sodinokibi January 2020","url":"https://www.picussecurity.com/blog/a-brief-history-and-further-technical-analysis-of-sodinokibi-ransomware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--63e937c3-f395-4146-8061-6c00550bcd6a","subject":"ATTACK:enterprise:S0527","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--63e937c3-f395-4146-8061-6c00550bcd6a","modified":"2026-04-29T14:23:06.061Z","references":[{"source_name":"Cybereason Kimsuky November 2020","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--64a0ef28-3274-4db4-a87d-e2ef4af03c4a","subject":"ATTACK:enterprise:S0526","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--64a0ef28-3274-4db4-a87d-e2ef4af03c4a","modified":"2026-04-29T14:23:06.062Z","references":[{"source_name":"Cybereason Kimsuky November 2020","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--69d1d811-fb2f-43cc-99bb-989769dd4ffb","subject":"ATTACK:enterprise:S1086","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--69d1d811-fb2f-43cc-99bb-989769dd4ffb","modified":"2026-04-29T14:23:06.069Z","references":[{"source_name":"Telefonica Snip3 December 2021","url":"https://telefonicatech.com/blog/snip3-investigacion-malware"},{"source_name":"Morphisec Snip3 May 2021","url":"https://blog.morphisec.com/revealing-the-snip3-crypter-a-highly-evasive-rat-loader"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6a43c789-142f-4c88-bac3-e3c065441d98","subject":"ATTACK:enterprise:G1046","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6a43c789-142f-4c88-bac3-e3c065441d98","modified":"2026-07-31T18:47:47.947Z","references":[{"source_name":"Microsoft Storm-1811 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"},{"source_name":"RedCanary Storm-1811 2024","url":"https://redcanary.com/blog/threat-intelligence/storm-1811-black-basta/"},{"source_name":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6a552e69-29f1-4acc-8bd2-1f32d7550443","subject":"ATTACK:enterprise:S0491","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6a552e69-29f1-4acc-8bd2-1f32d7550443","modified":"2026-09-03T14:50:23.902Z","references":[{"source_name":"Talos Promethium June 2020","url":"https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"},{"source_name":"Bitdefender StrongPity June 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6b55eeb9-c7a1-4ff5-b8ef-f114e3a1b75a","subject":"ATTACK:enterprise:S0266","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6b55eeb9-c7a1-4ff5-b8ef-f114e3a1b75a","modified":"2026-04-29T14:23:06.071Z","references":[{"source_name":"TrendMicro Trickbot Feb 2019","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-adds-remote-application-credential-grabbing-capabilities-to-its-repertoire/"},{"source_name":"Cyberreason Anchor December 2019","url":"https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6b5d4e83-6ca4-4fa9-94a7-4068fcc8d3e6","subject":"ATTACK:enterprise:G1054","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6b5d4e83-6ca4-4fa9-94a7-4068fcc8d3e6","modified":"2026-07-31T18:48:08.720Z","references":[{"source_name":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"},{"source_name":"Trend Micro Earth Kasha Updates APR 2025","url":"https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html"},{"source_name":"Kaspersky LODEINFO OCT 2022","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/"},{"source_name":"ITOCHU LODEINFO JAN 2024","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6d8d9425-86ec-42d3-bce5-2af53d4f1fad","subject":"ATTACK:enterprise:S0263","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6d8d9425-86ec-42d3-bce5-2af53d4f1fad","modified":"2026-04-29T14:23:06.074Z","references":[{"source_name":"US-CERT TYPEFRAME June 2018","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6ee38990-50e9-423d-aea8-c3c16cf98ca4","subject":"ATTACK:enterprise:G0100","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6ee38990-50e9-423d-aea8-c3c16cf98ca4","modified":"2026-07-31T18:48:25.159Z","references":[{"source_name":"Kaspersky Cloud Atlas December 2014","url":"https://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083/"},{"source_name":"Kaspersky Cloud Atlas August 2019","url":"https://securelist.com/recent-cloud-atlas-activity/92016/"},{"source_name":"Symantec Inception Framework March 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies"},{"source_name":"Unit 42 Inception November 2018","url":"https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--736856d1-3ae3-4135-9dd4-7dfa6b55715b","subject":"ATTACK:enterprise:G1011","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--736856d1-3ae3-4135-9dd4-7dfa6b55715b","modified":"2026-07-31T18:47:38.757Z","references":[{"source_name":"Proofpoint Bumblebee April 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"},{"source_name":"Google EXOTIC LILY March 2022","url":"https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7423b6a3-9956-49ea-ba11-3a678994352c","subject":"ATTACK:enterprise:S1070","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7423b6a3-9956-49ea-ba11-3a678994352c","modified":"2026-04-29T14:23:06.084Z","references":[{"source_name":"Trend Micro Black Basta May 2022","url":"https://www.trendmicro.com/en_us/research/22/e/examining-the-black-basta-ransomwares-infection-routine.html"},{"source_name":"Trend Micro Black Basta Spotlight September 2022","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbasta"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--74650ec9-91db-4f17-a30e-2bfc1b84c86f","subject":"ATTACK:enterprise:G0130","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--74650ec9-91db-4f17-a30e-2bfc1b84c86f","modified":"2026-07-31T18:48:28.078Z","references":[{"source_name":"FireEye Operation Saffron Rose 2013","url":"https://www.mandiant.com/sites/default/files/2021-09/rpt-operation-saffron-rose.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7571e0ac-281a-495b-bc7a-9cffd7dfc09f","subject":"ATTACK:enterprise:S0348","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7571e0ac-281a-495b-bc7a-9cffd7dfc09f","modified":"2026-04-29T14:23:06.086Z","references":[{"source_name":"PaloAlto CardinalRat Apr 2017","url":"https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7b078d28-1724-474c-8668-a6d5c28ed72b","subject":"ATTACK:enterprise:S0483","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7b078d28-1724-474c-8668-a6d5c28ed72b","modified":"2026-04-29T14:23:06.094Z","references":[{"source_name":"DFIR_Sodinokibi_Ransomware","url":"https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/"},{"source_name":"DFIR_Quantum_Ransomware","url":"https://thedfirreport.com/2022/04/25/quantum-ransomware/"},{"source_name":"Juniper IcedID June 2020","url":"https://blogs.juniper.net/en-us/threat-research/covid-19-and-fmla-campaigns-used-to-install-new-icedid-banking-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7c9b61d8-30ff-4594-9cfb-90f2db44ca0e","subject":"ATTACK:enterprise:S0465","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7c9b61d8-30ff-4594-9cfb-90f2db44ca0e","modified":"2026-04-29T14:23:06.096Z","references":[{"source_name":"Unit 42 CARROTBAT January 2020","url":"https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7e6827aa-fd5f-4c32-b06e-60e9ee71bd53","subject":"ATTACK:enterprise:S0696","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7e6827aa-fd5f-4c32-b06e-60e9ee71bd53","modified":"2026-04-29T14:23:06.098Z","references":[{"source_name":"NTT Security Flagpro new December 2021","url":"https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7e93778d-1f69-4705-b544-b0e80d889267","subject":"ATTACK:enterprise:S1013","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7e93778d-1f69-4705-b544-b0e80d889267","modified":"2026-04-29T14:23:06.098Z","references":[{"source_name":"Cisco Talos Bitter Bangladesh May 2022","url":"https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7f08eca5-83e2-4d12-9c65-69691fbed054","subject":"ATTACK:enterprise:C0011","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7f08eca5-83e2-4d12-9c65-69691fbed054","modified":"2026-07-31T18:47:31.421Z","references":[{"source_name":"Cisco Talos Transparent Tribe Education Campaign July 2022","url":"https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7f74dcb1-6ce2-4247-8ea2-58caea335094","subject":"ATTACK:enterprise:C0022","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7f74dcb1-6ce2-4247-8ea2-58caea335094","modified":"2026-07-31T21:14:22.717Z","references":[{"source_name":"McAfee Lazarus Jul 2020","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-a-job-offer-thats-too-good-to-be-true/?hilite=%27Operation%27%2C%27North%27%2C%27Star%27"},{"source_name":"ClearSky Lazarus Aug 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--80219528-7b8e-415a-b2f2-c3678bccc185","subject":"ATTACK:enterprise:S1066","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--80219528-7b8e-415a-b2f2-c3678bccc185","modified":"2026-04-29T14:23:06.101Z","references":[{"source_name":"Secureworks DarkTortilla Aug 2022","url":"https://www.secureworks.com/research/darktortilla-malware-analysis"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--80389d5a-b92b-4101-930b-5be361e53eb8","subject":"ATTACK:enterprise:S0435","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--80389d5a-b92b-4101-930b-5be361e53eb8","modified":"2026-04-29T14:23:06.101Z","references":[{"source_name":"TrendMicro BlackTech June 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--80f3d913-d317-4531-9fb5-293f023f9b11","subject":"ATTACK:enterprise:G1031","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--80f3d913-d317-4531-9fb5-293f023f9b11","modified":"2026-07-31T18:48:00.378Z","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--83bfee39-b6c9-48e6-8114-54b0c623a91f","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--83bfee39-b6c9-48e6-8114-54b0c623a91f","modified":"2026-07-31T20:48:46.959Z","references":[{"source_name":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"McAfee Bankshot","url":"https://securingtomorrow.mcafee.com/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/"},{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--862d150d-ea3c-439e-9a56-b877935e5262","subject":"ATTACK:enterprise:G0037","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--862d150d-ea3c-439e-9a56-b877935e5262","modified":"2026-07-31T20:48:30.933Z","references":[{"source_name":"Visa FIN6 Feb 2019","url":"https://usa.visa.com/dam/VCOM/global/support-legal/documents/fin6-cybercrime-group-expands-threat-To-ecommerce-merchants.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--874f8662-0ec0-48e4-901b-270ac9ed63e6","subject":"ATTACK:enterprise:C0028","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--874f8662-0ec0-48e4-901b-270ac9ed63e6","modified":"2026-08-04T20:48:44.936Z","references":[{"source_name":"Ukraine15 - EISAC - 201603","url":"https://nsarchive.gwu.edu/sites/default/files/documents/3891751/SANS-and-Electricity-Information-Sharing-and.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8c270ffb-2e2e-445c-a1ee-df9323e93e60","subject":"ATTACK:enterprise:S1236","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8c270ffb-2e2e-445c-a1ee-df9323e93e60","modified":"2026-04-29T14:23:06.116Z","references":[{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8cfc4444-a2bd-4553-8a26-9018cb561705","subject":"ATTACK:enterprise:S1037","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8cfc4444-a2bd-4553-8a26-9018cb561705","modified":"2026-04-29T14:23:06.117Z","references":[{"source_name":"DHS CISA AA22-055A MuddyWater February 2022","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8d64ed83-77db-4471-acd9-10f5ca15c012","subject":"ATTACK:enterprise:S1169","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8d64ed83-77db-4471-acd9-10f5ca15c012","modified":"2026-04-29T14:23:06.118Z","references":[{"source_name":"ESET OilRig Campaigns Sep 2023","url":"https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9015a88f-9442-41cb-8486-046b76cddc5d","subject":"ATTACK:enterprise:G0040","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9015a88f-9442-41cb-8486-046b76cddc5d","modified":"2026-07-31T20:48:26.370Z","references":[{"source_name":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"},{"source_name":"Volexity Patchwork June 2018","url":"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--91bd508e-7f5a-4514-b886-95d97f8eefff","subject":"ATTACK:enterprise:S0268","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--91bd508e-7f5a-4514-b886-95d97f8eefff","modified":"2026-04-29T14:23:06.124Z","references":[{"source_name":"Talos Bisonal Mar 2020","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--94f1a9b7-e068-49b8-a2b7-9eb59055476c","subject":"ATTACK:enterprise:S0464","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--94f1a9b7-e068-49b8-a2b7-9eb59055476c","modified":"2026-04-29T14:23:06.128Z","references":[{"source_name":"Unit 42 CARROTBAT November 2018","url":"https://unit42.paloaltonetworks.com/unit42-the-fractured-block-campaign-carrotbat-malware-used-to-deliver-malware-targeting-southeast-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--95615d72-da27-42f5-b7a3-a2651ca68a2a","subject":"ATTACK:enterprise:S9020","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--95615d72-da27-42f5-b7a3-a2651ca68a2a","modified":"2026-04-29T14:23:06.129Z","references":[{"source_name":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"},{"source_name":"Kaspersky LODEINFO OCT 2022","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/"},{"source_name":"ITOCHU LODEINFO JAN 2024","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--983bd6cd-907a-430d-a6ec-0ca024ca87ae","subject":"ATTACK:enterprise:G0107","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--983bd6cd-907a-430d-a6ec-0ca024ca87ae","modified":"2026-07-31T18:48:14.629Z","references":[{"source_name":"Symantec Whitefly March 2019","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/whitefly-espionage-singapore"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--993e37d1-b81c-47d7-9063-216446271e07","subject":"ATTACK:enterprise:G0062","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--993e37d1-b81c-47d7-9063-216446271e07","modified":"2026-07-31T18:47:58.887Z","references":[{"source_name":"Proofpoint TA459 April 2017","url":"https://www.proofpoint.com/us/threat-insight/post/apt-targets-financial-analysts"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9b9dad4a-c597-4979-9129-7753a7c3b3db","subject":"ATTACK:enterprise:G0046","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9b9dad4a-c597-4979-9129-7753a7c3b3db","modified":"2026-07-31T20:48:32.082Z","references":[{"source_name":"FireEye FIN7 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"},{"source_name":"eSentire FIN7 July 2021","url":"https://www.esentire.com/security-advisories/notorious-cybercrime-gang-fin7-lands-malware-in-law-firm-using-fake-legal-complaint-against-jack-daniels-owner-brown-forman-inc"},{"source_name":"CrowdStrike Carbon Spider August 2021","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"},{"source_name":"Crowdstrike_CarbonSpider_Part2_Nov2024","url":"https://www.crowdstrike.com/en-us/blog/carbon-spider-embraces-big-game-hunting-part-2/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9bce879f-ffe8-425b-81d6-10408902c397","subject":"ATTACK:enterprise:S0642","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9bce879f-ffe8-425b-81d6-10408902c397","modified":"2026-06-13T12:04:40.997Z","references":[{"source_name":"Accenture MUDCARP March 2019","url":"https://web.archive.org/web/20210722005437/https://www.accenture.com/_acnmedia/PDF-96/Accenture-Security-MUDCARP.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9beeef27-988c-4ec3-ab34-d452d4dd6a76","subject":"ATTACK:enterprise:S1160","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9beeef27-988c-4ec3-ab34-d452d4dd6a76","modified":"2026-04-29T14:23:06.137Z","references":[{"source_name":"Bleeping Computer Latrodectus April 2024","url":"https://www.bleepingcomputer.com/news/security/new-latrodectus-malware-attacks-use-microsoft-cloudflare-themes/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9c800f85-0062-40af-9799-fe4a7bcb0526","subject":"ATTACK:enterprise:G1036","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9c800f85-0062-40af-9799-fe4a7bcb0526","modified":"2026-07-31T18:48:24.879Z","references":[{"source_name":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9d9e1fc8-7e93-41e3-b648-762f6f6db384","subject":"ATTACK:enterprise:S0606","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9d9e1fc8-7e93-41e3-b648-762f6f6db384","modified":"2026-04-29T14:23:06.140Z","references":[{"source_name":"ESET Bad Rabbit","url":"https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/"},{"source_name":"Secure List Bad Rabbit","url":"https://securelist.com/bad-rabbit-ransomware/82851/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9ef511b5-ecdb-4f11-97f6-0046ec25af84","subject":"ATTACK:enterprise:G0133","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9ef511b5-ecdb-4f11-97f6-0046ec25af84","modified":"2026-07-31T18:48:31.098Z","references":[{"source_name":"Securelist Octopus Oct 2018","url":"https://securelist.com/octopus-infested-seas-of-central-asia/88200/"},{"source_name":"ESET Nomadic Octopus 2018","url":"https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a0edf2ca-8f76-42ad-9525-1c0ae3948131","subject":"ATTACK:enterprise:S1021","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a0edf2ca-8f76-42ad-9525-1c0ae3948131","modified":"2026-04-29T14:23:06.144Z","references":[{"source_name":"Zscaler Lyceum DnsSystem June 2022","url":"https://www.zscaler.com/blogs/security-research/lyceum-net-dns-backdoor"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a3b44434-d499-4c30-b42d-7bb0f6b4bfc4","subject":"ATTACK:enterprise:S0520","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a3b44434-d499-4c30-b42d-7bb0f6b4bfc4","modified":"2026-04-29T14:23:06.148Z","references":[{"source_name":"US-CERT BLINDINGCAN Aug 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a61a45c0-b0ed-4017-80ff-f080211494bc","subject":"ATTACK:enterprise:S1246","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a61a45c0-b0ed-4017-80ff-f080211494bc","modified":"2026-04-29T14:23:06.151Z","references":[{"source_name":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"},{"source_name":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a6d53c2b-a2d2-4ad6-a61b-b8c88927d66a","subject":"ATTACK:enterprise:S1065","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a6d53c2b-a2d2-4ad6-a61b-b8c88927d66a","modified":"2026-04-29T14:23:06.152Z","references":[{"source_name":"MalwareBytes WoodyRAT Aug 2022","url":"https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a77d7668-db79-46b0-960a-cfa39db781fa","subject":"ATTACK:enterprise:S0482","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a77d7668-db79-46b0-960a-cfa39db781fa","modified":"2026-04-29T14:23:06.153Z","references":[{"source_name":"MacKeeper Bundlore Apr 2019","url":"https://mackeeper.com/blog/post/610-macos-bundlore-adware-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a8ec5ebc-8505-471c-ae81-877229b53a65","subject":"ATTACK:enterprise:M1040","predicate":"mitigates","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a8ec5ebc-8505-471c-ae81-877229b53a65","modified":"2026-04-29T14:23:06.155Z","references":[{"source_name":"win10_asr","url":"https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a9085e04-4072-4bb9-b76e-5d5d7da43cfb","subject":"ATTACK:enterprise:C0047","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a9085e04-4072-4bb9-b76e-5d5d7da43cfb","modified":"2026-07-31T18:47:19.667Z","references":[{"source_name":"Recorded Future RedDelta 2025","url":"https://go.recordedfuture.com/hubfs/reports/cta-cn-2025-0109.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aa256f57-243f-4a52-90c9-8f9037a28fe2","subject":"ATTACK:enterprise:S1017","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aa256f57-243f-4a52-90c9-8f9037a28fe2","modified":"2026-04-29T14:23:06.156Z","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aad16378-db29-4ba9-b65b-90531ff20fd6","subject":"ATTACK:enterprise:S9035","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aad16378-db29-4ba9-b65b-90531ff20fd6","modified":"2026-04-29T14:23:06.157Z","references":[{"source_name":"Splunk LAMEHUG SEP 2025","url":"https://www.splunk.com/en_us/blog/security/lamehug-ai-driven-malware-llm-cyber-intrusion-analysis.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ac65e484-b59a-40e1-984e-02dc4b62b6f0","subject":"ATTACK:enterprise:G0007","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ac65e484-b59a-40e1-984e-02dc4b62b6f0","modified":"2026-07-31T20:48:45.017Z","references":[{"source_name":"Accenture SNAKEMACKEREL Nov 2018","url":"https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"},{"source_name":"Unit 42 Sofacy Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/"},{"source_name":"Secureworks IRON TWILIGHT Active Measures March 2017","url":"https://www.secureworks.com/research/iron-twilight-supports-active-measures"},{"source_name":"Cato LAMEHUG JUL 2025","url":"https://www.catonetworks.com/blog/cato-ctrl-threat-research-analyzing-lamehug/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ac8ba4ea-f9dc-4d0c-85d9-0df3041fd304","subject":"ATTACK:enterprise:S0389","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ac8ba4ea-f9dc-4d0c-85d9-0df3041fd304","modified":"2026-04-29T14:23:06.160Z","references":[{"source_name":"Carbon Black JCry May 2019","url":"https://www.carbonblack.com/2019/05/14/cb-tau-threat-intelligence-notification-jcry-ransomware-pretends-to-be-adobe-flash-player-update-installer/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aee59ac6-e6e6-4b35-b2ce-4e529d4efc4b","subject":"ATTACK:enterprise:G0078","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aee59ac6-e6e6-4b35-b2ce-4e529d4efc4b","modified":"2026-07-31T18:47:42.814Z","references":[{"source_name":"Unit 42 Gorgon Group Aug 2018","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b033e131-e448-46c6-815b-b86e4bd6d638","subject":"ATTACK:enterprise:G0073","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b033e131-e448-46c6-815b-b86e4bd6d638","modified":"2026-07-31T18:48:31.122Z","references":[{"source_name":"FireEye APT19","url":"https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b0766ea1-924a-4e1f-92db-17e5f4a3b72d","subject":"ATTACK:enterprise:G1018","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b0766ea1-924a-4e1f-92db-17e5f4a3b72d","modified":"2026-07-31T18:47:55.467Z","references":[{"source_name":"Telefonica Snip3 December 2021","url":"https://telefonicatech.com/blog/snip3-investigacion-malware"},{"source_name":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"},{"source_name":"Cisco Operation Layover September 2021","url":"https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b0ee5fb3-ea57-4b00-8d3e-ff911db8f0e7","subject":"ATTACK:enterprise:S1030","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b0ee5fb3-ea57-4b00-8d3e-ff911db8f0e7","modified":"2026-04-29T14:23:06.167Z","references":[{"source_name":"ZScaler Squirrelwaffle Sep 2021","url":"https://www.zscaler.com/blogs/security-research/squirrelwaffle-new-loader-delivering-cobalt-strike"},{"source_name":"Netskope Squirrelwaffle Oct 2021","url":"https://www.netskope.com/blog/squirrelwaffle-new-malware-loader-delivering-cobalt-strike-and-qakbot"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b13de0c7-196c-4a74-9b91-c7c8c4cce419","subject":"ATTACK:enterprise:S1111","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b13de0c7-196c-4a74-9b91-c7c8c4cce419","modified":"2026-04-29T14:23:06.167Z","references":[{"source_name":"Ensilo Darkgate 2018","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"},{"source_name":"Trellix Darkgate 2023","url":"https://www.trellix.com/blogs/research/the-continued-evolution-of-the-darkgate-malware-as-a-service/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b2d97276-503d-4fd0-9517-92e05a774de0","subject":"ATTACK:enterprise:T1204.002","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1204","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b2d97276-503d-4fd0-9517-92e05a774de0","modified":"2026-04-29T14:23:06.169Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b4beede8-130b-4c99-b123-f7079896e28d","subject":"ATTACK:enterprise:S0234","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b4beede8-130b-4c99-b123-f7079896e28d","modified":"2026-04-29T14:23:06.172Z","references":[{"source_name":"CheckPoint Bandook Nov 2020","url":"https://research.checkpoint.com/2020/bandook-signed-delivered/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b71bc667-b3e8-4482-ba74-118049872be4","subject":"ATTACK:enterprise:G1006","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b71bc667-b3e8-4482-ba74-118049872be4","modified":"2026-07-31T20:48:48.347Z","references":[{"source_name":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b76d4437-7d55-4369-b262-eb4ca52d6059","subject":"ATTACK:enterprise:S0433","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b76d4437-7d55-4369-b262-eb4ca52d6059","modified":"2026-04-29T14:23:06.176Z","references":[{"source_name":"Carbon Black HotCroissant April 2020","url":"https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b784a456-decb-4d3a-a789-9dd67afb6e66","subject":"ATTACK:enterprise:G1008","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b784a456-decb-4d3a-a789-9dd67afb6e66","modified":"2026-07-31T18:47:36.926Z","references":[{"source_name":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b91c4f2d-8f21-46e9-a012-967436018eea","subject":"ATTACK:enterprise:G0103","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b91c4f2d-8f21-46e9-a012-967436018eea","modified":"2026-07-31T18:48:06.633Z","references":[{"source_name":"FOX-IT May 2016 Mofang","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b9247c37-ed60-477d-aade-45ceb5ff91a9","subject":"ATTACK:enterprise:G1055","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b9247c37-ed60-477d-aade-45ceb5ff91a9","modified":"2026-07-31T18:48:25.911Z","references":[{"source_name":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"},{"source_name":"Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026","url":"https://dti.domaintools.com/research/handala-mois-linked-cyber-influence-ecosystem-threat-intelligence-assessment"},{"source_name":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b979ce29-9d89-4d81-82fb-14240af7a241","subject":"ATTACK:enterprise:G0065","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b979ce29-9d89-4d81-82fb-14240af7a241","modified":"2026-07-31T20:48:38.360Z","references":[{"source_name":"Proofpoint Leviathan Oct 2017","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"},{"source_name":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ba2d135f-cce4-4548-9298-ff8ed0d07dc7","subject":"ATTACK:enterprise:G0131","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ba2d135f-cce4-4548-9298-ff8ed0d07dc7","modified":"2026-07-31T18:48:18.960Z","references":[{"source_name":"TrendMicro Tonto Team October 2020","url":"https://vb2020.vblocalhost.com/uploads/VB2020-06.pdf"},{"source_name":"Talos Bisonal Mar 2020","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--be872040-4179-4076-b371-923fe2a2b4de","subject":"ATTACK:enterprise:S0332","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--be872040-4179-4076-b371-923fe2a2b4de","modified":"2026-04-29T14:23:06.186Z","references":[{"source_name":"Fortinet Remcos Campaign NOV 2024","url":"https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--be9e89ef-de70-44e3-b3cb-73844f069ac4","subject":"ATTACK:enterprise:C0006","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--be9e89ef-de70-44e3-b3cb-73844f069ac4","modified":"2026-07-31T18:47:21.102Z","references":[{"source_name":"McAfee Honeybee","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bfc4c5dd-a02a-42a0-8838-1e9b45c1dd7e","subject":"ATTACK:enterprise:G0013","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bfc4c5dd-a02a-42a0-8838-1e9b45c1dd7e","modified":"2026-07-31T18:48:26.056Z","references":[{"source_name":"FireEye APT30","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c021ed6c-a241-4c20-ad6c-3d267baeac40","subject":"ATTACK:enterprise:S1213","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c021ed6c-a241-4c20-ad6c-3d267baeac40","modified":"2026-04-29T14:23:06.188Z","references":[{"source_name":"Cybereason LumaStealer Undated","url":"https://www.cybereason.com/blog/threat-analysis-rise-of-lummastealer"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c3f90e75-7642-4349-a163-881389bff063","subject":"ATTACK:enterprise:G1059","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c3f90e75-7642-4349-a163-881389bff063","modified":"2026-10-01T21:10:52.226Z","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"},{"source_name":"CheckPoint_NimbusManticore_May2026","url":"https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"},{"source_name":"Mandiant_UNC1549TTPsTools_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"},{"source_name":"Mandiant_UNC1549_Feb2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c4de34ea-99de-4850-817d-f9f2915bc7bd","subject":"ATTACK:enterprise:G0138","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c4de34ea-99de-4850-817d-f9f2915bc7bd","modified":"2026-07-31T18:47:50.837Z","references":[{"source_name":"AhnLab Andariel Subgroup of Lazarus June 2018","url":"https://web.archive.org/web/20230213154832/http://download.ahnlab.com/global/brochure/%5BAnalysis%5DAndariel_Group.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c60596a4-8947-4e43-8a4a-05bb5826d0fd","subject":"ATTACK:enterprise:S1242","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c60596a4-8947-4e43-8a4a-05bb5826d0fd","modified":"2026-04-29T14:23:06.196Z","references":[{"source_name":"SentinelOne Qilin NOV 2022","url":"https://www.sentinelone.com/anthology/agenda-qilin/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c7a2c6f6-5240-45f8-896e-b9cf434e53d1","subject":"ATTACK:enterprise:S1238","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c7a2c6f6-5240-45f8-896e-b9cf434e53d1","modified":"2026-04-29T14:23:06.198Z","references":[{"source_name":"Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c87a8320-8705-4de3-93ee-2db5c00ea461","subject":"ATTACK:enterprise:G0060","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c87a8320-8705-4de3-93ee-2db5c00ea461","modified":"2026-07-31T18:48:10.861Z","references":[{"source_name":"Symantec Tick Apr 2016","url":"https://www.symantec.com/connect/blogs/tick-cyberespionage-group-zeros-japan"},{"source_name":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cd2842e8-13e8-4946-9f16-f0473c6ac205","subject":"ATTACK:enterprise:G0082","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cd2842e8-13e8-4946-9f16-f0473c6ac205","modified":"2026-09-30T17:45:37.428Z","references":[{"source_name":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"},{"source_name":"Microsoft CYBERWARCON NOV 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/11/22/microsoft-shares-latest-intelligence-on-north-korean-and-chinese-threat-actors-at-cyberwarcon/"},{"source_name":"Microsoft Axios Compromise APR 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/"},{"source_name":"Microsoft Sapphire Sleet APR 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"},{"source_name":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cd589f82-0783-40d9-8dc9-1e561413a395","subject":"ATTACK:enterprise:S1087","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cd589f82-0783-40d9-8dc9-1e561413a395","modified":"2026-04-29T14:23:06.206Z","references":[{"source_name":"Recorded Future TAG-144 AUG 2025","url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cd5d323c-5ec5-4bef-8b8f-2d975a44cbcb","subject":"ATTACK:enterprise:S0528","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cd5d323c-5ec5-4bef-8b8f-2d975a44cbcb","modified":"2026-04-29T14:23:06.206Z","references":[{"source_name":"Securelist Brazilian Banking Malware July 2020","url":"https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ce212708-cd21-4f5c-9d67-010cb216f561","subject":"ATTACK:enterprise:S1229","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ce212708-cd21-4f5c-9d67-010cb216f561","modified":"2026-04-29T14:23:06.207Z","references":[{"source_name":"Check Point Wirte NOV 2024","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d06420fb-1c4d-4a4e-b18e-4c0750310606","subject":"ATTACK:enterprise:G0069","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d06420fb-1c4d-4a4e-b18e-4c0750310606","modified":"2026-07-31T20:48:30.193Z","references":[{"source_name":"Talos MuddyWater May 2019","url":"https://blog.talosintelligence.com/2019/05/recent-muddywater-associated-blackwater.html"},{"source_name":"CloudSEK_RustyWater_Jan2026","url":"https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"},{"source_name":"ClearSky MuddyWater June 2019","url":"https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf"},{"source_name":"DHS CISA AA22-055A MuddyWater February 2022","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"},{"source_name":"Securelist MuddyWater Oct 2018","url":"https://securelist.com/muddywater/88059/"},{"source_name":"Unit 42 MuddyWater Nov 2017","url":"https://researchcenter.paloaltonetworks.com/2017/11/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/"},{"source_name":"Talos MuddyWater Jan 2022","url":"https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html"},{"source_name":"Anomali Static Kitten February 2021","url":"https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies"},{"source_name":"Proofpoint TA450 Phishing March 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign"},{"source_name":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"},{"source_name":"Reaqta MuddyWater November 2017","url":"https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/"},{"source_name":"FireEye MuddyWater Mar 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d0efbf46-7f6a-4bf9-be4f-a52cd510174c","subject":"ATTACK:enterprise:S1039","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d0efbf46-7f6a-4bf9-be4f-a52cd510174c","modified":"2026-04-29T14:23:06.211Z","references":[{"source_name":"Cybereason Bumblebee August 2022","url":"https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control"},{"source_name":"Symantec Bumblebee June 2022","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime"},{"source_name":"Proofpoint Bumblebee April 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"},{"source_name":"Medium Ali Salem Bumblebee April 2022","url":"https://elis531989.medium.com/the-chronicles-of-bumblebee-the-hook-the-bee-and-the-trickbot-connection-686379311056"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d159e441-b30b-464a-8838-b83864173e89","subject":"ATTACK:enterprise:G0019","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d159e441-b30b-464a-8838-b83864173e89","modified":"2026-07-31T18:47:46.397Z","references":[{"source_name":"CheckPoint Naikon May 2020","url":"https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d2b047a4-9e06-4e75-8fa9-12e7016d14c1","subject":"ATTACK:enterprise:S1230","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d2b047a4-9e06-4e75-8fa9-12e7016d14c1","modified":"2026-04-29T14:23:06.214Z","references":[{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source_name":"Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024","url":"https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d2cf553c-b2a3-4599-9cb8-4722eb1b1293","subject":"ATTACK:enterprise:S0622","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d2cf553c-b2a3-4599-9cb8-4722eb1b1293","modified":"2026-04-29T14:23:06.214Z","references":[{"source_name":"Malwarebytes Kimsuky June 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d4f17f68-7a50-428f-b26d-94dcbf861ec5","subject":"ATTACK:enterprise:S0458","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d4f17f68-7a50-428f-b26d-94dcbf861ec5","modified":"2026-04-29T14:23:06.216Z","references":[{"source_name":"Antiy CERT Ramsay April 2020","url":"https://www.programmersought.com/article/62493896999/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d764b3d2-8ca3-437b-abe4-f54662ccce42","subject":"ATTACK:enterprise:S0240","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d764b3d2-8ca3-437b-abe4-f54662ccce42","modified":"2026-04-29T14:23:06.219Z","references":[{"source_name":"Malwarebytes RokRAT VBA January 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d7836be5-6c99-4a14-90ca-e342455516ab","subject":"ATTACK:enterprise:C0013","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d7836be5-6c99-4a14-90ca-e342455516ab","modified":"2026-07-31T18:47:20.383Z","references":[{"source_name":"McAfee Sharpshooter December 2018","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d96dd876-5752-4ea6-bb4b-ef92f60d57fe","subject":"ATTACK:enterprise:S1088","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d96dd876-5752-4ea6-bb4b-ef92f60d57fe","modified":"2026-04-29T14:23:06.222Z","references":[{"source_name":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--da33f077-8ce2-4a2d-a8ed-f9f21799c80e","subject":"ATTACK:enterprise:S0447","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--da33f077-8ce2-4a2d-a8ed-f9f21799c80e","modified":"2026-04-29T14:23:06.223Z","references":[{"source_name":"TrendMicro Msiexec Feb 2018","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/attack-using-windows-installer-msiexec-exe-leads-lokibot/"},{"source_name":"Talos Lokibot Jan 2021","url":"https://blog.talosintelligence.com/2021/01/a-deep-dive-into-lokibot-infection-chain.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--da62e1f0-d49d-40ed-b983-fcfaaacb42f5","subject":"ATTACK:enterprise:S1042","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--da62e1f0-d49d-40ed-b983-fcfaaacb42f5","modified":"2026-04-29T14:23:06.223Z","references":[{"source_name":"Mandiant UNC3890 Aug 2022","url":"https://www.mandiant.com/resources/blog/suspected-iranian-actor-targeting-israeli-shipping"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dad14304-3539-4de9-b50b-c79d2d376ab6","subject":"ATTACK:enterprise:S0011","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dad14304-3539-4de9-b50b-c79d2d376ab6","modified":"2026-04-29T14:23:06.224Z","references":[{"source_name":"TrendMicro Taidoor","url":"http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the_taidoor_campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dd48cdb6-ab24-410b-ac3e-624b1ed8cf92","subject":"ATTACK:enterprise:S0584","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dd48cdb6-ab24-410b-ac3e-624b1ed8cf92","modified":"2026-04-29T14:23:06.227Z","references":[{"source_name":"CISA AppleJeus Feb 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-048a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dfea2d53-ecf8-4e01-9773-98d65c57bcc8","subject":"ATTACK:enterprise:S0260","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dfea2d53-ecf8-4e01-9773-98d65c57bcc8","modified":"2026-04-29T14:23:06.230Z","references":[{"source_name":"ESET InvisiMole June 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e0b775d4-cfc4-4075-a72b-6a866ef3c159","subject":"ATTACK:enterprise:S0148","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e0b775d4-cfc4-4075-a72b-6a866ef3c159","modified":"2026-04-29T14:23:06.231Z","references":[{"source_name":"Unit42 Redaman January 2019","url":"https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e10a3f38-fe4b-4bf3-9d36-cdf18854ed2a","subject":"ATTACK:enterprise:S9037","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e10a3f38-fe4b-4bf3-9d36-cdf18854ed2a","modified":"2026-04-29T14:23:06.232Z","references":[{"source_name":"CloudSEK_RustyWater_Jan2026","url":"https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e122c13d-078d-4404-b2a0-e0e2341dbd2e","subject":"ATTACK:enterprise:G0129","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e122c13d-078d-4404-b2a0-e0e2341dbd2e","modified":"2026-07-31T18:47:53.578Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"Anomali MUSTANG PANDA October 2019","url":"https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"},{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source_name":"CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024","url":"https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"},{"source_name":"Lab52 MUSTANG PANDA PUBLOAD MAY 2023","url":"https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"},{"source_name":"EclecticIQ Mustang Panda PlugX","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"},{"source_name":"IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025","url":"https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"},{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source_name":"Avira Mustang Panda January 2020","url":"https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"},{"source_name":"Google TAG Ukraine Threat Landscape March 2022","url":"https://blog.google/threat-analysis-group/update-threat-landscape-ukraine"},{"source_name":"Recorded Future REDDELTA July 2020","url":"https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"},{"source_name":"Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024","url":"https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"},{"source_name":"Crowdstrike MUSTANG PANDA June 2018","url":"https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"},{"source_name":"Trend Micro Mustang Panda Earth Preta Toneshell February 2025","url":"https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source_name":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"},{"source_name":"Unit42 Bookworm Nov2015","url":"https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"},{"source_name":"Palo Alto Networks, Unit 42","url":"https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"},{"source_name":"Sophos PlugX September 2022","url":"https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"},{"source_name":"Sophos Mustang Panda PLUGX","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"},{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e3f77039-014f-4786-b226-808167d75a96","subject":"ATTACK:enterprise:S0340","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e3f77039-014f-4786-b226-808167d75a96","modified":"2026-04-29T14:23:06.236Z","references":[{"source_name":"ESET Nomadic Octopus 2018","url":"https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e49a1c79-5aa0-4d1a-906d-806c5253bd3e","subject":"ATTACK:enterprise:M1017","predicate":"mitigates","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e49a1c79-5aa0-4d1a-906d-806c5253bd3e","modified":"2026-04-29T14:23:06.236Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e586e3c7-ed6b-4f6b-92e8-031f0acc84ef","subject":"ATTACK:enterprise:G0021","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e586e3c7-ed6b-4f6b-92e8-031f0acc84ef","modified":"2026-07-31T18:48:23.887Z","references":[{"source_name":"Kaspersky MoleRATs April 2019","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"},{"source_name":"Unit42 Molerat Mar 2020","url":"https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/"},{"source_name":"Cybereason Molerats Dec 2020","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e69ac347-8b74-4fcc-8b13-17d7a1b04339","subject":"ATTACK:enterprise:S0585","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e69ac347-8b74-4fcc-8b13-17d7a1b04339","modified":"2026-04-29T14:23:06.239Z","references":[{"source_name":"Amnesty Intl. Ocean Lotus February 2021","url":"https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf"},{"source_name":"Unit 42 KerrDown February 2019","url":"https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e752cfb4-7865-4590-b355-eb1f1b851c5e","subject":"ATTACK:enterprise:G0018","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e752cfb4-7865-4590-b355-eb1f1b851c5e","modified":"2026-07-31T18:47:39.717Z","references":[{"source_name":"FireEye admin@338","url":"https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e84791af-7bdb-4fe9-8e03-7a10a154c9a4","subject":"ATTACK:enterprise:G0047","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e84791af-7bdb-4fe9-8e03-7a10a154c9a4","modified":"2026-07-31T18:47:48.157Z","references":[{"source_name":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source_name":"CERT-EE Gamaredon January 2021","url":"https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf"},{"source_name":"TrendMicro Gamaredon April 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/"},{"source_name":"Microsoft Actinium February 2022","url":"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"},{"source_name":"Secureworks IRON TILDEN Profile","url":"https://www.secureworks.com/research/threat-profiles/iron-tilden"},{"source_name":"Symantec Shuckworm January 2022","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine"},{"source_name":"unit42_gamaredon_dec2022","url":"https://unit42.paloaltonetworks.com/trident-ursa/"},{"source_name":"Unit 42 Gamaredon February 2022","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"},{"source_name":"VenereCiscoTalos_Gamaredon_Mar2025","url":"https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e884cc7d-cea1-4ecc-84fb-5c31950b4357","subject":"ATTACK:enterprise:S0384","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e884cc7d-cea1-4ecc-84fb-5c31950b4357","modified":"2026-04-29T14:23:06.242Z","references":[{"source_name":"Checkpoint Dridex Jan 2021","url":"https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e936d8c6-f069-49b1-8d4e-9ecafab2a576","subject":"ATTACK:enterprise:G0012","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e936d8c6-f069-49b1-8d4e-9ecafab2a576","modified":"2026-07-31T18:48:12.112Z","references":[{"source_name":"Securelist Darkhotel Aug 2015","url":"https://securelist.com/darkhotels-attacks-in-2015/71713/"},{"source_name":"Microsoft DUBNIUM July 2016","url":"https://www.microsoft.com/security/blog/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ea7c1a9f-7d8e-4a06-8331-9901a33ee7d8","subject":"ATTACK:enterprise:G0050","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ea7c1a9f-7d8e-4a06-8331-9901a33ee7d8","modified":"2026-07-31T18:47:46.005Z","references":[{"source_name":"ESET OceanLotus","url":"https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/"},{"source_name":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source_name":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"},{"source_name":"FireEye APT32 April 2020","url":"https://www.fireeye.com/blog/threat-research/2020/04/apt32-targeting-chinese-government-in-covid-19-related-espionage.html"},{"source_name":"Amnesty Intl. Ocean Lotus February 2021","url":"https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eba54c2a-854f-4349-9248-314519ed9c43","subject":"ATTACK:enterprise:G0089","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eba54c2a-854f-4349-9248-314519ed9c43","modified":"2026-07-31T18:47:59.903Z","references":[{"source_name":"Cylance Shaheen Nov 2018","url":"https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ecedc32f-3e97-4c2c-9b7e-d847baec8a44","subject":"ATTACK:enterprise:G0136","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ecedc32f-3e97-4c2c-9b7e-d847baec8a44","modified":"2026-07-31T18:48:24.423Z","references":[{"source_name":"HackerNews IndigoZebra July 2021","url":"https://thehackernews.com/2021/07/indigozebra-apt-hacking-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ed0428f5-d354-4827-8f9a-95177ce0a1cb","subject":"ATTACK:enterprise:G0064","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ed0428f5-d354-4827-8f9a-95177ce0a1cb","modified":"2026-07-31T20:48:53.330Z","references":[{"source_name":"Microsoft Holmium June 2020","url":"https://www.microsoft.com/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--efe23026-7cba-46df-873b-1c8244a92d36","subject":"ATTACK:enterprise:G0091","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--efe23026-7cba-46df-873b-1c8244a92d36","modified":"2026-07-31T18:48:21.519Z","references":[{"source_name":"SecureList Silence Nov 2017","url":"https://securelist.com/the-silence/83009/"},{"source_name":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."},{"source_name":"Cyber Forensicator Silence Jan 2019","url":"https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f1ef0014-9d3d-407a-aa86-8aab6c92edda","subject":"ATTACK:enterprise:G0121","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f1ef0014-9d3d-407a-aa86-8aab6c92edda","modified":"2026-07-31T18:47:52.194Z","references":[{"source_name":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"},{"source_name":"Rewterz Sidewinder APT April 2020","url":"https://www.rewterz.com/threats/sidewinder-apt-group-campaign-analysis"},{"source_name":"Rewterz Sidewinder COVID-19 June 2020","url":"https://www.rewterz.com/articles/analysis-on-sidewinder-apt-group-covid-19"},{"source_name":"Cyble Sidewinder September 2020","url":"https://cybleinc.com/2020/09/26/sidewinder-apt-targets-with-futuristic-tactics-and-techniques/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f30598a2-f1bd-41da-874c-9b883d54790d","subject":"ATTACK:enterprise:G0119","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f30598a2-f1bd-41da-874c-9b883d54790d","modified":"2026-07-31T18:47:36.109Z","references":[{"source_name":"Symantec WastedLocker June 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f3f122f1-998f-4079-afad-7a59e39f89b7","subject":"ATTACK:enterprise:G0016","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f3f122f1-998f-4079-afad-7a59e39f89b7","modified":"2026-07-31T18:48:09.383Z","references":[{"source_name":"ESET T3 Threat Report 2021","url":"https://www.welivesecurity.com/wp-content/uploads/2022/02/eset_threat_report_t32021.pdf"},{"source_name":"F-Secure The Dukes","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"},{"source_name":"Secureworks IRON HEMLOCK Profile","url":"http://www.secureworks.com/research/threat-profiles/iron-hemlock"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f40b2e98-47a9-4cd6-a345-7e4618d896e7","subject":"ATTACK:enterprise:G0142","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f40b2e98-47a9-4cd6-a345-7e4618d896e7","modified":"2026-07-31T20:48:37.674Z","references":[{"source_name":"Uptycs Confucius APT Jan 2021","url":"https://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f56f129e-0a30-4be0-bc4b-5942a479e0f9","subject":"ATTACK:enterprise:S1027","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f56f129e-0a30-4be0-bc4b-5942a479e0f9","modified":"2026-04-29T14:23:06.258Z","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f6d1c615-16df-4527-ad74-ce8623f87ce0","subject":"ATTACK:enterprise:G0098","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f6d1c615-16df-4527-ad74-ce8623f87ce0","modified":"2026-07-31T18:48:01.832Z","references":[{"source_name":"TrendMicro BlackTech June 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"},{"source_name":"NTT Security Flagpro new December 2021","url":"https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f7800d2b-7eb5-4efe-ac8d-503c187d18ef","subject":"ATTACK:enterprise:G0112","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f7800d2b-7eb5-4efe-ac8d-503c187d18ef","modified":"2026-09-02T18:52:47.218Z","references":[{"source_name":"SANS Windshift August 2018","url":"https://www.scribd.com/document/661837258/WINDSHIFT-summit-archive-1554718868"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fa777c92-0431-4916-9527-4077e8b10559","subject":"ATTACK:enterprise:S0561","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fa777c92-0431-4916-9527-4077e8b10559","modified":"2026-04-29T14:23:06.265Z","references":[{"source_name":"Unit 42 NETWIRE April 2020","url":"https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fc193a2e-65ef-483d-908e-482e05340c41","subject":"ATTACK:enterprise:S0648","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fc193a2e-65ef-483d-908e-482e05340c41","modified":"2026-04-29T14:23:06.267Z","references":[{"source_name":"eSentire FIN7 July 2021","url":"https://www.esentire.com/security-advisories/notorious-cybercrime-gang-fin7-lands-malware-in-law-firm-using-fake-legal-complaint-against-jack-daniels-owner-brown-forman-inc"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fef97c89-06fe-4def-b58b-5dafd9ff925d","subject":"ATTACK:enterprise:S1063","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fef97c89-06fe-4def-b58b-5dafd9ff925d","modified":"2026-04-29T14:23:06.271Z","references":[{"source_name":"Palo Alto Brute Ratel July 2022","url":"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}