Source assertions are not new attribution claims. No sole inventor or transitive actor-CVE inference. { "record": { "id": "ATTACK:enterprise:T1547.001", "title": "Registry Run Keys / Startup Folder", "type": "Subtechnique", "source_url": "https://attack.mitre.org/techniques/T1547/001", "snapshot": "enterprise-attack-20.0.json", "status": "active", "rights": "Source metadata only; source notices retained; no operational prose or payloads", "review_status": "machine-extracted; source-specific checks passed, editorial review pending", "stix_id": "attack-pattern--9efb1ea7-c37b-4595-9640-b7680cd84279", "external_id": "T1547.001", "domain": "enterprise", "created": "2020-01-23T22:02:48.566Z", "modified": "2026-05-12T15:12:00.706Z", "version": "2.1", "aliases": [ ], "tactics": [ "persistence", "privilege-escalation" ], "source_references": [ { "source_name": "Malwarebytes Wow6432Node 2016", "url": "https://blog.malwarebytes.com/cybercrime/2013/10/hiding-in-plain-sight/" }, { "source_name": "Microsoft Wow6432Node 2018", "url": "https://docs.microsoft.com/en-us/windows/win32/sysinfo/32-bit-and-64-bit-application-data-in-the-registry" }, { "source_name": "Microsoft Run Key", "url": "https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys" }, { "source_name": "Oddvar Moe RunOnceEx Mar 2018", "url": "https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/" }, { "source_name": "TechNet Autoruns", "url": "https://technet.microsoft.com/en-us/sysinternals/bb963902" } ] }, "assertions": [ { "id": "enterprise:relationship--0040fdbd-ec7e-49b3-b715-c8c91e08666b", "subject": "ATTACK:enterprise:S0082", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--0040fdbd-ec7e-49b3-b715-c8c91e08666b", "modified": "2026-04-29T14:23:05.903Z", "references": [ { "source_name": "Emissary Trojan Feb 2016", "url": "http://researchcenter.paloaltonetworks.com/2016/02/emissary-trojan-changelog-did-operation-lotus-blossom-cause-it-to-evolve/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--02a629d3-b970-43e8-a11b-79f35107a4c0", "subject": "ATTACK:enterprise:S0124", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--02a629d3-b970-43e8-a11b-79f35107a4c0", "modified": "2026-04-29T14:23:05.906Z", "references": [ { "source_name": "Palo Alto DNS Requests", "url": "http://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--030958f2-615b-4c80-a1ec-38ed335da413", "subject": "ATTACK:enterprise:S0396", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--030958f2-615b-4c80-a1ec-38ed335da413", "modified": "2026-04-29T14:23:05.907Z", "references": [ { "source_name": "Cyphort EvilBunny Dec 2014", "url": "https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--04558d61-aa04-46b5-a65f-921011ac9621", "subject": "ATTACK:enterprise:G0073", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--04558d61-aa04-46b5-a65f-921011ac9621", "modified": "2026-07-31T18:48:30.489Z", "references": [ { "source_name": "Unit 42 C0d0so0 Jan 2016", "url": "https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--0500bac5-bc50-4529-ae5f-b4e1a85fa7d7", "subject": "ATTACK:enterprise:G0067", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--0500bac5-bc50-4529-ae5f-b4e1a85fa7d7", "modified": "2026-07-31T18:47:55.014Z", "references": [ { "source_name": "FireEye APT37 Feb 2018", "url": "https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf" }, { "source_name": "Talos Group123", "url": "https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--0574a456-6327-4f07-94b0-58be6ecbf8b8", "subject": "ATTACK:enterprise:G0087", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--0574a456-6327-4f07-94b0-58be6ecbf8b8", "modified": "2026-07-31T18:47:52.988Z", "references": [ { "source_name": "FireEye APT39 Jan 2019", "url": "https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--06eb051c-74d0-4bbd-8cdf-1018b3c2e748", "subject": "ATTACK:enterprise:S0198", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--06eb051c-74d0-4bbd-8cdf-1018b3c2e748", "modified": "2026-04-29T14:23:05.913Z", "references": [ { "source_name": "McAfee Netwire Mar 2015", "url": "https://securingtomorrow.mcafee.com/mcafee-labs/netwire-rat-behind-recent-targeted-attacks/" }, { "source_name": "Red Canary NETWIRE January 2020", "url": "https://redcanary.com/blog/netwire-remote-access-trojan-on-linux/" }, { "source_name": "Unit 42 NETWIRE April 2020", "url": "https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/" }, { "source_name": "Proofpoint NETWIRE December 2020", "url": "https://www.proofpoint.com/us/blog/threat-insight/geofenced-netwire-campaigns" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--07efd7ec-332f-43fd-8ffc-6f50c32c4f55", "subject": "ATTACK:enterprise:G1018", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--07efd7ec-332f-43fd-8ffc-6f50c32c4f55", "modified": "2026-07-31T18:47:54.932Z", "references": [ { "source_name": "Proofpoint TA2541 February 2022", "url": "https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--084fc3bc-5e50-47fb-97d1-75fa00b6ed79", "subject": "ATTACK:enterprise:S0386", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--084fc3bc-5e50-47fb-97d1-75fa00b6ed79", "modified": "2026-04-29T14:23:05.915Z", "references": [ { "source_name": "TrendMicro PE_URSNIF.A2", "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/PE_URSNIF.A2?_ga=2.131425807.1462021705.1559742358-1202584019.1549394279" }, { "source_name": "TrendMicro BKDR_URSNIF.SM", "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/BKDR_URSNIF.SM?_ga=2.129468940.1462021705.1559742358-1202584019.1549394279" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--087721ee-6643-4453-8a76-8768ced7e506", "subject": "ATTACK:enterprise:S0093", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--087721ee-6643-4453-8a76-8768ced7e506", "modified": "2026-04-29T14:23:05.915Z", "references": [ { "source_name": "Symantec Dragonfly", "url": "https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments" }, { "source_name": "Gigamon Berserk Bear October 2021", "url": "https://vblocalhost.com/uploads/VB2021-Slowik.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--093215eb-4edb-4c55-bb5f-b8ca2de7962c", "subject": "ATTACK:enterprise:S0028", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--093215eb-4edb-4c55-bb5f-b8ca2de7962c", "modified": "2026-04-29T14:23:05.916Z", "references": [ { "source_name": "FireEye APT30", "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--09381138-b93b-4b0d-b82d-c21d452ff514", "subject": "ATTACK:enterprise:G0048", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--09381138-b93b-4b0d-b82d-c21d452ff514", "modified": "2026-07-31T18:48:17.274Z", "references": [ { "source_name": "ESET RTM Feb 2017", "url": "https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf" }, { "source_name": "Group IB RTM August 2019", "url": "https://www.group-ib.com/blog/rtm" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--0a507d28-ef6b-417b-a968-e82608e8b6a8", "subject": "ATTACK:enterprise:G0059", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--0a507d28-ef6b-417b-a968-e82608e8b6a8", "modified": "2026-07-31T18:48:28.069Z", "references": [ { "source_name": "DFIR Phosphorus November 2021", "url": "https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/" }, { "source_name": "Unit 42 Magic Hound Feb 2017", "url": "https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/" }, { "source_name": "Microsoft Iranian Threat Actor Trends November 2021", "url": "https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--0a606064-9f7f-4ca9-a2c5-b80360433ff7", "subject": "ATTACK:enterprise:S1044", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--0a606064-9f7f-4ca9-a2c5-b80360433ff7", "modified": "2026-04-29T14:23:05.917Z", "references": [ { "source_name": "Bitdefender FunnyDream Campaign November 2020", "url": "https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--0ecaa94b-3ad8-4de5-9cf2-81069676cfa3", "subject": "ATTACK:enterprise:S0331", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--0ecaa94b-3ad8-4de5-9cf2-81069676cfa3", "modified": "2026-04-29T14:23:05.924Z", "references": [ { "source_name": "Fortinet Agent Tesla April 2018", "url": "https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html" }, { "source_name": "SentinelLabs Agent Tesla Aug 2020", "url": "https://labs.sentinelone.com/agent-tesla-old-rat-uses-new-tricks-to-stay-on-top/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--0ef4030f-0af2-4b6e-bfb8-3fedc5af5a7e", "subject": "ATTACK:enterprise:S1029", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--0ef4030f-0af2-4b6e-bfb8-3fedc5af5a7e", "modified": "2026-04-29T14:23:05.924Z", "references": [ { "source_name": "MalwareBytes SideCopy Dec 2021", "url": "https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--0f1d0255-d27c-40d6-9c01-b2c9e9331f93", "subject": "ATTACK:enterprise:G1046", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--0f1d0255-d27c-40d6-9c01-b2c9e9331f93", "modified": "2026-07-31T18:47:47.768Z", "references": [ { "source_name": "rapid7-email-bombing", "url": "https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--0f5d3626-1dc2-4ebe-ba37-3f86ab0df9ec", "subject": "ATTACK:enterprise:S0090", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--0f5d3626-1dc2-4ebe-ba37-3f86ab0df9ec", "modified": "2026-04-29T14:23:05.925Z", "references": [ { "source_name": "Palo Alto Rover", "url": "http://researchcenter.paloaltonetworks.com/2016/02/new-malware-rover-targets-indian-ambassador-to-afghanistan/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--0f60b67a-c6a5-4855-991e-00ec6fe5f9ac", "subject": "ATTACK:enterprise:S0182", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--0f60b67a-c6a5-4855-991e-00ec6fe5f9ac", "modified": "2026-04-29T14:23:05.925Z", "references": [ { "source_name": "Microsoft FinFisher March 2018", "url": "https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/" }, { "source_name": "FinFisher Citation", "url": "https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--0f90920b-ab2e-4c79-95a5-5438c172a46d", "subject": "ATTACK:enterprise:S0670", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--0f90920b-ab2e-4c79-95a5-5438c172a46d", "modified": "2026-04-29T14:23:05.925Z", "references": [ { "source_name": "Check Point Warzone Feb 2020", "url": "https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--1075f27d-8675-4819-b23b-50d390092c95", "subject": "ATTACK:enterprise:S0449", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--1075f27d-8675-4819-b23b-50d390092c95", "modified": "2026-04-29T14:23:05.926Z", "references": [ { "source_name": "Sophos Maze VM September 2020", "url": "https://news.sophos.com/en-us/2020/09/17/maze-attackers-adopt-ragnar-locker-virtual-machine-technique/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--11471266-5136-4cd8-a1ef-d847f33ab6de", "subject": "ATTACK:enterprise:S0355", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--11471266-5136-4cd8-a1ef-d847f33ab6de", "modified": "2026-04-29T14:23:05.927Z", "references": [ { "source_name": "Unit 42 Nokki Oct 2018", "url": "https://researchcenter.paloaltonetworks.com/2018/10/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--11d37d18-3ad6-41ed-a99e-f1cc9d524c6c", "subject": "ATTACK:enterprise:S0337", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--11d37d18-3ad6-41ed-a99e-f1cc9d524c6c", "modified": "2026-04-29T14:23:05.928Z", "references": [ { "source_name": "Unit 42 BadPatch Oct 2017", "url": "https://researchcenter.paloaltonetworks.com/2017/10/unit42-badpatch/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--1215a807-77b4-465e-9c82-c4f023e668da", "subject": "ATTACK:enterprise:G0100", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--1215a807-77b4-465e-9c82-c4f023e668da", "modified": "2026-07-31T18:48:25.022Z", "references": [ { "source_name": "Kaspersky Cloud Atlas December 2014", "url": "https://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--1400cd29-916f-40fe-af7c-ec89ef7b75c8", "subject": "ATTACK:enterprise:S1199", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--1400cd29-916f-40fe-af7c-ec89ef7b75c8", "modified": "2026-04-29T14:23:05.931Z", "references": [ { "source_name": "FBI Lockbit 2.0 FEB 2022", "url": "https://www.ic3.gov/CSA/2022/220204.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--16713b63-7fe7-41e0-b157-2d26a406881b", "subject": "ATTACK:enterprise:C0022", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--16713b63-7fe7-41e0-b157-2d26a406881b", "modified": "2026-07-31T21:14:22.440Z", "references": [ { "source_name": "McAfee Lazarus Jul 2020", "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-a-job-offer-thats-too-good-to-be-true/?hilite=%27Operation%27%2C%27North%27%2C%27Star%27" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--1829d419-0145-4a47-bb1e-ff00e647b5ff", "subject": "ATTACK:enterprise:G0007", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--1829d419-0145-4a47-bb1e-ff00e647b5ff", "modified": "2026-07-31T20:48:44.440Z", "references": [ { "source_name": "TrendMicro Pawn Storm Dec 2020", "url": "https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--18ca258c-d465-44f1-98c6-57bd908577a9", "subject": "ATTACK:enterprise:S9053", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--18ca258c-d465-44f1-98c6-57bd908577a9", "modified": "2026-09-24T22:23:10.891Z", "references": [ { "source_name": "CheckPoint_NimbusManticoreEurope_Sept2025", "url": "https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--19bede58-549b-4e7d-b206-6045370b9995", "subject": "ATTACK:enterprise:G0139", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--19bede58-549b-4e7d-b206-6045370b9995", "modified": "2026-07-31T18:47:49.101Z", "references": [ { "source_name": "ATT TeamTNT Chimaera September 2020", "url": "https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--1be18787-844d-4135-9781-e5b6a8e76d14", "subject": "ATTACK:enterprise:S0332", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--1be18787-844d-4135-9781-e5b6a8e76d14", "modified": "2026-04-29T14:23:05.943Z", "references": [ { "source_name": "Fortinet Remcos Feb 2017", "url": "https://www.fortinet.com/blog/threat-research/remcos-a-new-rat-in-the-wild-2.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--1cb54b2e-5f2d-4d1b-9fda-9b17f49de65b", "subject": "ATTACK:enterprise:S0265", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--1cb54b2e-5f2d-4d1b-9fda-9b17f49de65b", "modified": "2026-04-29T14:23:05.944Z", "references": [ { "source_name": "Unit 42 Kazuar May 2017", "url": "https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--1eae2e76-cd0b-496e-b121-fa9fac51e6fc", "subject": "ATTACK:enterprise:G1056", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--1eae2e76-cd0b-496e-b121-fa9fac51e6fc", "modified": "2026-09-02T17:31:48.770Z", "references": [ { "source_name": "Aikido TeamPCP Telnyx MAR 2026", "url": "https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--1ec23e24-e63e-4c35-ad0d-637880ce7bb6", "subject": "ATTACK:enterprise:S0568", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--1ec23e24-e63e-4c35-ad0d-637880ce7bb6", "modified": "2026-04-29T14:23:05.946Z", "references": [ { "source_name": "Prevailion EvilNum May 2020", "url": "https://web.archive.org/web/20221209052853/https://www.prevailion.com/phantom-in-the-command-shell-2/" }, { "source_name": "ESET EvilNum July 2020", "url": "https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--1ffba98c-788b-47e0-a67c-9d3700e86ec5", "subject": "ATTACK:enterprise:S0389", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--1ffba98c-788b-47e0-a67c-9d3700e86ec5", "modified": "2026-04-29T14:23:05.948Z", "references": [ { "source_name": "Carbon Black JCry May 2019", "url": "https://www.carbonblack.com/2019/05/14/cb-tau-threat-intelligence-notification-jcry-ransomware-pretends-to-be-adobe-flash-player-update-installer/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--22260fda-fb95-4cf4-9e23-ba8662157c1f", "subject": "ATTACK:enterprise:S0338", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--22260fda-fb95-4cf4-9e23-ba8662157c1f", "modified": "2026-04-29T14:23:05.952Z", "references": [ { "source_name": "Zscaler Cobian Aug 2017", "url": "https://www.zscaler.com/blogs/research/cobian-rat-backdoored-rat" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--22879bfd-c9de-480b-83f3-4b58ef6dd08e", "subject": "ATTACK:enterprise:S0012", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--22879bfd-c9de-480b-83f3-4b58ef6dd08e", "modified": "2026-04-29T14:23:05.952Z", "references": [ { "source_name": "Symantec Darkmoon Aug 2005", "url": "https://www.symantec.com/security_response/writeup.jsp?docid=2005-081910-3934-99" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--23bc50df-16da-4b2d-89b3-1a74c7602aa2", "subject": "ATTACK:enterprise:S0484", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--23bc50df-16da-4b2d-89b3-1a74c7602aa2", "modified": "2026-04-29T14:23:05.954Z", "references": [ { "source_name": "Prevx Carberp March 2011", "url": "https://web.archive.org/web/20231227000328/http://pxnow.prevx.com/content/blog/carberp-a_modular_information_stealing_trojan.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--25022051-be2f-4cc2-b61a-3de03fc3e8d6", "subject": "ATTACK:enterprise:S0532", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--25022051-be2f-4cc2-b61a-3de03fc3e8d6", "modified": "2026-04-29T14:23:05.956Z", "references": [ { "source_name": "Unit 42 Lucifer June 2020", "url": "https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--251b010d-270f-44a3-8546-ce7cde631ab7", "subject": "ATTACK:enterprise:S0632", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--251b010d-270f-44a3-8546-ce7cde631ab7", "modified": "2026-04-29T14:23:05.956Z", "references": [ { "source_name": "Group IB GrimAgent July 2021", "url": "https://www.group-ib.com/blog/grimagent/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--259b878f-147e-443b-8360-aabc00cf6d73", "subject": "ATTACK:enterprise:S0070", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--259b878f-147e-443b-8360-aabc00cf6d73", "modified": "2026-04-29T14:23:05.956Z", "references": [ { "source_name": "ZScaler Hacking Team", "url": "http://research.zscaler.com/2015/08/chinese-cyber-espionage-apt-group.html" }, { "source_name": "ThreatStream Evasion Analysis", "url": "https://www.threatstream.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--25d44b9e-3645-4fe7-96b0-3c2c31b90ac0", "subject": "ATTACK:enterprise:S0665", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--25d44b9e-3645-4fe7-96b0-3c2c31b90ac0", "modified": "2026-04-29T14:23:05.957Z", "references": [ { "source_name": "Kaspersky ThreatNeedle Feb 2021", "url": "https://securelist.com/lazarus-threatneedle/100803/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--280b3253-cc47-42e1-9339-dbaa06161b15", "subject": "ATTACK:enterprise:S1212", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--280b3253-cc47-42e1-9339-dbaa06161b15", "modified": "2026-04-29T14:23:05.959Z", "references": [ { "source_name": "Group-IB RansomHub FEB 2025", "url": "https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--284ffb1b-ad42-468e-9897-94c25024f0d4", "subject": "ATTACK:enterprise:S0045", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--284ffb1b-ad42-468e-9897-94c25024f0d4", "modified": "2026-04-29T14:23:05.960Z", "references": [ { "source_name": "Kaspersky Sofacy", "url": "https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/" }, { "source_name": "ESET Sednit Part 2", "url": "http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf" }, { "source_name": "Bitdefender APT28 Dec 2015", "url": "https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--2851e8fa-0622-42db-b7b7-4e051fc5fbeb", "subject": "ATTACK:enterprise:G0065", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--2851e8fa-0622-42db-b7b7-4e051fc5fbeb", "modified": "2026-07-31T20:48:38.070Z", "references": [ { "source_name": "Proofpoint Leviathan Oct 2017", "url": "https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets" }, { "source_name": "FireEye Periscope March 2018", "url": "https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--2a7cd52f-46e5-4a18-bdf6-4c38edfcb97c", "subject": "ATTACK:enterprise:S0170", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--2a7cd52f-46e5-4a18-bdf6-4c38edfcb97c", "modified": "2026-04-29T14:23:05.962Z", "references": [ { "source_name": "Palo Alto OilRig May 2016", "url": "http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--2a896410-d7cd-4b58-a7d6-4878bc64113b", "subject": "ATTACK:enterprise:G0019", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--2a896410-d7cd-4b58-a7d6-4878bc64113b", "modified": "2026-07-31T18:47:46.045Z", "references": [ { "source_name": "Bitdefender Naikon April 2021", "url": "https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--2b3dc227-2ce1-41fa-8d1c-4c0d3685258d", "subject": "ATTACK:enterprise:S1066", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--2b3dc227-2ce1-41fa-8d1c-4c0d3685258d", "modified": "2026-04-29T14:23:05.963Z", "references": [ { "source_name": "Secureworks DarkTortilla Aug 2022", "url": "https://www.secureworks.com/research/darktortilla-malware-analysis" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--2cb6835c-e6e6-46d5-b5d2-45846eac3b74", "subject": "ATTACK:enterprise:S0650", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--2cb6835c-e6e6-46d5-b5d2-45846eac3b74", "modified": "2026-04-29T14:23:05.965Z", "references": [ { "source_name": "Crowdstrike Qakbot October 2020", "url": "https://www.crowdstrike.com/blog/duck-hunting-with-falcon-complete-qakbot-zip-based-campaign/" }, { "source_name": "Group IB Ransomware September 2020", "url": "https://web.archive.org/web/20220119114433/https://groupib.pathfactory.com/ransomware-reports/prolock_wp" }, { "source_name": "Trend Micro Qakbot May 2020", "url": "https://www.trendmicro.com/vinfo/ph/security/news/cybercrime-and-digital-threats/qakbot-resurges-spreads-through-vbs-files" }, { "source_name": "Trend Micro Qakbot December 2020", "url": "https://success.trendmicro.com/en-US/solution/KA-0011282" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--2d49852d-083e-4379-90e3-dcb0748be624", "subject": "ATTACK:enterprise:G0091", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--2d49852d-083e-4379-90e3-dcb0748be624", "modified": "2026-07-31T18:48:21.054Z", "references": [ { "source_name": "Group IB Silence Sept 2018", "url": "https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA." } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--2dde8a3e-773e-4a7f-82e4-dbcaa8cb94c8", "subject": "ATTACK:enterprise:S0666", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--2dde8a3e-773e-4a7f-82e4-dbcaa8cb94c8", "modified": "2026-04-29T14:23:05.967Z", "references": [ { "source_name": "ESET Gelsemium June 2021", "url": "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--2e443cd2-b77f-4bb9-8bbd-82e11ab389f2", "subject": "ATTACK:enterprise:S1130", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--2e443cd2-b77f-4bb9-8bbd-82e11ab389f2", "modified": "2026-04-29T14:23:05.967Z", "references": [ { "source_name": "TrendMicro RaspberryRobin 2022", "url": "https://www.trendmicro.com/en_us/research/22/l/raspberry-robin-malware-targets-telecom-governments.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--2e44b66a-0f81-4f60-94aa-c450556bc243", "subject": "ATTACK:enterprise:S0144", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--2e44b66a-0f81-4f60-94aa-c450556bc243", "modified": "2026-04-29T14:23:05.967Z", "references": [ { "source_name": "PWC Cloud Hopper Technical Annex April 2017", "url": "https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--2fb450c6-e236-4b81-b5ac-a9d4be0cf167", "subject": "ATTACK:enterprise:S0168", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--2fb450c6-e236-4b81-b5ac-a9d4be0cf167", "modified": "2026-04-29T14:23:05.974Z", "references": [ { "source_name": "ESET Gazer Aug 2017", "url": "https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf" }, { "source_name": "Securelist WhiteBear Aug 2017", "url": "https://securelist.com/introducing-whitebear/81638/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--313082d2-c493-4053-80c1-06300aeea8e0", "subject": "ATTACK:enterprise:G0078", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--313082d2-c493-4053-80c1-06300aeea8e0", "modified": "2026-07-31T18:47:42.561Z", "references": [ { "source_name": "Unit 42 Gorgon Group Aug 2018", "url": "https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--3216e004-d8fe-4475-a107-8c3ad92f0fd8", "subject": "ATTACK:enterprise:S0115", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--3216e004-d8fe-4475-a107-8c3ad92f0fd8", "modified": "2026-04-29T14:23:05.983Z", "references": [ { "source_name": "Proofpoint Operation Transparent Tribe March 2016", "url": "https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf" }, { "source_name": "Kaspersky Transparent Tribe August 2020", "url": "https://securelist.com/transparent-tribe-part-1/98127/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--3236ca50-2342-455a-b258-6a085cae8fc2", "subject": "ATTACK:enterprise:S0367", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--3236ca50-2342-455a-b258-6a085cae8fc2", "modified": "2026-04-29T14:23:05.983Z", "references": [ { "source_name": "Symantec Emotet Jul 2018", "url": "https://www.symantec.com/blogs/threat-intelligence/evolution-emotet-trojan-distributor" }, { "source_name": "US-CERT Emotet Jul 2018", "url": "https://www.us-cert.gov/ncas/alerts/TA18-201A" }, { "source_name": "Picus Emotet Dec 2018", "url": "https://www.picussecurity.com/blog/the-christmas-card-you-never-wanted-a-new-wave-of-emotet-is-back-to-wreak-havoc.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--327a64df-b405-453b-83d2-528d17e8df51", "subject": "ATTACK:enterprise:S0046", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--327a64df-b405-453b-83d2-528d17e8df51", "modified": "2026-04-29T14:23:05.985Z", "references": [ { "source_name": "F-Secure CozyDuke", "url": "https://www.f-secure.com/documents/996508/1030745/CozyDuke" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--3341ad26-c7a8-4e42-a095-a49e65fde843", "subject": "ATTACK:enterprise:S0341", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--3341ad26-c7a8-4e42-a095-a49e65fde843", "modified": "2026-04-29T14:23:05.986Z", "references": [ { "source_name": "Unit42 Xbash Sept 2018", "url": "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--3434121e-a4d6-43a7-b905-78c52f5a12bd", "subject": "ATTACK:enterprise:S0260", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--3434121e-a4d6-43a7-b905-78c52f5a12bd", "modified": "2026-04-29T14:23:05.989Z", "references": [ { "source_name": "ESET InvisiMole June 2020", "url": "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--343d285a-e910-487b-8e85-dc87cdb63be3", "subject": "ATTACK:enterprise:G0016", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--343d285a-e910-487b-8e85-dc87cdb63be3", "modified": "2026-07-31T18:48:07.633Z", "references": [ { "source_name": "Mandiant No Easy Breach", "url": "https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--3475a2ad-4cb7-4ec0-bb36-6e60355a03c3", "subject": "ATTACK:enterprise:S1236", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--3475a2ad-4cb7-4ec0-bb36-6e60355a03c3", "modified": "2026-04-29T14:23:05.989Z", "references": [ { "source_name": "IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025", "url": "https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor" }, { "source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA", "url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--3698b20c-408a-4873-9284-19b2106bfaab", "subject": "ATTACK:enterprise:S0546", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--3698b20c-408a-4873-9284-19b2106bfaab", "modified": "2026-04-29T14:23:05.994Z", "references": [ { "source_name": "Cybereason Molerats Dec 2020", "url": "https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--3777379a-469f-453e-a270-450c8b1eba9b", "subject": "ATTACK:enterprise:S0660", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--3777379a-469f-453e-a270-450c8b1eba9b", "modified": "2026-04-29T14:23:05.995Z", "references": [ { "source_name": "Trend Micro DRBControl February 2020", "url": "https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf" }, { "source_name": "Talent-Jump Clambling February 2020", "url": "https://www.talent-jump.com/article/2020/02/17/CLAMBLING-A-New-Backdoor-Base-On-Dropbox-en/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--37dd9a3c-dd52-4541-be7c-b490d026305c", "subject": "ATTACK:enterprise:S0148", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--37dd9a3c-dd52-4541-be7c-b490d026305c", "modified": "2026-04-29T14:23:05.996Z", "references": [ { "source_name": "ESET RTM Feb 2017", "url": "https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--384c75e4-04e7-4ff8-9da6-0c8a03cb7a61", "subject": "ATTACK:enterprise:S0074", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--384c75e4-04e7-4ff8-9da6-0c8a03cb7a61", "modified": "2026-04-29T14:23:05.997Z", "references": [ { "source_name": "Dell Sakula", "url": "http://www.secureworks.com/cyber-threat-intelligence/threats/sakula-malware-family/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--3d3fa163-626d-41b8-85c1-f815c458ad19", "subject": "ATTACK:enterprise:G0128", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--3d3fa163-626d-41b8-85c1-f815c458ad19", "modified": "2026-07-31T18:47:52.190Z", "references": [ { "source_name": "Zscaler APT31 Covid-19 October 2020", "url": "https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--3dcf441c-b987-4c6a-93e7-e24ae1e16475", "subject": "ATTACK:enterprise:S0172", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--3dcf441c-b987-4c6a-93e7-e24ae1e16475", "modified": "2026-04-29T14:23:06.009Z", "references": [ { "source_name": "Palo Alto Reaver Nov 2017", "url": "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--3e3a5bf5-1e90-45d2-b90a-3b919f5425d5", "subject": "ATTACK:enterprise:S0262", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--3e3a5bf5-1e90-45d2-b90a-3b919f5425d5", "modified": "2026-04-29T14:23:06.010Z", "references": [ { "source_name": "CISA AR18-352A Quasar RAT December 2018", "url": "https://www.cisa.gov/uscert/ncas/analysis-reports/AR18-352A" }, { "source_name": "GitHub QuasarRAT", "url": "https://github.com/quasar/QuasarRAT" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--3ebad12d-fd33-4289-93dc-1f5af5e90b66", "subject": "ATTACK:enterprise:S0036", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--3ebad12d-fd33-4289-93dc-1f5af5e90b66", "modified": "2026-04-29T14:23:06.010Z", "references": [ { "source_name": "FireEye APT30", "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--3f4700e6-71a4-4995-b173-00974a528905", "subject": "ATTACK:enterprise:S0397", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--3f4700e6-71a4-4995-b173-00974a528905", "modified": "2026-04-29T14:23:06.011Z", "references": [ { "source_name": "ESET LoJax Sept 2018", "url": "https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--3f954be4-205c-4cec-92f9-36715e204a49", "subject": "ATTACK:enterprise:G0040", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--3f954be4-205c-4cec-92f9-36715e204a49", "modified": "2026-07-31T20:48:26.247Z", "references": [ { "source_name": "Cymmetria Patchwork", "url": "https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf" }, { "source_name": "TrendMicro Patchwork Dec 2017", "url": "https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--41bec3ae-de2b-470b-b356-dd163bd20445", "subject": "ATTACK:enterprise:S1138", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--41bec3ae-de2b-470b-b356-dd163bd20445", "modified": "2026-04-29T14:23:06.015Z", "references": [ { "source_name": "Sophos Gootloader", "url": "https://news.sophos.com/en-us/2021/03/01/gootloader-expands-its-payload-delivery-options/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--434296ee-6296-4d0a-a72e-bebb914c9700", "subject": "ATTACK:enterprise:S1037", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--434296ee-6296-4d0a-a72e-bebb914c9700", "modified": "2026-04-29T14:23:06.017Z", "references": [ { "source_name": "DHS CISA AA22-055A MuddyWater February 2022", "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-055a" }, { "source_name": "Mandiant UNC3313 Feb 2022", "url": "https://www.mandiant.com/resources/telegram-malware-iranian-espionage" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--442ff7a8-149b-4d26-933a-033ba25b9838", "subject": "ATTACK:enterprise:S0381", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--442ff7a8-149b-4d26-933a-033ba25b9838", "modified": "2026-04-29T14:23:06.018Z", "references": [ { "source_name": "Korean FSI TA505 2020", "url": "https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory=" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--44908b0a-993a-4339-b30f-f0f1a64c0753", "subject": "ATTACK:enterprise:S0147", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--44908b0a-993a-4339-b30f-f0f1a64c0753", "modified": "2026-04-29T14:23:06.019Z", "references": [ { "source_name": "Palo Alto Gamaredon Feb 2017", "url": "https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--45f150d4-a917-4862-bcee-170be75415cd", "subject": "ATTACK:enterprise:S0652", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--45f150d4-a917-4862-bcee-170be75415cd", "modified": "2026-04-29T14:23:06.021Z", "references": [ { "source_name": "Kaspersky Ferocious Kitten Jun 2021", "url": "https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--4696a49d-caa1-4746-b106-45faf327270b", "subject": "ATTACK:enterprise:S0167", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--4696a49d-caa1-4746-b106-45faf327270b", "modified": "2026-04-29T14:23:06.022Z", "references": [ { "source_name": "ClearSky Wilted Tulip July 2017", "url": "http://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf" }, { "source_name": "CopyKittens Nov 2015", "url": "https://cdn2.hubspot.net/hubfs/1903456/Whitepapers/CopyKittens.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--4739d942-9d7f-4d7b-8aaf-af5464f76d44", "subject": "ATTACK:enterprise:S1111", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--4739d942-9d7f-4d7b-8aaf-af5464f76d44", "modified": "2026-04-29T14:23:06.022Z", "references": [ { "source_name": "Ensilo Darkgate 2018", "url": "https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign" }, { "source_name": "Rapid7 BlackBasta 2024", "url": "https://www.rapid7.com/blog/post/2024/12/04/black-basta-ransomware-campaign-drops-zbot-darkgate-and-custom-malware/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--475d30ee-999c-470c-b4b3-eed40d1db799", "subject": "ATTACK:enterprise:S0356", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--475d30ee-999c-470c-b4b3-eed40d1db799", "modified": "2026-04-29T14:23:06.022Z", "references": [ { "source_name": "Talos Konni May 2017", "url": "https://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--498c599b-99ed-477d-afe8-2a6714506934", "subject": "ATTACK:enterprise:S0207", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--498c599b-99ed-477d-afe8-2a6714506934", "modified": "2026-04-29T14:23:06.026Z", "references": [ { "source_name": "Symantec Vasport May 2012", "url": "https://www.symantec.com/security_response/writeup.jsp?docid=2012-051606-5938-99" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--4a34355b-dcbb-41a7-b562-167a76c93d9e", "subject": "ATTACK:enterprise:S0644", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--4a34355b-dcbb-41a7-b562-167a76c93d9e", "modified": "2026-04-29T14:23:06.026Z", "references": [ { "source_name": "Talos Oblique RAT March 2021", "url": "https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--4ad60c58-2665-4c4b-a9e8-5cd0042e45bb", "subject": "ATTACK:enterprise:S0015", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--4ad60c58-2665-4c4b-a9e8-5cd0042e45bb", "modified": "2026-04-29T14:23:06.027Z", "references": [ { "source_name": "Trend Micro IXESHE 2012", "url": "https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--4af1ec66-5007-49df-8a10-df2c8ed7edc8", "subject": "ATTACK:enterprise:S0127", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--4af1ec66-5007-49df-8a10-df2c8ed7edc8", "modified": "2026-04-29T14:23:06.028Z", "references": [ ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--4b45b720-a606-4c52-a28a-2ef298f9b42f", "subject": "ATTACK:enterprise:G0037", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--4b45b720-a606-4c52-a28a-2ef298f9b42f", "modified": "2026-07-31T20:48:30.840Z", "references": [ { "source_name": "FireEye FIN6 April 2016", "url": "https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--4be5482c-2a58-41af-a7d7-477c596b4622", "subject": "ATTACK:enterprise:S0455", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--4be5482c-2a58-41af-a7d7-477c596b4622", "modified": "2026-04-29T14:23:06.029Z", "references": [ { "source_name": "Medium Metamorfo Apr 2020", "url": "https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767" }, { "source_name": "ESET Casbaneiro Oct 2019", "url": "https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/" }, { "source_name": "FireEye Metamorfo Apr 2018", "url": "https://www.fireeye.com/blog/threat-research/2018/04/metamorfo-campaign-targeting-brazilian-users.html" }, { "source_name": "Fortinet Metamorfo Feb 2020", "url": "https://www.fortinet.com/blog/threat-research/another-metamorfo-variant-targeting-customers-of-financial-institutions" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--4c362fcd-939d-48e8-9279-731a663875b0", "subject": "ATTACK:enterprise:S1053", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--4c362fcd-939d-48e8-9279-731a663875b0", "modified": "2026-04-29T14:23:06.029Z", "references": [ { "source_name": "Trend Micro AvosLocker Apr 2022", "url": "https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-avoslocker" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--4cfd348f-d2b0-4e89-b485-b2d02f912d1d", "subject": "ATTACK:enterprise:T1547.001", "predicate": "subtechnique-of", "object": "ATTACK:enterprise:T1547", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--4cfd348f-d2b0-4e89-b485-b2d02f912d1d", "modified": "2026-04-29T14:23:06.030Z", "references": [ ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--4d28e653-c023-45cf-bbbd-ade005bcd519", "subject": "ATTACK:enterprise:S1086", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--4d28e653-c023-45cf-bbbd-ade005bcd519", "modified": "2026-04-29T14:23:06.030Z", "references": [ { "source_name": "Telefonica Snip3 December 2021", "url": "https://telefonicatech.com/blog/snip3-investigacion-malware" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--4f08676f-51c1-4cb5-94a7-08922e4886c6", "subject": "ATTACK:enterprise:S0087", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--4f08676f-51c1-4cb5-94a7-08922e4886c6", "modified": "2026-04-29T14:23:06.033Z", "references": [ { "source_name": "Fidelis INOCNATION", "url": "https://fidelissecurity.com/resource/report/fidelis-threat-advisory-1020-dissecting-the-malware-involved-in-the-inocnation-campaign/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--4f2450a7-d2d2-4063-9dd5-cac396a3215c", "subject": "ATTACK:enterprise:G0010", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--4f2450a7-d2d2-4063-9dd5-cac396a3215c", "modified": "2026-07-31T18:48:03.811Z", "references": [ { "source_name": "ESET Turla Mosquito May 2018", "url": "https://www.welivesecurity.com/2018/05/22/turla-mosquito-shift-towards-generic-tools/" }, { "source_name": "ESET Turla Mosquito Jan 2018", "url": "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf" }, { "source_name": "ESET Turla Lunar toolset May 2024", "url": "https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--51cc7dff-7fb4-41bc-a67d-39598f14f1d8", "subject": "ATTACK:enterprise:S0226", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--51cc7dff-7fb4-41bc-a67d-39598f14f1d8", "modified": "2026-04-29T14:23:06.037Z", "references": [ { "source_name": "Malwarebytes SmokeLoader 2016", "url": "https://blog.malwarebytes.com/threat-analysis/2016/08/smoke-loader-downloader-with-a-smokescreen-still-alive/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--5266fdd9-f62e-4412-b5d0-d26ba6d5a1ab", "subject": "ATTACK:enterprise:S0471", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--5266fdd9-f62e-4412-b5d0-d26ba6d5a1ab", "modified": "2026-04-29T14:23:06.038Z", "references": [ { "source_name": "Trend Micro Tick November 2019", "url": "https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--52d12577-199c-41a6-92d6-28d26c023aea", "subject": "ATTACK:enterprise:S0433", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--52d12577-199c-41a6-92d6-28d26c023aea", "modified": "2026-04-29T14:23:06.038Z", "references": [ { "source_name": "Carbon Black HotCroissant April 2020", "url": "https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--52fb6aab-7a55-437d-8a2f-d3f84bf98a2f", "subject": "ATTACK:enterprise:S0630", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--52fb6aab-7a55-437d-8a2f-d3f84bf98a2f", "modified": "2026-04-29T14:23:06.038Z", "references": [ { "source_name": "Bitdefender Naikon April 2021", "url": "https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--534cf936-84e8-49ff-a616-90267467decd", "subject": "ATTACK:enterprise:S0353", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--534cf936-84e8-49ff-a616-90267467decd", "modified": "2026-04-29T14:23:06.039Z", "references": [ { "source_name": "Unit 42 NOKKI Sept 2018", "url": "https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--53dadcc9-9f23-4057-8b75-bc893ee30a17", "subject": "ATTACK:enterprise:S1239", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--53dadcc9-9f23-4057-8b75-bc893ee30a17", "modified": "2026-04-29T14:23:06.040Z", "references": [ { "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023", "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--5463f157-7cab-4e9d-bb68-6179972087b6", "subject": "ATTACK:enterprise:S0531", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--5463f157-7cab-4e9d-bb68-6179972087b6", "modified": "2026-04-29T14:23:06.040Z", "references": [ { "source_name": "IBM Grandoreiro April 2020", "url": "https://securityintelligence.com/posts/grandoreiro-malware-now-targeting-banks-in-spain/" }, { "source_name": "ESET Grandoreiro April 2020", "url": "https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--55120727-0b7f-4d6a-a881-d17bdc9c85ba", "subject": "ATTACK:enterprise:G0024", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--55120727-0b7f-4d6a-a881-d17bdc9c85ba", "modified": "2026-07-31T18:47:58.386Z", "references": [ { "source_name": "CrowdStrike Putter Panda", "url": "http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--559c0d59-16a7-4c1c-801d-6c8c32ffc5ce", "subject": "ATTACK:enterprise:S0196", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--559c0d59-16a7-4c1c-801d-6c8c32ffc5ce", "modified": "2026-04-29T14:23:06.042Z", "references": [ { "source_name": "FireEye Know Your Enemy FIN8 Aug 2016", "url": "https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html" }, { "source_name": "Morphisec ShellTea June 2019", "url": "http://blog.morphisec.com/security-alert-fin8-is-back" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--55d44c4e-c864-4e6f-ac33-62f13cd08f0e", "subject": "ATTACK:enterprise:G0069", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--55d44c4e-c864-4e6f-ac33-62f13cd08f0e", "modified": "2026-07-31T20:48:29.827Z", "references": [ { "source_name": "Talos MuddyWater May 2019", "url": "https://blog.talosintelligence.com/2019/05/recent-muddywater-associated-blackwater.html" }, { "source_name": "Securelist MuddyWater Oct 2018", "url": "https://securelist.com/muddywater/88059/" }, { "source_name": "Talos MuddyWater Jan 2022", "url": "https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html" }, { "source_name": "Trend Micro Muddy Water March 2021", "url": "https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html" }, { "source_name": "Reaqta MuddyWater November 2017", "url": "https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/" }, { "source_name": "FireEye MuddyWater Mar 2018", "url": "https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--55df3b40-b130-4313-9064-6b0fc56564d0", "subject": "ATTACK:enterprise:S0178", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--55df3b40-b130-4313-9064-6b0fc56564d0", "modified": "2026-04-29T14:23:06.042Z", "references": [ { "source_name": "Microsoft Win Defender Truvasys Sep 2017", "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Truvasys.A!dha" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--57c700c6-e301-4433-84bd-722934f9d922", "subject": "ATTACK:enterprise:S0499", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--57c700c6-e301-4433-84bd-722934f9d922", "modified": "2026-04-29T14:23:06.045Z", "references": [ { "source_name": "FireEye Hancitor", "url": "https://www.fireeye.com/blog/threat-research/2016/09/hancitor_aka_chanit.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--57e1f6b0-7fbd-49b4-8f5d-876b759437ac", "subject": "ATTACK:enterprise:S0094", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--57e1f6b0-7fbd-49b4-8f5d-876b759437ac", "modified": "2026-04-29T14:23:06.045Z", "references": [ { "source_name": "Symantec Dragonfly", "url": "https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments" }, { "source_name": "Secureworks Karagany July 2019", "url": "https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--5ab3897a-4f37-4b59-99ca-f39605cb1a35", "subject": "ATTACK:enterprise:S0080", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--5ab3897a-4f37-4b59-99ca-f39605cb1a35", "modified": "2026-04-29T14:23:06.049Z", "references": [ { "source_name": "Symantec Backdoor.Mivast", "url": "http://www.symantec.com/security_response/writeup.jsp?docid=2015-020623-0740-99&tabid=2" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--5b686a7c-4fcd-44c2-9f57-1d88d6633ef4", "subject": "ATTACK:enterprise:S0136", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--5b686a7c-4fcd-44c2-9f57-1d88d6633ef4", "modified": "2026-04-29T14:23:06.050Z", "references": [ { "source_name": "ESET Sednit USBStealer 2014", "url": "http://www.welivesecurity.com/2014/11/11/sednit-espionage-group-attacking-air-gapped-networks/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--5bd58ef1-ad36-47ac-91e5-4e7df618dd87", "subject": "ATTACK:enterprise:S0141", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--5bd58ef1-ad36-47ac-91e5-4e7df618dd87", "modified": "2026-04-29T14:23:06.050Z", "references": [ { "source_name": "Novetta Winnti April 2015", "url": "https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--5d0263d9-ddd3-4195-96ae-e340caef9e0e", "subject": "ATTACK:enterprise:S0044", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--5d0263d9-ddd3-4195-96ae-e340caef9e0e", "modified": "2026-04-29T14:23:06.052Z", "references": [ { "source_name": "ESET Sednit Part 1", "url": "http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part1.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--5d036e42-7ce2-499d-b693-12504c8615ca", "subject": "ATTACK:enterprise:S0553", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--5d036e42-7ce2-499d-b693-12504c8615ca", "modified": "2026-04-29T14:23:06.052Z", "references": [ { "source_name": "Cybereason Molerats Dec 2020", "url": "https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--5d43c968-d9d2-4687-949e-23888376f10c", "subject": "ATTACK:enterprise:G0121", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--5d43c968-d9d2-4687-949e-23888376f10c", "modified": "2026-07-31T18:47:51.861Z", "references": [ { "source_name": "Rewterz Sidewinder APT April 2020", "url": "https://www.rewterz.com/threats/sidewinder-apt-group-campaign-analysis" }, { "source_name": "Rewterz Sidewinder COVID-19 June 2020", "url": "https://www.rewterz.com/articles/analysis-on-sidewinder-apt-group-covid-19" }, { "source_name": "Cyble Sidewinder September 2020", "url": "https://cybleinc.com/2020/09/26/sidewinder-apt-targets-with-futuristic-tactics-and-techniques/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--5ec68d1c-9ba8-4f9c-b185-f4e8482a66b2", "subject": "ATTACK:enterprise:S0570", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--5ec68d1c-9ba8-4f9c-b185-f4e8482a66b2", "modified": "2026-04-29T14:23:06.054Z", "references": [ { "source_name": "Crowdstrike Indrik November 2018", "url": "https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--600e55f7-1a72-4289-9c4c-b66798a58776", "subject": "ATTACK:enterprise:S9037", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--600e55f7-1a72-4289-9c4c-b66798a58776", "modified": "2026-04-29T14:23:06.056Z", "references": [ { "source_name": "CloudSEK_RustyWater_Jan2026", "url": "https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--603725ac-1b50-482d-b3f5-f657fdd082af", "subject": "ATTACK:enterprise:S0512", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--603725ac-1b50-482d-b3f5-f657fdd082af", "modified": "2026-04-29T14:23:06.056Z", "references": [ { "source_name": "ESET Dukes October 2019", "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--608ecdef-db04-419b-b453-0aeb538c7093", "subject": "ATTACK:enterprise:S0513", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--608ecdef-db04-419b-b453-0aeb538c7093", "modified": "2026-04-29T14:23:06.056Z", "references": [ { "source_name": "ESET Dukes October 2019", "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--617fe29d-ac48-4cd0-ae8c-19cf7cfdbedd", "subject": "ATTACK:enterprise:S0034", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--617fe29d-ac48-4cd0-ae8c-19cf7cfdbedd", "modified": "2026-04-29T14:23:06.058Z", "references": [ { "source_name": "FireEye APT30", "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--618b419c-d8a1-42cb-a846-ea465bd96618", "subject": "ATTACK:enterprise:C0047", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--618b419c-d8a1-42cb-a846-ea465bd96618", "modified": "2026-07-31T18:47:19.439Z", "references": [ { "source_name": "Recorded Future RedDelta 2025", "url": "https://go.recordedfuture.com/hubfs/reports/cta-cn-2025-0109.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--62bf46b4-69b3-4a32-bcbb-c9d960e3039a", "subject": "ATTACK:enterprise:S0382", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--62bf46b4-69b3-4a32-bcbb-c9d960e3039a", "modified": "2026-04-29T14:23:06.059Z", "references": [ { "source_name": "Deep Instinct TA505 Apr 2019", "url": "https://www.deepinstinct.com/blog/new-servhelper-variant-employs-excel-4-0-macro-to-drop-signed-payload" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--6435caf7-2493-4cfb-9ddc-2f672c220251", "subject": "ATTACK:enterprise:S0444", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--6435caf7-2493-4cfb-9ddc-2f672c220251", "modified": "2026-04-29T14:23:06.061Z", "references": [ { "source_name": "FOX-IT May 2016 Mofang", "url": "https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--64d59c09-1ecd-4711-b2b8-e46d4ffc7ede", "subject": "ATTACK:enterprise:G0027", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--64d59c09-1ecd-4711-b2b8-e46d4ffc7ede", "modified": "2026-07-31T18:48:28.958Z", "references": [ { "source_name": "Lunghi Iron Tiger Linux", "url": "https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html" }, { "source_name": "Nccgroup Emissary Panda May 2018", "url": "https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--64f1da46-93a7-4e70-8702-801dbaf26206", "subject": "ATTACK:enterprise:S0375", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--64f1da46-93a7-4e70-8702-801dbaf26206", "modified": "2026-04-29T14:23:06.062Z", "references": [ { "source_name": "Securelist Remexi Jan 2019", "url": "https://securelist.com/chafer-used-remexi-malware/89538/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--689c51b8-7e41-474e-abf6-ffdde0acc40b", "subject": "ATTACK:enterprise:S0035", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--689c51b8-7e41-474e-abf6-ffdde0acc40b", "modified": "2026-04-29T14:23:06.067Z", "references": [ { "source_name": "FireEye APT30", "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--69cc4413-80b4-45ed-a993-db34fe32fabe", "subject": "ATTACK:enterprise:G0081", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--69cc4413-80b4-45ed-a993-db34fe32fabe", "modified": "2026-07-31T18:47:57.166Z", "references": [ { "source_name": "Anomali Pirate Panda April 2020", "url": "https://www.anomali.com/blog/anomali-suspects-that-china-backed-apt-pirate-panda-may-be-seeking-access-to-vietnam-government-data-center#When:15:00:00Z" }, { "source_name": "TrendMicro Tropic Trooper May 2020", "url": "https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--6ab291a5-8061-4ad4-a6a7-07a6142e4c27", "subject": "ATTACK:enterprise:G0032", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--6ab291a5-8061-4ad4-a6a7-07a6142e4c27", "modified": "2026-07-31T20:48:46.818Z", "references": [ { "source_name": "Novetta Blockbuster RATs", "url": "https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf" }, { "source_name": "Novetta Blockbuster", "url": "https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf" }, { "source_name": "Lazarus APT January 2022", "url": "https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/" }, { "source_name": "McAfee Lazarus Resurfaces Feb 2018", "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--6ad8e998-041f-491d-8691-4990022248e0", "subject": "ATTACK:enterprise:G0096", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--6ad8e998-041f-491d-8691-4990022248e0", "modified": "2026-07-31T20:48:27.164Z", "references": [ { "source_name": "FireEye APT41 Aug 2019", "url": "https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf" }, { "source_name": "FireEye APT41 March 2020", "url": "https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html" }, { "source_name": "Group IB APT 41 June 2021", "url": "https://www.group-ib.com/blog/colunmtk-apt41/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--6aeeb7e4-fc09-40a6-b071-c04df0f92928", "subject": "ATTACK:enterprise:G0112", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--6aeeb7e4-fc09-40a6-b071-c04df0f92928", "modified": "2026-09-02T18:52:47.016Z", "references": [ { "source_name": "BlackBerry Bahamut", "url": "https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--6c9c0332-bdd8-4692-af01-cc7ebc486a41", "subject": "ATTACK:enterprise:S1122", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--6c9c0332-bdd8-4692-af01-cc7ebc486a41", "modified": "2026-04-29T14:23:06.073Z", "references": [ { "source_name": "ESET Security Mispadu Facebook Ads 2019", "url": "https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/" }, { "source_name": "Metabase Q Mispadu Trojan 2023", "url": "https://www.metabaseq.com/mispadu-banking-trojan/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--6cc7fc62-740a-47c4-988c-bdd9c5880c3f", "subject": "ATTACK:enterprise:S0363", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--6cc7fc62-740a-47c4-988c-bdd9c5880c3f", "modified": "2026-04-29T14:23:06.073Z", "references": [ { "source_name": "Github PowerShell Empire", "url": "https://github.com/PowerShellEmpire/Empire" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--6d4a7150-60f9-4ed5-b24b-088c76d6ab73", "subject": "ATTACK:enterprise:S1041", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--6d4a7150-60f9-4ed5-b24b-088c76d6ab73", "modified": "2026-04-29T14:23:06.074Z", "references": [ { "source_name": "Bitdefender FunnyDream Campaign November 2020", "url": "https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--6e18aefd-85d3-432e-9ebb-3dde28c4bc6c", "subject": "ATTACK:enterprise:S9010", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--6e18aefd-85d3-432e-9ebb-3dde28c4bc6c", "modified": "2026-04-29T14:23:06.075Z", "references": [ { "source_name": "Koi Glassworm InvisibleCode October 2025", "url": "https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--70613a9f-e8c2-44ba-a238-34acb0b7e5b8", "subject": "ATTACK:enterprise:S1035", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--70613a9f-e8c2-44ba-a238-34acb0b7e5b8", "modified": "2026-04-29T14:23:06.078Z", "references": [ { "source_name": "NCSC GCHQ Small Sieve Jan 2022", "url": "https://www.ncsc.gov.uk/files/NCSC-Malware-Analysis-Report-Small-Sieve.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--70b1afda-98b8-4c7c-ad41-ceb2b45af5d4", "subject": "ATTACK:enterprise:S0649", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--70b1afda-98b8-4c7c-ad41-ceb2b45af5d4", "modified": "2026-04-29T14:23:06.079Z", "references": [ { "source_name": "FireEye SMOKEDHAM June 2021", "url": "https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--7118797d-8bb1-4404-8f00-d02113c7dd7d", "subject": "ATTACK:enterprise:S9034", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--7118797d-8bb1-4404-8f00-d02113c7dd7d", "modified": "2026-04-29T14:23:06.080Z", "references": [ { "source_name": "CAL_MuddyWater_Mar2026", "url": "https://ctrlaltintel.com/research/MuddyWater/" }, { "source_name": "SecureListUbiedo_Tsundere_Nov2025", "url": "https://securelist.com/tsundere-node-js-botnet-uses-ethereum-blockchain/117979/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--7333e2da-7aa5-4559-a03d-5818883d62d5", "subject": "ATTACK:enterprise:S0461", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--7333e2da-7aa5-4559-a03d-5818883d62d5", "modified": "2026-04-29T14:23:06.083Z", "references": [ { "source_name": "IBM TA505 April 2020", "url": "https://web.archive.org/web/20200420201624/https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/" }, { "source_name": "Proofpoint TA505 October 2019", "url": "https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--742ac520-ebc2-4ac2-8083-2c2d601fda4f", "subject": "ATTACK:enterprise:S9019", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--742ac520-ebc2-4ac2-8083-2c2d601fda4f", "modified": "2026-04-29T14:23:06.084Z", "references": [ { "source_name": "Zscaler PureCrypter JUN 2022", "url": "https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--74859e2a-7a8f-4b87-b75c-7286b3de685c", "subject": "ATTACK:enterprise:G0046", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--74859e2a-7a8f-4b87-b75c-7286b3de685c", "modified": "2026-07-31T20:48:31.998Z", "references": [ { "source_name": "FireEye FIN7 April 2017", "url": "https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html" }, { "source_name": "FireEye FIN7 Aug 2018", "url": "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--74fd87b9-3aff-4278-a408-11ae470082e5", "subject": "ATTACK:enterprise:G0070", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--74fd87b9-3aff-4278-a408-11ae470082e5", "modified": "2026-09-02T18:51:44.330Z", "references": [ { "source_name": "Lookout Dark Caracal Jan 2018", "url": "https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--750ca5b8-6142-46c0-9c40-f04dc9036bb9", "subject": "ATTACK:enterprise:S0249", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--750ca5b8-6142-46c0-9c40-f04dc9036bb9", "modified": "2026-04-29T14:23:06.085Z", "references": [ { "source_name": "McAfee Gold Dragon", "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--753f9861-f0b8-4467-ac5e-4457bd350095", "subject": "ATTACK:enterprise:S0131", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--753f9861-f0b8-4467-ac5e-4457bd350095", "modified": "2026-04-29T14:23:06.085Z", "references": [ { "source_name": "Forcepoint Monsoon", "url": "https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--75b383eb-5483-4c44-a721-ee1cffa6edb7", "subject": "ATTACK:enterprise:G0051", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--75b383eb-5483-4c44-a721-ee1cffa6edb7", "modified": "2026-07-31T18:48:28.776Z", "references": [ { "source_name": "FireEye FIN10 June 2017", "url": "https://services.google.com/fh/files/misc/rpt-fin-10-anatomy-of-a-cyber-en.pdf" }, { "source_name": "Github PowerShell Empire", "url": "https://github.com/PowerShellEmpire/Empire" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--76701e52-cfce-4294-91e4-485fad7c8f0f", "subject": "ATTACK:enterprise:S0456", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--76701e52-cfce-4294-91e4-485fad7c8f0f", "modified": "2026-04-29T14:23:06.087Z", "references": [ { "source_name": "CheckPoint Naikon May 2020", "url": "https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--788d02cb-7a20-4115-9428-b55e598374ce", "subject": "ATTACK:enterprise:G0056", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--788d02cb-7a20-4115-9428-b55e598374ce", "modified": "2026-07-31T20:48:51.290Z", "references": [ { "source_name": "Talos Promethium June 2020", "url": "https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--79bae99a-8480-4857-834b-fa823adca4c6", "subject": "ATTACK:enterprise:S0441", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--79bae99a-8480-4857-834b-fa823adca4c6", "modified": "2026-04-29T14:23:06.092Z", "references": [ { "source_name": "Unit 42 Inception November 2018", "url": "https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--7a1dd7b6-f759-4580-b658-e1b5abf12d89", "subject": "ATTACK:enterprise:S0647", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--7a1dd7b6-f759-4580-b658-e1b5abf12d89", "modified": "2026-04-29T14:23:06.092Z", "references": [ { "source_name": "ESET BackdoorDiplomacy Jun 2021", "url": "https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--7ae71a39-4f64-4d64-ad3f-885ae7a5c613", "subject": "ATTACK:enterprise:S0204", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--7ae71a39-4f64-4d64-ad3f-885ae7a5c613", "modified": "2026-04-29T14:23:06.094Z", "references": [ { "source_name": "Symantec Briba May 2012", "url": "https://www.symantec.com/security_response/writeup.jsp?docid=2012-051515-2843-99" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--7b06929c-1b23-4efc-9fc1-64552d5fbdb2", "subject": "ATTACK:enterprise:S0194", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--7b06929c-1b23-4efc-9fc1-64552d5fbdb2", "modified": "2026-04-29T14:23:06.094Z", "references": [ { "source_name": "GitHub PowerSploit May 2012", "url": "https://github.com/PowerShellMafia/PowerSploit" }, { "source_name": "PowerSploit Documentation", "url": "http://powersploit.readthedocs.io" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--7b909310-43e8-4870-ab62-d6078f27a785", "subject": "ATTACK:enterprise:S0268", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--7b909310-43e8-4870-ab62-d6078f27a785", "modified": "2026-04-29T14:23:06.095Z", "references": [ { "source_name": "Unit 42 Bisonal July 2018", "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-bisonal-malware-used-attacks-russia-south-korea/" }, { "source_name": "Talos Bisonal Mar 2020", "url": "https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--7d1d4ffd-7c60-4a83-bcfa-66413bbe7212", "subject": "ATTACK:enterprise:S0253", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--7d1d4ffd-7c60-4a83-bcfa-66413bbe7212", "modified": "2026-04-29T14:23:06.097Z", "references": [ { "source_name": "McAfee Gold Dragon", "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--7d667946-e6f1-418b-9ad3-0e3689dfaaa7", "subject": "ATTACK:enterprise:S0586", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--7d667946-e6f1-418b-9ad3-0e3689dfaaa7", "modified": "2026-04-29T14:23:06.097Z", "references": [ { "source_name": "CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020", "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--7e6995cc-c917-4ac7-84e1-5dbf661f29cd", "subject": "ATTACK:enterprise:S0409", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--7e6995cc-c917-4ac7-84e1-5dbf661f29cd", "modified": "2026-04-29T14:23:06.098Z", "references": [ { "source_name": "Securelist Machete Aug 2014", "url": "https://securelist.com/el-machete/66108/" }, { "source_name": "Cylance Machete Mar 2017", "url": "https://threatvector.cylance.com/en_us/home/el-machete-malware-attacks-cut-through-latam.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--8023d964-9013-4f3d-962e-569b799a2991", "subject": "ATTACK:enterprise:S0235", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--8023d964-9013-4f3d-962e-569b799a2991", "modified": "2026-04-29T14:23:06.101Z", "references": [ { "source_name": "Lookout Dark Caracal Jan 2018", "url": "https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--80aab758-d3fc-4380-b114-e552bdace832", "subject": "ATTACK:enterprise:S0031", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--80aab758-d3fc-4380-b114-e552bdace832", "modified": "2026-04-29T14:23:06.101Z", "references": [ { "source_name": "FireEye APT30", "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--827bdd59-c6b9-43fe-9004-ab9a740e323a", "subject": "ATTACK:enterprise:S1213", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--827bdd59-c6b9-43fe-9004-ab9a740e323a", "modified": "2026-04-29T14:23:06.104Z", "references": [ { "source_name": "Cybereason LumaStealer Undated", "url": "https://www.cybereason.com/blog/threat-analysis-rise-of-lummastealer" }, { "source_name": "Netskope LummaStealer 2025", "url": "https://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--82826722-4278-438e-a8d0-5bd9fd117b2b", "subject": "ATTACK:enterprise:S0186", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--82826722-4278-438e-a8d0-5bd9fd117b2b", "modified": "2026-04-29T14:23:06.104Z", "references": [ { "source_name": "ClearSky Charming Kitten Dec 2017", "url": "http://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--828afc32-9874-40aa-b752-315c7623ffee", "subject": "ATTACK:enterprise:S0088", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--828afc32-9874-40aa-b752-315c7623ffee", "modified": "2026-04-29T14:23:06.104Z", "references": [ { "source_name": "Zscaler Kasidet", "url": "http://research.zscaler.com/2016/01/malicious-office-files-dropping-kasidet.html" }, { "source_name": "Microsoft Kasidet", "url": "http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Win32%2FKasidet" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--83561fd5-18cf-47df-a412-45614f3142bd", "subject": "ATTACK:enterprise:S0696", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--83561fd5-18cf-47df-a412-45614f3142bd", "modified": "2026-04-29T14:23:06.105Z", "references": [ { "source_name": "NTT Security Flagpro new December 2021", "url": "https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--850d1949-38bc-4cb2-be8f-22d249ebfaf5", "subject": "ATTACK:enterprise:S0340", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--850d1949-38bc-4cb2-be8f-22d249ebfaf5", "modified": "2026-04-29T14:23:06.107Z", "references": [ { "source_name": "Securelist Octopus Oct 2018", "url": "https://securelist.com/octopus-infested-seas-of-central-asia/88200/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--85482d65-d2ac-4d79-8ee4-da653e73aa8f", "subject": "ATTACK:enterprise:S0385", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--85482d65-d2ac-4d79-8ee4-da653e73aa8f", "modified": "2026-04-29T14:23:06.107Z", "references": [ { "source_name": "Fidelis njRAT June 2013", "url": "https://www.threatminer.org/_reports/2013/fta-1009---njrat-uncovered-1.pdf" }, { "source_name": "Trend Micro njRAT 2018", "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/autoit-compiled-worm-affecting-removable-media-delivers-fileless-version-of-bladabindi-njrat-backdoor/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--856db86a-62a6-4545-898f-7eb44924cfde", "subject": "ATTACK:enterprise:G1014", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--856db86a-62a6-4545-898f-7eb44924cfde", "modified": "2026-07-31T18:48:14.886Z", "references": [ { "source_name": "Bitdefender LuminousMoth July 2021", "url": "https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited" }, { "source_name": "Kaspersky LuminousMoth July 2021", "url": "https://securelist.com/apt-luminousmoth/103332/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--86b7352f-8cba-4a5e-ac0a-c79697d0bd25", "subject": "ATTACK:enterprise:S1021", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--86b7352f-8cba-4a5e-ac0a-c79697d0bd25", "modified": "2026-04-29T14:23:06.109Z", "references": [ { "source_name": "Zscaler Lyceum DnsSystem June 2022", "url": "https://www.zscaler.com/blogs/security-research/lyceum-net-dns-backdoor" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--8839b4ad-24cb-4ad3-a407-947f75591973", "subject": "ATTACK:enterprise:S0251", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--8839b4ad-24cb-4ad3-a407-947f75591973", "modified": "2026-04-29T14:23:06.111Z", "references": [ { "source_name": "ESET Zebrocy Nov 2018", "url": "https://www.welivesecurity.com/2018/11/20/sednit-whats-going-zebrocy/" }, { "source_name": "ESET Zebrocy May 2019", "url": "https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/" }, { "source_name": "Accenture SNAKEMACKEREL Nov 2018", "url": "https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--8904bd95-4844-4fe4-b6b6-47e4a4f8d85d", "subject": "ATTACK:enterprise:S0058", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--8904bd95-4844-4fe4-b6b6-47e4a4f8d85d", "modified": "2026-04-29T14:23:06.112Z", "references": [ { "source_name": "Baumgartner Naikon 2015", "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--8c359d18-06fc-4db1-9b58-6e85fa563066", "subject": "ATTACK:enterprise:S0128", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--8c359d18-06fc-4db1-9b58-6e85fa563066", "modified": "2026-04-29T14:23:06.117Z", "references": [ { "source_name": "Forcepoint Monsoon", "url": "https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--8d204453-9efc-4e91-8385-5be0e038a7e3", "subject": "ATTACK:enterprise:S9018", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--8d204453-9efc-4e91-8385-5be0e038a7e3", "modified": "2026-04-29T14:23:06.118Z", "references": [ { "source_name": "Palo Alto HeartCrypt DEC 2024", "url": "https://unit42.paloaltonetworks.com/packer-as-a-service-heartcrypt-malware/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--8f43c516-a7f0-4d72-82ae-cd9c8eda4ffc", "subject": "ATTACK:enterprise:S1228", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--8f43c516-a7f0-4d72-82ae-cd9c8eda4ffc", "modified": "2026-04-29T14:23:06.120Z", "references": [ { "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022", "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/" }, { "source_name": "CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024", "url": "https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/" }, { "source_name": "Lab52 MUSTANG PANDA PUBLOAD MAY 2023", "url": "https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/" }, { "source_name": "Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024", "url": "https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html" }, { "source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload", "url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--9020cfe5-99b4-48ba-ac48-bcf20697c575", "subject": "ATTACK:enterprise:S0608", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--9020cfe5-99b4-48ba-ac48-bcf20697c575", "modified": "2026-04-29T14:23:06.122Z", "references": [ { "source_name": "Trend Micro Conficker", "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/conficker" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--9158527d-c4f7-4088-89b1-d62dc35bf196", "subject": "ATTACK:enterprise:S9059", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--9158527d-c4f7-4088-89b1-d62dc35bf196", "modified": "2026-09-28T18:45:29.242Z", "references": [ { "source_name": "Mandiant_UNC1549_Feb2024", "url": "https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--91e4cb6a-abe6-46e0-8730-b80ba1cca16f", "subject": "ATTACK:enterprise:S1074", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--91e4cb6a-abe6-46e0-8730-b80ba1cca16f", "modified": "2026-04-29T14:23:06.124Z", "references": [ { "source_name": "Mandiant Suspected Turla Campaign February 2023", "url": "https://www.mandiant.com/resources/blog/turla-galaxy-opportunity" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--928977f5-9602-4020-b8e8-31a8e3881225", "subject": "ATTACK:enterprise:S0582", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--928977f5-9602-4020-b8e8-31a8e3881225", "modified": "2026-04-29T14:23:06.125Z", "references": [ { "source_name": "Proofpoint LookBack Malware Aug 2019", "url": "https://www.proofpoint.com/us/threat-insight/post/lookback-malware-targets-united-states-utilities-sector-phishing-attacks" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--96062ede-31e8-4777-8b81-39e8a9e8b88e", "subject": "ATTACK:enterprise:S0458", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--96062ede-31e8-4777-8b81-39e8a9e8b88e", "modified": "2026-04-29T14:23:06.130Z", "references": [ { "source_name": "Antiy CERT Ramsay April 2020", "url": "https://www.programmersought.com/article/62493896999/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--961ad537-4280-420a-8c1d-0bc32147949a", "subject": "ATTACK:enterprise:S1150", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--961ad537-4280-420a-8c1d-0bc32147949a", "modified": "2026-04-29T14:23:06.130Z", "references": [ { "source_name": "Microsoft Albanian Government Attacks September 2022", "url": "https://www.microsoft.com/en-us/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--969e4342-1635-4e0f-8855-47be84cddccf", "subject": "ATTACK:enterprise:S0250", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--969e4342-1635-4e0f-8855-47be84cddccf", "modified": "2026-04-29T14:23:06.130Z", "references": [ { "source_name": "MalwareBytes LazyScripter Feb 2021", "url": "https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--9992c76b-149d-4842-80b5-dbd37f0369be", "subject": "ATTACK:enterprise:G1016", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--9992c76b-149d-4842-80b5-dbd37f0369be", "modified": "2026-07-31T18:48:31.314Z", "references": [ { "source_name": "Mandiant FIN13 Aug 2022", "url": "https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--9a7ff784-436b-40c5-bfb0-25e02e1d9940", "subject": "ATTACK:enterprise:S0062", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--9a7ff784-436b-40c5-bfb0-25e02e1d9940", "modified": "2026-04-29T14:23:06.136Z", "references": [ { "source_name": "DustySky", "url": "https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--9c12e724-5f3e-4209-961e-481ec22a5ab6", "subject": "ATTACK:enterprise:S0030", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--9c12e724-5f3e-4209-961e-481ec22a5ab6", "modified": "2026-04-29T14:23:06.138Z", "references": [ { "source_name": "FireEye CARBANAK June 2017", "url": "https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--9c3459f4-8c8e-4650-bd21-ad506a1a3ee9", "subject": "ATTACK:enterprise:G1036", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--9c3459f4-8c8e-4650-bd21-ad506a1a3ee9", "modified": "2026-07-31T18:48:24.867Z", "references": [ { "source_name": "Microsoft Moonstone Sleet 2024", "url": "https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--9cf55e84-53d2-4ec9-aaed-1df38ea08af1", "subject": "ATTACK:enterprise:S0442", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--9cf55e84-53d2-4ec9-aaed-1df38ea08af1", "modified": "2026-04-29T14:23:06.139Z", "references": [ { "source_name": "Kaspersky Cloud Atlas August 2019", "url": "https://securelist.com/recent-cloud-atlas-activity/92016/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--9d757133-336a-491b-807b-5d8c1591cf45", "subject": "ATTACK:enterprise:S9051", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--9d757133-336a-491b-807b-5d8c1591cf45", "modified": "2026-09-23T21:16:38.815Z", "references": [ { "source_name": "CheckPointResearch_TheGentlemen_April2026", "url": "https://research.checkpoint.com/2026/dfir-report-the-gentlemen/" }, { "source_name": "MSTI_GentelmenRansomware_May2026", "url": "https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--a1956344-1a2d-4193-bb20-0f65c98776fe", "subject": "ATTACK:enterprise:G0106", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--a1956344-1a2d-4193-bb20-0f65c98776fe", "modified": "2026-07-31T18:47:52.499Z", "references": [ { "source_name": "Talos Rocke August 2018", "url": "https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--a29d9514-3284-4ac2-a93a-e17750519534", "subject": "ATTACK:enterprise:S0013", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--a29d9514-3284-4ac2-a93a-e17750519534", "modified": "2026-04-29T14:23:06.146Z", "references": [ { "source_name": "Eset PlugX Korplug Mustang Panda March 2022", "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/" }, { "source_name": "CIRCL PlugX March 2013", "url": "http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf" }, { "source_name": "DOJ Affidavit Search and Seizure PlugX December 2024", "url": "https://www.justice.gov/archives/opa/media/1384136/dl" }, { "source_name": "EclecticIQ Mustang Panda PlugX", "url": "https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware" }, { "source_name": "PWC Cloud Hopper Technical Annex April 2017", "url": "https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf" }, { "source_name": "Sophos Mustang Panda PLUGX", "url": "https://www.secureworks.com/blog/bronze-president-targets-government-officials" }, { "source_name": "Lastline PlugX Analysis", "url": "https://lastline3.rssing.com/chan-29044929/all_p1.html#c29044929a2" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--a2aaa018-7bcc-4ec1-b27e-c6672e390c32", "subject": "ATTACK:enterprise:S1242", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--a2aaa018-7bcc-4ec1-b27e-c6672e390c32", "modified": "2026-04-29T14:23:06.146Z", "references": [ { "source_name": "Halcyon Qilin.B OCT 2024", "url": "https://www.halcyon.ai/blog/new-qilin-b-ransomware-variant-boasts-enhanced-encryption-and-defense-evasion" }, { "source_name": "Trend Micro Agenda Ransomware AUG 2022", "url": "https://www.trendmicro.com/en_us/research/22/h/new-golang-ransomware-agenda-customizes-attacks.html" }, { "source_name": "Cisco Talos Qilin Ransomware OCT 2025", "url": "https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--a307922f-1cd2-4f95-aaa4-dcd40a8fcaab", "subject": "ATTACK:enterprise:S0631", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--a307922f-1cd2-4f95-aaa4-dcd40a8fcaab", "modified": "2026-04-29T14:23:06.147Z", "references": [ { "source_name": "Cybereason Chaes Nov 2020", "url": "https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--a7ad3949-0d4d-49a8-a2cd-3a0d5857ba92", "subject": "ATTACK:enterprise:S1018", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--a7ad3949-0d4d-49a8-a2cd-3a0d5857ba92", "modified": "2026-04-29T14:23:06.153Z", "references": [ { "source_name": "Malwarebytes Saint Bot April 2021", "url": "https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/" }, { "source_name": "Palo Alto Unit 42 OutSteel SaintBot February 2022 ", "url": "https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--aa4038e3-451f-4ad7-acc7-5c971825967b", "subject": "ATTACK:enterprise:G0021", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--aa4038e3-451f-4ad7-acc7-5c971825967b", "modified": "2026-07-31T18:48:23.799Z", "references": [ { "source_name": "Kaspersky MoleRATs April 2019", "url": "https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--ab1d783b-d6b3-439c-a5f4-701a8cae4c6a", "subject": "ATTACK:enterprise:S0662", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--ab1d783b-d6b3-439c-a5f4-701a8cae4c6a", "modified": "2026-04-29T14:23:06.158Z", "references": [ { "source_name": "Profero APT27 December 2020", "url": "https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf" }, { "source_name": "Trend Micro DRBControl February 2020", "url": "https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--ab2b2cd2-9f20-4497-a6d3-ef1698809779", "subject": "ATTACK:enterprise:S0032", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--ab2b2cd2-9f20-4497-a6d3-ef1698809779", "modified": "2026-04-29T14:23:06.158Z", "references": [ { "source_name": "Nccgroup Gh0st April 2018", "url": "https://research.nccgroup.com/2018/04/17/decoding-network-data-from-a-gh0st-rat-variant/" }, { "source_name": "Gh0stRAT ATT March 2019", "url": "https://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--ab322e5c-dfd2-45dd-bee1-59aec9d1d840", "subject": "ATTACK:enterprise:S0414", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--ab322e5c-dfd2-45dd-bee1-59aec9d1d840", "modified": "2026-04-29T14:23:06.158Z", "references": [ { "source_name": "CISA AA20-301A Kimsuky", "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-301a" }, { "source_name": "Unit42 BabyShark Feb 2019", "url": "https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--aeaa2f37-4014-4313-9fe2-8616b352a90c", "subject": "ATTACK:enterprise:S0004", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--aeaa2f37-4014-4313-9fe2-8616b352a90c", "modified": "2026-04-29T14:23:06.163Z", "references": [ { "source_name": "Cylance Cleaver", "url": "https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--aeb0762f-0d0e-43b8-be6f-413f60097e02", "subject": "ATTACK:enterprise:S0334", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--aeb0762f-0d0e-43b8-be6f-413f60097e02", "modified": "2026-04-29T14:23:06.163Z", "references": [ { "source_name": "TrendMicro DarkComet Sept 2014", "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/DARKCOMET" }, { "source_name": "Malwarebytes DarkComet March 2018", "url": "https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--afa1f53f-abd9-4e57-b4e1-4e161dd34e9b", "subject": "ATTACK:enterprise:S0145", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--afa1f53f-abd9-4e57-b4e1-4e161dd34e9b", "modified": "2026-04-29T14:23:06.164Z", "references": [ { "source_name": "Cisco DNSMessenger March 2017", "url": "http://blog.talosintelligence.com/2017/03/dnsmessenger.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--afbd40b8-5dde-4758-809f-ea0a21a7dca6", "subject": "ATTACK:enterprise:S1182", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--afbd40b8-5dde-4758-809f-ea0a21a7dca6", "modified": "2026-04-29T14:23:06.165Z", "references": [ { "source_name": "Cisco MagicRAT 2022", "url": "https://blog.talosintelligence.com/lazarus-magicrat/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--b1bb8990-c773-46aa-8415-b69028d1b4a9", "subject": "ATTACK:enterprise:G1055", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--b1bb8990-c773-46aa-8415-b69028d1b4a9", "modified": "2026-07-31T18:48:25.887Z", "references": [ { "source_name": "FBI IC3 Flash VOID MANTICORE Handala Hack March 2026", "url": "https://www.ic3.gov/CSA/2026/260320.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--b228cc3b-a428-42e4-b6f3-994fe790e329", "subject": "ATTACK:enterprise:S0345", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--b228cc3b-a428-42e4-b6f3-994fe790e329", "modified": "2026-04-29T14:23:06.168Z", "references": [ { "source_name": "McAfee Oceansalt Oct 2018", "url": "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-oceansalt.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--b26fc06b-507b-4fbd-bf07-b4e880ac85ab", "subject": "ATTACK:enterprise:S1027", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--b26fc06b-507b-4fbd-bf07-b4e880ac85ab", "modified": "2026-04-29T14:23:06.169Z", "references": [ { "source_name": "SentinelOne Aoqin Dragon June 2022", "url": "https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--b28c7fbf-05c6-4be2-9f17-3dcc722cee7c", "subject": "ATTACK:enterprise:S0247", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--b28c7fbf-05c6-4be2-9f17-3dcc722cee7c", "modified": "2026-04-29T14:23:06.169Z", "references": [ { "source_name": "Talos NavRAT May 2018", "url": "https://blog.talosintelligence.com/2018/05/navrat.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--b5baa306-e027-4000-9338-0d9df55c5040", "subject": "ATTACK:enterprise:C0013", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--b5baa306-e027-4000-9338-0d9df55c5040", "modified": "2026-07-31T18:47:20.320Z", "references": [ { "source_name": "McAfee Sharpshooter December 2018", "url": "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--baca2e38-a6fa-430e-a829-7afc5537e45f", "subject": "ATTACK:enterprise:S0254", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--baca2e38-a6fa-430e-a829-7afc5537e45f", "modified": "2026-04-29T14:23:06.180Z", "references": [ { "source_name": "Rancor Unit42 June 2018", "url": "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--bc7382dc-b2d0-4bd3-9e7d-f49cf17e7fc1", "subject": "ATTACK:enterprise:S0259", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--bc7382dc-b2d0-4bd3-9e7d-f49cf17e7fc1", "modified": "2026-04-29T14:23:06.182Z", "references": [ { "source_name": "ASERT InnaputRAT April 2018", "url": "https://asert.arbornetworks.com/innaput-actors-utilize-remote-access-trojan-since-2016-presumably-targeting-victim-files/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--bcdbb8dc-87e5-4f29-8ff2-d660e53015cb", "subject": "ATTACK:enterprise:S0053", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--bcdbb8dc-87e5-4f29-8ff2-d660e53015cb", "modified": "2026-04-29T14:23:06.183Z", "references": [ { "source_name": "Unit 42 SeaDuke 2015", "url": "http://researchcenter.paloaltonetworks.com/2015/07/unit-42-technical-analysis-seaduke/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--bce14354-c728-417c-b2d2-2d62e9c57300", "subject": "ATTACK:enterprise:S9060", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--bce14354-c728-417c-b2d2-2d62e9c57300", "modified": "2026-10-01T21:14:17.355Z", "references": [ { "source_name": "Mandiant_UNC1549_Feb2024", "url": "https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--bd5bc949-6b6b-4511-87f7-3a439a4681da", "subject": "ATTACK:enterprise:G0080", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--bd5bc949-6b6b-4511-87f7-3a439a4681da", "modified": "2026-07-31T18:48:23.323Z", "references": [ { "source_name": "Group IB Cobalt Aug 2017", "url": "https://www.group-ib.com/blog/cobalt" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--bdbd9cce-7d32-4e87-8036-3e602a3783b9", "subject": "ATTACK:enterprise:S0417", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--bdbd9cce-7d32-4e87-8036-3e602a3783b9", "modified": "2026-04-29T14:23:06.185Z", "references": [ { "source_name": "SecureList Griffon May 2019", "url": "https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--be24db0e-1ae0-4478-9b83-7d40d0f0a1c0", "subject": "ATTACK:enterprise:S1247", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--be24db0e-1ae0-4478-9b83-7d40d0f0a1c0", "modified": "2026-04-29T14:23:06.185Z", "references": [ { "source_name": "ESET Embargo Ransomware October 2024", "url": "https://www.welivesecurity.com/en/eset-research/embargo-ransomware-rocknrust/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--c0561e30-556b-486b-a7fa-1be6feece584", "subject": "ATTACK:enterprise:G0129", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--c0561e30-556b-486b-a7fa-1be6feece584", "modified": "2026-07-31T18:47:53.281Z", "references": [ { "source_name": "EclecticIQ Mustang Panda PlugX", "url": "https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware" }, { "source_name": "Proofpoint TA416 November 2020", "url": "https://www.proofpoint.com/us/blog/threat-insight/ta416-goes-ground-and-returns-golang-plugx-malware-loader" }, { "source_name": "Sophos Mustang Panda PLUGX", "url": "https://www.secureworks.com/blog/bronze-president-targets-government-officials" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--c0792868-a5da-4486-9b3b-cefbc2667e54", "subject": "ATTACK:enterprise:G0126", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--c0792868-a5da-4486-9b3b-cefbc2667e54", "modified": "2026-07-31T18:47:56.822Z", "references": [ { "source_name": "Malwarebytes Higaisa 2020", "url": "https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/" }, { "source_name": "Zscaler Higaisa 2020", "url": "https://www.zscaler.com/blogs/security-research/return-higaisa-apt" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--c1421d39-cb5d-4bac-a931-9c641066c0fd", "subject": "ATTACK:enterprise:S0018", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--c1421d39-cb5d-4bac-a931-9c641066c0fd", "modified": "2026-04-29T14:23:06.189Z", "references": [ { "source_name": "Blasco 2013", "url": "http://www.alienvault.com/open-threat-exchange/blog/new-sykipot-developments" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--c28ef21a-d62b-45de-8cda-e80f0cb3accf", "subject": "ATTACK:enterprise:S9020", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--c28ef21a-d62b-45de-8cda-e80f0cb3accf", "modified": "2026-04-29T14:23:06.191Z", "references": [ { "source_name": "ESET MirrorFace DEC 2022", "url": "https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/" }, { "source_name": "Trend Micro Earth Kasha NOV 2024", "url": "https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--c3e633f5-857d-45a9-86f1-8c71ac484cc7", "subject": "ATTACK:enterprise:G1059", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--c3e633f5-857d-45a9-86f1-8c71ac484cc7", "modified": "2026-10-01T19:28:40.029Z", "references": [ { "source_name": "CheckPoint_NimbusManticoreEurope_Sept2025", "url": "https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/" }, { "source_name": "Mandiant_UNC1549_Feb2024", "url": "https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--c5ae9551-e756-4b8b-9b78-515eba60acf5", "subject": "ATTACK:enterprise:G0094", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--c5ae9551-e756-4b8b-9b78-515eba60acf5", "modified": "2026-07-31T20:48:25.471Z", "references": [ { "source_name": "Talos Kimsuky Nov 2021", "url": "https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html" }, { "source_name": "CISA AA20-301A Kimsuky", "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-301a" }, { "source_name": "Crowdstrike GTR2020 Mar 2020", "url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf" }, { "source_name": "KISA Operation Muzabi", "url": "https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf" }, { "source_name": "Securelist Kimsuky Sept 2013", "url": "https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--c5fa4766-4468-4afd-9b5f-5ce4f443729d", "subject": "ATTACK:enterprise:S0113", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--c5fa4766-4468-4afd-9b5f-5ce4f443729d", "modified": "2026-04-29T14:23:06.196Z", "references": [ { "source_name": "ESET Operation Groundbait", "url": "http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--c6d4f484-bb75-4012-b756-f043e962aaa6", "subject": "ATTACK:enterprise:G0035", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--c6d4f484-bb75-4012-b756-f043e962aaa6", "modified": "2026-07-31T20:48:28.656Z", "references": [ { "source_name": "US-CERT TA18-074A", "url": "https://www.us-cert.gov/ncas/alerts/TA18-074A" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--c75cc595-79d7-4a77-9647-d2323aad93d0", "subject": "ATTACK:enterprise:S0159", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--c75cc595-79d7-4a77-9647-d2323aad93d0", "modified": "2026-04-29T14:23:06.198Z", "references": [ { "source_name": "FireEye APT10 April 2017", "url": "https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--c9768a3e-1556-488e-8a9e-55389fd1752e", "subject": "ATTACK:enterprise:S0663", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--c9768a3e-1556-488e-8a9e-55389fd1752e", "modified": "2026-04-29T14:23:06.201Z", "references": [ { "source_name": "Trend Micro Iron Tiger April 2021", "url": "https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--cab93d90-f8de-4bb3-8868-11b8d9a2ddf9", "subject": "ATTACK:enterprise:S0439", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--cab93d90-f8de-4bb3-8868-11b8d9a2ddf9", "modified": "2026-04-29T14:23:06.202Z", "references": [ { "source_name": "ESET Okrum July 2019", "url": "https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--cabd44af-9804-4f83-98e0-927719057a62", "subject": "ATTACK:enterprise:S0483", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--cabd44af-9804-4f83-98e0-927719057a62", "modified": "2026-04-29T14:23:06.202Z", "references": [ { "source_name": "IBM IcedID November 2017", "url": "https://securityintelligence.com/new-banking-trojan-icedid-discovered-by-ibm-x-force-research/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--cb3117b7-3679-424d-bfb4-b28699cbba02", "subject": "ATTACK:enterprise:G0140", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--cb3117b7-3679-424d-bfb4-b28699cbba02", "modified": "2026-07-31T18:48:13.675Z", "references": [ { "source_name": "MalwareBytes LazyScripter Feb 2021", "url": "https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--cb62e9ed-6a69-439b-865a-bcda20c8a5e3", "subject": "ATTACK:enterprise:S1230", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--cb62e9ed-6a69-439b-865a-bcda20c8a5e3", "modified": "2026-04-29T14:23:06.203Z", "references": [ { "source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA", "url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan" }, { "source_name": "Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024", "url": "https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--cb69898b-b5e4-407a-964d-a13149accdd7", "subject": "ATTACK:enterprise:S0228", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--cb69898b-b5e4-407a-964d-a13149accdd7", "modified": "2026-04-29T14:23:06.203Z", "references": [ { "source_name": "fsecure NanHaiShu July 2016", "url": "https://www.f-secure.com/documents/996508/1030745/nanhaishu_whitepaper.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--cba3f208-4db7-486b-adb1-311910b0382d", "subject": "ATTACK:enterprise:S0635", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--cba3f208-4db7-486b-adb1-311910b0382d", "modified": "2026-04-29T14:23:06.204Z", "references": [ { "source_name": "MSTIC Nobelium Toolset May 2021", "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--cc55ad3c-601b-4549-b080-adbde6b98629", "subject": "ATTACK:enterprise:G0082", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--cc55ad3c-601b-4549-b080-adbde6b98629", "modified": "2026-09-30T21:22:11.379Z", "references": [ { "source_name": "Microsoft Axios Compromise APR 2026", "url": "https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/" }, { "source_name": "MIcrosoft Mastra npm Compromise JUN 2026", "url": "https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--cc705bf0-ba29-443e-9cd5-aef247505210", "subject": "ATTACK:enterprise:G0022", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--cc705bf0-ba29-443e-9cd5-aef247505210", "modified": "2026-07-31T18:47:38.193Z", "references": [ { "source_name": "FireEye Operation Double Tap", "url": "https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--cd1e409b-e981-4c83-a9ea-86705a45f92c", "subject": "ATTACK:enterprise:S0152", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--cd1e409b-e981-4c83-a9ea-86705a45f92c", "modified": "2026-04-29T14:23:06.206Z", "references": [ { "source_name": "PWC Cloud Hopper Technical Annex April 2017", "url": "https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--cd2a7854-1339-4f40-8ba1-be032dc5249e", "subject": "ATTACK:enterprise:S0089", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--cd2a7854-1339-4f40-8ba1-be032dc5249e", "modified": "2026-04-29T14:23:06.206Z", "references": [ { "source_name": "F-Secure BlackEnergy 2014", "url": "https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--cf58d726-7674-4cdc-9ce1-9d7364aa4a0d", "subject": "ATTACK:enterprise:S1025", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--cf58d726-7674-4cdc-9ce1-9d7364aa4a0d", "modified": "2026-04-29T14:23:06.209Z", "references": [ { "source_name": "Korean FSI TA505 2020", "url": "https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory=" }, { "source_name": "BlackBerry Amadey 2020", "url": "https://blogs.blackberry.com/en/2020/01/threat-spotlight-amadey-bot" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--cfda1087-90e8-46f3-9751-06e2140f2f2c", "subject": "ATTACK:enterprise:S0640", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--cfda1087-90e8-46f3-9751-06e2140f2f2c", "modified": "2026-04-29T14:23:06.210Z", "references": [ { "source_name": "Arxiv Avaddon Feb 2021", "url": "https://arxiv.org/pdf/2102.04796.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--d021d378-a5ff-4020-972c-cc9152e824b0", "subject": "ATTACK:enterprise:G0012", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--d021d378-a5ff-4020-972c-cc9152e824b0", "modified": "2026-07-31T18:48:12.087Z", "references": [ { "source_name": "Kaspersky Darkhotel", "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070903/darkhotel_kl_07.11.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--d02d208e-2b9a-4613-bc89-df3953ad9576", "subject": "ATTACK:enterprise:S0561", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--d02d208e-2b9a-4613-bc89-df3953ad9576", "modified": "2026-04-29T14:23:06.210Z", "references": [ { "source_name": "Unit 42 NETWIRE April 2020", "url": "https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--d067b113-4584-419f-860b-d3184f734350", "subject": "ATTACK:enterprise:S0085", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--d067b113-4584-419f-860b-d3184f734350", "modified": "2026-04-29T14:23:06.211Z", "references": [ { "source_name": "Cylance Dust Storm", "url": "https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--d15c3d84-9e21-41ac-9728-f97183b63ec6", "subject": "ATTACK:enterprise:G0064", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--d15c3d84-9e21-41ac-9728-f97183b63ec6", "modified": "2026-07-31T20:48:53.244Z", "references": [ { "source_name": "Symantec Elfin Mar 2019", "url": "https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage" }, { "source_name": "Microsoft Holmium June 2020", "url": "https://www.microsoft.com/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--d20b659b-3595-4171-9beb-668ab26bf398", "subject": "ATTACK:enterprise:G0060", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--d20b659b-3595-4171-9beb-668ab26bf398", "modified": "2026-07-31T18:48:10.908Z", "references": [ { "source_name": "Secureworks BRONZE BUTLER Oct 2017", "url": "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--d38177b0-03c0-4c59-afa6-eea94a372daa", "subject": "ATTACK:enterprise:S0192", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--d38177b0-03c0-4c59-afa6-eea94a372daa", "modified": "2026-04-29T14:23:06.214Z", "references": [ { "source_name": "GitHub Pupy", "url": "https://github.com/n1nj4sec/pupy" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--d490bb02-7dfc-4808-8109-29a3871f830a", "subject": "ATTACK:enterprise:S0244", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--d490bb02-7dfc-4808-8109-29a3871f830a", "modified": "2026-04-29T14:23:06.216Z", "references": [ { "source_name": "Palo Alto Comnie", "url": "https://researchcenter.paloaltonetworks.com/2018/01/unit42-comnie-continues-target-organizations-east-asia/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--d5e9478c-439e-4ec5-8317-6d769dedc68a", "subject": "ATTACK:enterprise:S0491", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--d5e9478c-439e-4ec5-8317-6d769dedc68a", "modified": "2026-09-03T14:50:24.114Z", "references": [ { "source_name": "Talos Promethium June 2020", "url": "https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--d7c2abc3-4f02-438f-b146-731351135075", "subject": "ATTACK:enterprise:G1043", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--d7c2abc3-4f02-438f-b146-731351135075", "modified": "2026-07-31T18:47:36.570Z", "references": [ { "source_name": "Microsoft BlackByte 2023", "url": "https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--d7f1b78b-824d-4ddc-a4cc-3fd44d07c4d3", "subject": "ATTACK:enterprise:S1160", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--d7f1b78b-824d-4ddc-a4cc-3fd44d07c4d3", "modified": "2026-04-29T14:23:06.220Z", "references": [ { "source_name": "Latrodectus APR 2024", "url": "https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--d97c5cd6-97e9-4684-a598-1e31406c7e2c", "subject": "ATTACK:enterprise:G1039", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--d97c5cd6-97e9-4684-a598-1e31406c7e2c", "modified": "2026-07-31T18:48:06.477Z", "references": [ { "source_name": "group-ib_redcurl1", "url": "https://www.group-ib.com/resources/research-hub/red-curl/" }, { "source_name": "group-ib_redcurl2", "url": "https://www.group-ib.com/resources/research-hub/red-curl-2/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--daa688cf-80e7-4529-8456-332a7f42fa50", "subject": "ATTACK:enterprise:S1245", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--daa688cf-80e7-4529-8456-332a7f42fa50", "modified": "2026-04-29T14:23:06.224Z", "references": [ { "source_name": "Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024", "url": "https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--db6220f4-9e1c-487c-9b8d-e016565817e3", "subject": "ATTACK:enterprise:S0330", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--db6220f4-9e1c-487c-9b8d-e016565817e3", "modified": "2026-04-29T14:23:06.225Z", "references": [ { "source_name": "Talos Zeus Panda Nov 2017", "url": "https://blog.talosintelligence.com/2017/11/zeus-panda-campaign.html#More" }, { "source_name": "GDATA Zeus Panda June 2017", "url": "https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--dcb733f7-0b36-4b25-82d4-c332810562a7", "subject": "ATTACK:enterprise:G0004", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--dcb733f7-0b36-4b25-82d4-c332810562a7", "modified": "2026-07-31T18:48:01.811Z", "references": [ { "source_name": "NCC Group APT15 Alive and Strong", "url": "https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--dcc2c503-25dc-47bb-b9cb-35ce27e73cd2", "subject": "ATTACK:enterprise:S0137", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--dcc2c503-25dc-47bb-b9cb-35ce27e73cd2", "modified": "2026-04-29T14:23:06.227Z", "references": [ { "source_name": "Microsoft SIR Vol 19", "url": "http://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--dd417d31-d129-44ac-8a9f-b14b79235dfa", "subject": "ATTACK:enterprise:S0336", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--dd417d31-d129-44ac-8a9f-b14b79235dfa", "modified": "2026-04-29T14:23:06.227Z", "references": [ { "source_name": "Cofense NanoCore Mar 2018", "url": "https://web.archive.org/web/20240522112705/https://cofense.com/blog/nanocore-rat-resurfaced-sewers/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--dd6eca67-574c-433a-8764-12cc802a0387", "subject": "ATTACK:enterprise:S0692", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--dd6eca67-574c-433a-8764-12cc802a0387", "modified": "2026-04-29T14:23:06.227Z", "references": [ { "source_name": "GitHub SILENTTRINITY Modules July 2019", "url": "https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--decc0aea-70d2-42b8-8529-3049b9f5937f", "subject": "ATTACK:enterprise:G0142", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--decc0aea-70d2-42b8-8529-3049b9f5937f", "modified": "2026-07-31T20:48:37.659Z", "references": [ { "source_name": "Uptycs Confucius APT Jan 2021", "url": "https://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--df05fecd-1eee-4139-8090-794a3310b478", "subject": "ATTACK:enterprise:S0348", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--df05fecd-1eee-4139-8090-794a3310b478", "modified": "2026-04-29T14:23:06.229Z", "references": [ { "source_name": "PaloAlto CardinalRat Apr 2017", "url": "https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--e039ba9f-a7d1-45a9-8ebc-d75fb31f4baa", "subject": "ATTACK:enterprise:S1145", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--e039ba9f-a7d1-45a9-8ebc-d75fb31f4baa", "modified": "2026-04-29T14:23:06.231Z", "references": [ { "source_name": "Zscaler Pikabot 2023", "url": "https://www.zscaler.com/blogs/security-research/technical-analysis-pikabot" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--e10a8253-29d9-438b-bf10-3167d4f85fe8", "subject": "ATTACK:enterprise:S1207", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--e10a8253-29d9-438b-bf10-3167d4f85fe8", "modified": "2026-04-29T14:23:06.232Z", "references": [ { "source_name": "Google XLoader 2017", "url": "https://cloud.google.com/blog/topics/threat-intelligence/formbook-malware-distribution-campaigns/" }, { "source_name": "Zscaler XLoader 2025", "url": "https://www.zscaler.com/blogs/security-research/technical-analysis-xloader-versions-6-and-7-part-1" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--e168a29f-c975-4ae9-8ab9-470bb03ae706", "subject": "ATTACK:enterprise:S0446", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--e168a29f-c975-4ae9-8ab9-470bb03ae706", "modified": "2026-04-29T14:23:06.232Z", "references": [ { "source_name": "CrowdStrike Ryuk January 2019", "url": "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--e1cf08cf-e483-44a1-bdfe-cdfa424d69e5", "subject": "ATTACK:enterprise:S0622", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--e1cf08cf-e483-44a1-bdfe-cdfa424d69e5", "modified": "2026-04-29T14:23:06.233Z", "references": [ { "source_name": "Malwarebytes Kimsuky June 2021", "url": "https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--e4465d76-d212-4f14-8493-c9c5d7c8a6f4", "subject": "ATTACK:enterprise:S0371", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--e4465d76-d212-4f14-8493-c9c5d7c8a6f4", "modified": "2026-04-29T14:23:06.236Z", "references": [ { "source_name": "FireEye APT33 Guardrail", "url": "https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--e47f03aa-09b3-45a2-927d-b2cd96e7c444", "subject": "ATTACK:enterprise:G0026", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--e47f03aa-09b3-45a2-927d-b2cd96e7c444", "modified": "2026-07-31T18:47:50.936Z", "references": [ { "source_name": "Anomali Evasive Maneuvers July 2015", "url": "https://www.anomali.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop" }, { "source_name": "PaloAlto DNS Requests May 2016", "url": "https://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--e73d4586-569d-4f32-9468-95777d65770a", "subject": "ATTACK:enterprise:S0256", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--e73d4586-569d-4f32-9468-95777d65770a", "modified": "2026-04-29T14:23:06.240Z", "references": [ { "source_name": "ESET Turla Mosquito Jan 2018", "url": "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--e772ce2d-bc2b-4e7f-af67-700737c75d2c", "subject": "ATTACK:enterprise:S0373", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--e772ce2d-bc2b-4e7f-af67-700737c75d2c", "modified": "2026-04-29T14:23:06.240Z", "references": [ { "source_name": "Cofense Astaroth Sept 2018", "url": "https://web.archive.org/web/20200302071436/https://cofense.com/seeing-resurgence-demonic-astaroth-wmic-trojan/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--e7f60c3a-5b9e-4175-8bac-72773f580dad", "subject": "ATTACK:enterprise:S0428", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--e7f60c3a-5b9e-4175-8bac-72773f580dad", "modified": "2026-04-29T14:23:06.241Z", "references": [ { "source_name": "Talos PoetRAT April 2020", "url": "https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--e84c3f01-fb77-40e6-8507-42bc500bd928", "subject": "ATTACK:enterprise:S0266", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--e84c3f01-fb77-40e6-8507-42bc500bd928", "modified": "2026-04-29T14:23:06.241Z", "references": [ { "source_name": "ESET Trickbot Oct 2020", "url": "https://www.welivesecurity.com/2020/10/12/eset-takes-part-global-operation-disrupt-trickbot/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--e84ffff2-59d1-4655-8fbe-b97bbf8e2f9f", "subject": "ATTACK:enterprise:G1052", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--e84ffff2-59d1-4655-8fbe-b97bbf8e2f9f", "modified": "2026-07-31T18:47:54.951Z", "references": [ { "source_name": "Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024", "url": "https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--e888ca4d-7970-4f35-a7f1-a2f9a14b2f22", "subject": "ATTACK:enterprise:S9032", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--e888ca4d-7970-4f35-a7f1-a2f9a14b2f22", "modified": "2026-04-29T14:23:06.242Z", "references": [ { "source_name": "ESET_MuddyWater_Dec2025", "url": "https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--eaed4cbc-d5d1-4274-af09-62d98ae1afc7", "subject": "ATTACK:enterprise:S0267", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--eaed4cbc-d5d1-4274-af09-62d98ae1afc7", "modified": "2026-04-29T14:23:06.245Z", "references": [ { "source_name": "ESET GreyEnergy Oct 2018", "url": "https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--ed2f811d-3258-4489-abe1-57dac4bdbbf8", "subject": "ATTACK:enterprise:S0153", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--ed2f811d-3258-4489-abe1-57dac4bdbbf8", "modified": "2026-04-29T14:23:06.248Z", "references": [ { "source_name": "Accenture Hogfish April 2018", "url": "http://web.archive.org/web/20220810112638/https:/www.accenture.com/t20180423T055005Z_w_/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf" }, { "source_name": "PWC Cloud Hopper Technical Annex April 2017", "url": "https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--f0b00a47-9d63-4d05-b771-022a21a4ed06", "subject": "ATTACK:enterprise:S0139", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--f0b00a47-9d63-4d05-b771-022a21a4ed06", "modified": "2026-04-29T14:23:06.252Z", "references": [ { "source_name": "Volexity PowerDuke November 2016", "url": "https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--f1796f08-a663-4189-8bdc-a89ecc13df57", "subject": "ATTACK:enterprise:S0669", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--f1796f08-a663-4189-8bdc-a89ecc13df57", "modified": "2026-04-29T14:23:06.253Z", "references": [ { "source_name": "MalwareBytes LazyScripter Feb 2021", "url": "https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--f2d0fd0d-7bfc-4f3e-bd78-2d691c476046", "subject": "ATTACK:enterprise:G0047", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--f2d0fd0d-7bfc-4f3e-bd78-2d691c476046", "modified": "2026-07-31T18:47:48.185Z", "references": [ { "source_name": "ESET Gamaredon June 2020", "url": "https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/" }, { "source_name": "CERT-EE Gamaredon January 2021", "url": "https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf" }, { "source_name": "TrendMicro Gamaredon April 2020", "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/" }, { "source_name": "ESET Gamaredon Sept2024", "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf" }, { "source_name": "unit42_gamaredon_dec2022", "url": "https://unit42.paloaltonetworks.com/trident-ursa/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--f2d1bf8c-6541-40af-8c84-48c7570fb50b", "subject": "ATTACK:enterprise:S0199", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--f2d1bf8c-6541-40af-8c84-48c7570fb50b", "modified": "2026-04-29T14:23:06.255Z", "references": [ { "source_name": "CyberBit Early Bird Apr 2018", "url": "https://www.cyberbit.com/blog/endpoint-security/new-early-bird-code-injection-technique-discovered/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--f373c8d3-3182-4977-b333-87493458d340", "subject": "ATTACK:enterprise:S0534", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--f373c8d3-3182-4977-b333-87493458d340", "modified": "2026-04-29T14:23:06.256Z", "references": [ { "source_name": "Cybereason Bazar July 2020", "url": "https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles" }, { "source_name": "NCC Group Team9 June 2020", "url": "https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--f38fa132-2485-45aa-ad86-4608595adb65", "subject": "ATTACK:enterprise:S1026", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--f38fa132-2485-45aa-ad86-4608595adb65", "modified": "2026-04-29T14:23:06.256Z", "references": [ { "source_name": "SentinelOne Aoqin Dragon June 2022", "url": "https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--f3cc3739-9dea-41c9-ac82-038b9c92bdb0", "subject": "ATTACK:enterprise:G0102", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--f3cc3739-9dea-41c9-ac82-038b9c92bdb0", "modified": "2026-07-31T20:48:50.607Z", "references": [ { "source_name": "DHS/CISA Ransomware Targeting Healthcare October 2020", "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-302a" }, { "source_name": "FireEye KEGTAP SINGLEMALT October 2020", "url": "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--f4a0f496-b47c-4bdf-affb-b57fb17203db", "subject": "ATTACK:enterprise:G0050", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--f4a0f496-b47c-4bdf-affb-b57fb17203db", "modified": "2026-07-31T18:47:46.054Z", "references": [ { "source_name": "Cybereason Oceanlotus May 2017", "url": "https://www.cybereason.com/blog/operation-cobalt-kitty-apt" }, { "source_name": "Cybereason Cobalt Kitty 2017", "url": "https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf" }, { "source_name": "ESET OceanLotus Mar 2019", "url": "https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--f5a39799-22d3-42e6-b524-bd93744b0149", "subject": "ATTACK:enterprise:S0500", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--f5a39799-22d3-42e6-b524-bd93744b0149", "modified": "2026-04-29T14:23:06.259Z", "references": [ { "source_name": "Secureworks MCMD July 2019", "url": "https://www.secureworks.com/research/mcmd-malware-analysis" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--f696324d-7fb4-44ca-82dd-3385b55fbb80", "subject": "ATTACK:enterprise:S0081", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--f696324d-7fb4-44ca-82dd-3385b55fbb80", "modified": "2026-04-29T14:23:06.260Z", "references": [ { "source_name": "Accenture Dragonfish Jan 2018", "url": "https://web.archive.org/web/20190508165226/https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf" }, { "source_name": "Lotus Blossom Jun 2015", "url": "https://www.paloaltonetworks.com/resources/research/unit42-operation-lotus-blossom.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--f8f21a3f-8bc7-49ee-a602-80df0e5e8bf4", "subject": "ATTACK:enterprise:S0011", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--f8f21a3f-8bc7-49ee-a602-80df0e5e8bf4", "modified": "2026-04-29T14:23:06.263Z", "references": [ { "source_name": "TrendMicro Taidoor", "url": "http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the_taidoor_campaign.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--fe86edf0-d69f-48bc-bdb7-7fd8a8dbcb82", "subject": "ATTACK:enterprise:S0270", "predicate": "uses", "object": "ATTACK:enterprise:T1547.001", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--fe86edf0-d69f-48bc-bdb7-7fd8a8dbcb82", "modified": "2026-04-29T14:23:06.271Z", "references": [ { "source_name": "Unit 42 DarkHydrus July 2018", "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 } ], "source_snapshot": { "file": "enterprise-attack-20.0.json", "url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "sha256": "81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352", "bytes": 55271014, "checked_at": "2026-10-16T03:31:39Z" }, "notices_url": "https://aol.pm/source-notices.txt", "notices": "License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n" } License ------- The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. "© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation." Disclaimers ----------- MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or variations on existing techniques not documented by ATT&CK. ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.