{"record":{"id":"ATTACK:enterprise:T1566.002","title":"Spearphishing Link","type":"Subtechnique","source_url":"https://attack.mitre.org/techniques/T1566/002","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--2b742742-28c3-4e1b-bab7-8350d6300fa7","external_id":"T1566.002","domain":"enterprise","created":"2020-03-02T19:15:44.182Z","modified":"2026-09-11T19:55:38.427Z","version":"2.8","aliases":[],"tactics":["initial-access"],"source_references":[{"source_name":"ACSC Email Spoofing","url":"https://web.archive.org/web/20210708014107/https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf"},{"source_name":"CISA IDN ST05-016","url":"https://us-cert.cisa.gov/ncas/tips/ST05-016"},{"source_name":"Trend Micro Pawn Storm OAuth 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-abuses-open-authentication-advanced-social-engineering-attacks"},{"source_name":"Netskope Device Code Phishing 2021","url":"https://www.netskope.com/blog/new-phishing-attacks-exploiting-oauth-authorization-flows-part-1"},{"source_name":"Microsoft OAuth 2.0 Consent Phishing 2021","url":"https://www.microsoft.com/security/blog/2021/07/14/microsoft-delivers-comprehensive-solution-to-battle-rise-in-consent-phishing-emails/"},{"source_name":"Microsoft Anti Spoofing","url":"https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide"},{"source_name":"Mandiant URL Obfuscation 2023","url":"https://www.mandiant.com/resources/blog/url-obfuscation-schema-abuse"},{"source_name":"Optiv Device Code Phishing 2021","url":"https://www.optiv.com/insights/source-zero/blog/microsoft-365-oauth-device-code-flow-and-phishing"},{"source_name":"SecureWorks Device Code Phishing 2021","url":"https://www.secureworks.com/blog/oauths-device-code-flow-abused-in-phishing-attacks"}]},"assertions":[{"id":"enterprise:relationship--005b46de-6241-413e-ba13-e0c2cc8efa77","subject":"ATTACK:enterprise:M1054","predicate":"mitigates","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--005b46de-6241-413e-ba13-e0c2cc8efa77","modified":"2026-04-29T14:23:05.903Z","references":[{"source_name":"ACSC Email Spoofing","url":"https://web.archive.org/web/20210708014107/https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf"},{"source_name":"Microsoft Anti Spoofing","url":"https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--01455ab2-2769-4eab-9df2-e7e5f707e7c6","subject":"ATTACK:enterprise:G0098","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--01455ab2-2769-4eab-9df2-e7e5f707e7c6","modified":"2026-07-31T18:48:01.443Z","references":[{"source_name":"TrendMicro BlackTech June 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0160acb0-db44-4076-acc6-74c872d5aa08","subject":"ATTACK:enterprise:S0585","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0160acb0-db44-4076-acc6-74c872d5aa08","modified":"2026-04-29T14:23:05.904Z","references":[{"source_name":"Amnesty Intl. Ocean Lotus February 2021","url":"https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--02d478b7-c728-4b43-b599-84bd75c3546e","subject":"ATTACK:enterprise:G0069","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--02d478b7-c728-4b43-b599-84bd75c3546e","modified":"2026-07-31T20:48:29.597Z","references":[{"source_name":"Anomali Static Kitten February 2021","url":"https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies"},{"source_name":"Proofpoint TA450 Phishing March 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign"},{"source_name":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--03c424ec-df52-4b08-8b32-fa8b2a738a97","subject":"ATTACK:enterprise:G1014","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--03c424ec-df52-4b08-8b32-fa8b2a738a97","modified":"2026-07-31T18:48:14.524Z","references":[{"source_name":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--04b1f1a3-b46b-4af9-b21a-3e1047d2844e","subject":"ATTACK:enterprise:G1054","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--04b1f1a3-b46b-4af9-b21a-3e1047d2844e","modified":"2026-07-31T18:48:08.123Z","references":[{"source_name":"Trend Micro Earth Kasha Updates APR 2025","url":"https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0930d98a-d8ae-4300-a50b-8a80b06e88e9","subject":"ATTACK:enterprise:G0142","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0930d98a-d8ae-4300-a50b-8a80b06e88e9","modified":"2026-07-31T20:48:37.524Z","references":[{"source_name":"TrendMicro Confucius APT Aug 2021","url":"https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0f29f072-1eb1-4711-8679-19580f16b351","subject":"ATTACK:enterprise:G0103","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0f29f072-1eb1-4711-8679-19580f16b351","modified":"2026-07-31T18:48:06.547Z","references":[{"source_name":"FOX-IT May 2016 Mofang","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0f7756fb-ea96-4d3a-9a23-a0f0a326de63","subject":"ATTACK:enterprise:G0094","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0f7756fb-ea96-4d3a-9a23-a0f0a326de63","modified":"2026-07-31T20:48:24.474Z","references":[{"source_name":"EST Kimsuky April 2019","url":"https://blog.alyac.co.kr/2234"},{"source_name":"Netscout Stolen Pencil Dec 2018","url":"https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/"},{"source_name":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--118e5be5-a143-4e2f-b80f-20b580f14210","subject":"ATTACK:enterprise:G0121","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--118e5be5-a143-4e2f-b80f-20b580f14210","modified":"2026-07-31T18:47:51.727Z","references":[{"source_name":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"},{"source_name":"Cyble Sidewinder September 2020","url":"https://cybleinc.com/2020/09/26/sidewinder-apt-targets-with-futuristic-tactics-and-techniques/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--148f4700-9a24-4729-af76-5ff9eafb997c","subject":"ATTACK:enterprise:S0561","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--148f4700-9a24-4729-af76-5ff9eafb997c","modified":"2026-04-29T14:23:05.932Z","references":[{"source_name":"Unit 42 NETWIRE April 2020","url":"https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1d0af393-5340-4bee-bccc-b1007853276a","subject":"ATTACK:enterprise:S1017","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1d0af393-5340-4bee-bccc-b1007853276a","modified":"2026-04-29T14:23:05.944Z","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1e3438f9-573c-4912-81e7-650094af62ac","subject":"ATTACK:enterprise:C0002","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1e3438f9-573c-4912-81e7-650094af62ac","modified":"2026-07-31T18:47:30.539Z","references":[{"source_name":"McAfee Night Dragon","url":"https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1f8132be-36d7-403e-a3e6-604db01ca3b8","subject":"ATTACK:enterprise:S0669","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1f8132be-36d7-403e-a3e6-604db01ca3b8","modified":"2026-04-29T14:23:05.947Z","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2003aaad-7b87-461d-b17f-b19100069ad9","subject":"ATTACK:enterprise:G0066","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2003aaad-7b87-461d-b17f-b19100069ad9","modified":"2026-07-31T18:47:35.844Z","references":[{"source_name":"CSM Elderwood Sept 2012","url":"https://www.csmonitor.com/USA/2012/0914/Stealing-US-business-secrets-Experts-ID-two-huge-cyber-gangs-in-China"},{"source_name":"Symantec Elderwood Sept 2012","url":"https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--20d7fd13-f14f-49a4-81db-3c497339b6f4","subject":"ATTACK:enterprise:S9026","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--20d7fd13-f14f-49a4-81db-3c497339b6f4","modified":"2026-04-29T14:23:05.950Z","references":[{"source_name":"Trend Micro Earth Kasha Updates APR 2025","url":"https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--239092bc-09e4-4c16-9d83-071929c9e4a4","subject":"ATTACK:enterprise:M1021","predicate":"mitigates","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--239092bc-09e4-4c16-9d83-071929c9e4a4","modified":"2026-04-29T14:23:05.953Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--24c2c2a0-15a5-4890-a38a-8fc8e4ccd381","subject":"ATTACK:enterprise:S9044","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--24c2c2a0-15a5-4890-a38a-8fc8e4ccd381","modified":"2026-07-31T03:26:19.038Z","references":[{"source_name":"Artic Wolf Labs Kali365 Device Code April 2026","url":"https://arcticwolf.com/resources/blog/token-bingo-dont-let-your-code-be-the-winner/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--272e3614-f257-4aff-9938-b03a2f16efbd","subject":"ATTACK:enterprise:S0528","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--272e3614-f257-4aff-9938-b03a2f16efbd","modified":"2026-04-29T14:23:05.958Z","references":[{"source_name":"Securelist Brazilian Banking Malware July 2020","url":"https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--29d8831b-42fb-4da2-aa43-7181073d5d79","subject":"ATTACK:enterprise:S1111","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--29d8831b-42fb-4da2-aa43-7181073d5d79","modified":"2026-04-29T14:23:05.962Z","references":[{"source_name":"Trellix Darkgate 2023","url":"https://www.trellix.com/blogs/research/the-continued-evolution-of-the-darkgate-malware-as-a-service/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2c5ff227-9d4b-4af0-b534-83b55733f5b5","subject":"ATTACK:enterprise:S1030","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2c5ff227-9d4b-4af0-b534-83b55733f5b5","modified":"2026-04-29T14:23:05.965Z","references":[{"source_name":"ZScaler Squirrelwaffle Sep 2021","url":"https://www.zscaler.com/blogs/security-research/squirrelwaffle-new-loader-delivering-cobalt-strike"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2dde02b3-20b9-4709-96b4-02dbb9150577","subject":"ATTACK:enterprise:G0095","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2dde02b3-20b9-4709-96b4-02dbb9150577","modified":"2026-07-31T18:47:49.829Z","references":[{"source_name":"Cylance Machete Mar 2017","url":"https://threatvector.cylance.com/en_us/home/el-machete-malware-attacks-cut-through-latam.html"},{"source_name":"ESET Machete July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--30a465fc-955e-4688-9349-daf17a287c47","subject":"ATTACK:enterprise:S0584","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--30a465fc-955e-4688-9349-daf17a287c47","modified":"2026-04-29T14:23:05.978Z","references":[{"source_name":"CISA AppleJeus Feb 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-048a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--34319090-f87a-431b-a6c1-38d8494495b6","subject":"ATTACK:enterprise:G0046","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--34319090-f87a-431b-a6c1-38d8494495b6","modified":"2026-07-31T20:48:31.787Z","references":[{"source_name":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"},{"source_name":"CrowdStrike Carbon Spider August 2021","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--358466fb-c847-4f14-b5cc-c368df25932b","subject":"ATTACK:enterprise:S1242","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--358466fb-c847-4f14-b5cc-c368df25932b","modified":"2026-04-29T14:23:05.992Z","references":[{"source_name":"Sophos Qilin MSP APR 2025","url":"https://news.sophos.com/en-us/2025/04/01/sophos-mdr-tracks-ongoing-campaign-by-qilin-affiliates-targeting-screenconnect/"},{"source_name":"SentinelOne Qilin NOV 2022","url":"https://www.sentinelone.com/anthology/agenda-qilin/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--36d41ebe-3a33-46f3-927b-42110fc2df1d","subject":"ATTACK:enterprise:S9050","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--36d41ebe-3a33-46f3-927b-42110fc2df1d","modified":"2026-09-11T19:55:38.134Z","references":[{"source_name":"QuorumCyber_Vidar_March2023","url":"https://www.quorumcyber.com/wp-content/uploads/2023/01/Malware-Analysis-Vidar.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3819b66b-51e4-440d-93cf-12e8b6892e3e","subject":"ATTACK:enterprise:T1566.002","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1566","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3819b66b-51e4-440d-93cf-12e8b6892e3e","modified":"2026-04-29T14:23:05.996Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--382b8780-edc3-477f-a7fa-3e6ba62397a2","subject":"ATTACK:enterprise:S0367","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--382b8780-edc3-477f-a7fa-3e6ba62397a2","modified":"2026-04-29T14:23:05.997Z","references":[{"source_name":"Trend Micro Banking Malware Jan 2019","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-banking-malware-uses-network-sniffing-for-data-theft/"},{"source_name":"Kaspersky Emotet Jan 2019","url":"https://securelist.com/the-banking-trojan-emotet-detailed-analysis/69560/"},{"source_name":"CIS Emotet Apr 2017","url":"https://www.cisecurity.org/blog/emotet-changes-ttp-and-arrives-in-united-states/"},{"source_name":"Malwarebytes Emotet Dec 2017","url":"https://support.malwarebytes.com/docs/DOC-2295"},{"source_name":"Symantec Emotet Jul 2018","url":"https://www.symantec.com/blogs/threat-intelligence/evolution-emotet-trojan-distributor"},{"source_name":"US-CERT Emotet Jul 2018","url":"https://www.us-cert.gov/ncas/alerts/TA18-201A"},{"source_name":"Talos Emotet Jan 2019","url":"https://blog.talosintelligence.com/2019/01/return-of-emotet.html"},{"source_name":"Talos Emotet Jan 2019","url":"https://blog.talosintelligence.com/2019/01/return-of-emotet.html"},{"source_name":"Picus Emotet Dec 2018","url":"https://www.picussecurity.com/blog/the-christmas-card-you-never-wanted-a-new-wave-of-emotet-is-back-to-wreak-havoc.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--386d6f27-a0a6-44c9-bd03-8a332c5ce9e2","subject":"ATTACK:enterprise:C0005","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--386d6f27-a0a6-44c9-bd03-8a332c5ce9e2","modified":"2026-07-31T18:47:22.479Z","references":[{"source_name":"ESET Operation Spalax Jan 2021","url":"https://www.welivesecurity.com/2021/01/12/operation-spalax-targeted-malware-attacks-colombia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3fe304c6-4f26-42a9-b1f4-22635fd01245","subject":"ATTACK:enterprise:G1020","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3fe304c6-4f26-42a9-b1f4-22635fd01245","modified":"2026-07-31T18:47:37.773Z","references":[{"source_name":"SocGholish-update","url":"https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4170eaf9-9845-4f13-91b2-ff5c9931f365","subject":"ATTACK:enterprise:G0034","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4170eaf9-9845-4f13-91b2-ff5c9931f365","modified":"2026-07-31T20:48:32.821Z","references":[{"source_name":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4364b7ab-fd25-4145-84e6-e9e74ac3c0dd","subject":"ATTACK:enterprise:G0134","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4364b7ab-fd25-4145-84e6-e9e74ac3c0dd","modified":"2026-07-31T18:48:24.155Z","references":[{"source_name":"Talos Oblique RAT March 2021","url":"https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html"},{"source_name":"Talos Transparent Tribe May 2021","url":"https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--478e4f65-d03a-4f1b-aeeb-16dddc1bfead","subject":"ATTACK:enterprise:G0120","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--478e4f65-d03a-4f1b-aeeb-16dddc1bfead","modified":"2026-07-31T18:47:42.387Z","references":[{"source_name":"ESET EvilNum July 2020","url":"https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4bf2c4b0-9b7c-4546-ad21-1ca6c97afd14","subject":"ATTACK:enterprise:S1122","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4bf2c4b0-9b7c-4546-ad21-1ca6c97afd14","modified":"2026-04-29T14:23:06.029Z","references":[{"source_name":"SCILabs Malteiro 2021","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--50860aec-3490-4783-8ffb-ad4217cf0d58","subject":"ATTACK:enterprise:S0646","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--50860aec-3490-4783-8ffb-ad4217cf0d58","modified":"2026-04-29T14:23:06.035Z","references":[{"source_name":"Secureworks GOLD KINGSWOOD September 2018","url":"https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--529e6ba3-a73d-4cca-84e9-d2d047340aa0","subject":"ATTACK:enterprise:G0129","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--529e6ba3-a73d-4cca-84e9-d2d047340aa0","modified":"2026-07-31T18:47:52.353Z","references":[{"source_name":"IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025","url":"https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"},{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source_name":"McAfee Dianxun March 2021","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-dianxun.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--52e319bc-d6ee-4ab5-a3ae-36f0477cac67","subject":"ATTACK:enterprise:G0061","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--52e319bc-d6ee-4ab5-a3ae-36f0477cac67","modified":"2026-07-31T18:48:29.594Z","references":[{"source_name":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5758382a-2ada-4d05-ad25-8ee802a9e041","subject":"ATTACK:enterprise:G0050","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5758382a-2ada-4d05-ad25-8ee802a9e041","modified":"2026-07-31T18:47:44.445Z","references":[{"source_name":"ESET OceanLotus","url":"https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/"},{"source_name":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source_name":"FireEye APT32 April 2020","url":"https://www.fireeye.com/blog/threat-research/2020/04/apt32-targeting-chinese-government-in-covid-19-related-espionage.html"},{"source_name":"Volexity Ocean Lotus November 2020","url":"https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/"},{"source_name":"Amnesty Intl. Ocean Lotus February 2021","url":"https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5853ff4e-9982-4d66-bf98-6c22fa42f305","subject":"ATTACK:enterprise:S0453","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5853ff4e-9982-4d66-bf98-6c22fa42f305","modified":"2026-04-29T14:23:06.046Z","references":[{"source_name":"Malwarebytes Pony April 2016","url":"https://blog.malwarebytes.com/threat-analysis/2015/11/no-money-but-pony-from-a-mail-to-a-trojan-horse/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--598e9cc3-818c-4fc0-baf3-aba229543da5","subject":"ATTACK:enterprise:G0022","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--598e9cc3-818c-4fc0-baf3-aba229543da5","modified":"2026-07-31T18:47:37.874Z","references":[{"source_name":"FireEye Clandestine Wolf","url":"https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-wolf-adobe-flash-zero-day.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5bc68652-1d99-4782-80bd-086fc7f8358c","subject":"ATTACK:enterprise:G0006","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5bc68652-1d99-4782-80bd-086fc7f8358c","modified":"2026-07-31T18:48:01.211Z","references":[{"source_name":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5e28da21-d977-4488-a8dc-10bad0833374","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5e28da21-d977-4488-a8dc-10bad0833374","modified":"2026-07-31T20:48:46.746Z","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5f90f8ec-9154-4f28-a632-fd4024e6fbce","subject":"ATTACK:enterprise:M1047","predicate":"mitigates","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5f90f8ec-9154-4f28-a632-fd4024e6fbce","modified":"2026-04-29T14:23:06.055Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--61f91f23-a8a5-4b4e-b546-f0fff28851a1","subject":"ATTACK:enterprise:G0065","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--61f91f23-a8a5-4b4e-b546-f0fff28851a1","modified":"2026-07-31T20:48:38.172Z","references":[{"source_name":"Proofpoint Leviathan Oct 2017","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"},{"source_name":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--63135ac5-fa86-41a0-9023-df4c8f830582","subject":"ATTACK:enterprise:S1018","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--63135ac5-fa86-41a0-9023-df4c8f830582","modified":"2026-04-29T14:23:06.060Z","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--639e7b8d-57d7-4c1d-8f42-1496606ea666","subject":"ATTACK:enterprise:G0064","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--639e7b8d-57d7-4c1d-8f42-1496606ea666","modified":"2026-07-31T20:48:53.106Z","references":[{"source_name":"FireEye APT33 Sept 2017","url":"https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html"},{"source_name":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--671a20b9-ad4c-468f-9871-be3545907dd2","subject":"ATTACK:enterprise:G0128","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--671a20b9-ad4c-468f-9871-be3545907dd2","modified":"2026-07-31T18:47:52.296Z","references":[{"source_name":"Microsoft Targeting Elections September 2020","url":"https://blogs.microsoft.com/on-the-issues/2020/09/10/cyberattacks-us-elections-trump-biden/"},{"source_name":"Google Election Threats October 2020","url":"https://blog.google/threat-analysis-group/how-were-tackling-evolving-online-threats/"},{"source_name":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6f23e808-aa3b-4ad8-b932-e294c8921fdb","subject":"ATTACK:enterprise:G1011","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6f23e808-aa3b-4ad8-b932-e294c8921fdb","modified":"2026-07-31T18:47:38.738Z","references":[{"source_name":"Google EXOTIC LILY March 2022","url":"https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--731a7678-8b88-47c9-88a6-7bc897bb79bb","subject":"ATTACK:enterprise:S0677","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--731a7678-8b88-47c9-88a6-7bc897bb79bb","modified":"2026-04-29T14:23:06.082Z","references":[{"source_name":"AADInternals Documentation","url":"https://o365blog.com/aadinternals"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--741c03f1-5c9c-4737-bf2d-279503a042ab","subject":"ATTACK:enterprise:S1039","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--741c03f1-5c9c-4737-bf2d-279503a042ab","modified":"2026-04-29T14:23:06.084Z","references":[{"source_name":"Cybereason Bumblebee August 2022","url":"https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control"},{"source_name":"Proofpoint Bumblebee April 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--74953cb2-4d72-487b-959b-57602ce28d07","subject":"ATTACK:enterprise:C0011","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--74953cb2-4d72-487b-959b-57602ce28d07","modified":"2026-07-31T18:47:31.388Z","references":[{"source_name":"Cisco Talos Transparent Tribe Education Campaign July 2022","url":"https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7dee0645-9c39-4e04-8012-6ae10a449ae9","subject":"ATTACK:enterprise:S0266","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7dee0645-9c39-4e04-8012-6ae10a449ae9","modified":"2026-04-29T14:23:06.098Z","references":[{"source_name":"Cyberreason Anchor December 2019","url":"https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7fd1b042-8543-46f7-90d5-631500f17e9e","subject":"ATTACK:enterprise:G0021","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7fd1b042-8543-46f7-90d5-631500f17e9e","modified":"2026-07-31T18:48:23.734Z","references":[{"source_name":"Kaspersky MoleRATs April 2019","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--808f140e-8b7b-4efa-8708-2f2308b2fc41","subject":"ATTACK:enterprise:G0059","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--808f140e-8b7b-4efa-8708-2f2308b2fc41","modified":"2026-07-31T18:48:28.817Z","references":[{"source_name":"Certfa Charming Kitten January 2021","url":"https://blog.certfa.com/posts/charming-kitten-christmas-gift/"},{"source_name":"ClearSky Kittens Back 3 August 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/The-Kittens-are-Back-in-Town-3.pdf"},{"source_name":"Secureworks Cobalt Gypsy Feb 2017","url":"https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations"},{"source_name":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--80c27fda-8e6c-49f4-a236-5ac424fd0849","subject":"ATTACK:enterprise:S1124","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--80c27fda-8e6c-49f4-a236-5ac424fd0849","modified":"2026-04-29T14:23:06.101Z","references":[{"source_name":"SocGholish-update","url":"https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8272bde7-817f-4cb4-b073-67859002d310","subject":"ATTACK:enterprise:G0049","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8272bde7-817f-4cb4-b073-67859002d310","modified":"2026-07-31T20:48:35.607Z","references":[{"source_name":"ClearSky OilRig Jan 2017","url":"http://www.clearskysec.com/oilrig/"},{"source_name":"Unit 42 OopsIE! Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--88157c8d-48d7-4114-8783-d22999a8f990","subject":"ATTACK:enterprise:G0112","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--88157c8d-48d7-4114-8783-d22999a8f990","modified":"2026-09-02T18:52:47.047Z","references":[{"source_name":"SANS Windshift August 2018","url":"https://www.scribd.com/document/661837258/WINDSHIFT-summit-archive-1554718868"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--933278a3-45a6-4d1a-93e7-76124d9938f6","subject":"ATTACK:enterprise:C0047","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--933278a3-45a6-4d1a-93e7-76124d9938f6","modified":"2026-07-31T18:47:19.517Z","references":[{"source_name":"Recorded Future RedDelta 2025","url":"https://go.recordedfuture.com/hubfs/reports/cta-cn-2025-0109.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--95618672-6f7f-4055-9c96-29f75e276d5b","subject":"ATTACK:enterprise:G0080","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--95618672-6f7f-4055-9c96-29f75e276d5b","modified":"2026-07-31T18:48:23.208Z","references":[{"source_name":"Talos Cobalt Group July 2018","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"},{"source_name":"Secureworks GOLD KINGSWOOD September 2018","url":"https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--95b0d9c3-e905-468c-8498-6550f2130826","subject":"ATTACK:enterprise:S0198","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--95b0d9c3-e905-468c-8498-6550f2130826","modified":"2026-04-29T14:23:06.129Z","references":[{"source_name":"Unit 42 NETWIRE April 2020","url":"https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a1d7019e-ccb0-42cb-ba7c-351dd5cb152f","subject":"ATTACK:enterprise:G0016","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a1d7019e-ccb0-42cb-ba7c-351dd5cb152f","modified":"2026-07-31T18:48:08.428Z","references":[{"source_name":"Mandiant No Easy Breach","url":"https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"},{"source_name":"MSTIC NOBELIUM May 2021","url":"https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"},{"source_name":"Secureworks IRON RITUAL USAID Phish May 2021","url":"https://www.secureworks.com/blog/usaid-themed-phishing-campaign-leverages-us-elections-lure"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a3a8c9e7-ed71-46c9-aa1f-c609406652b0","subject":"ATTACK:enterprise:M1018","predicate":"mitigates","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a3a8c9e7-ed71-46c9-aa1f-c609406652b0","modified":"2026-04-29T14:23:06.148Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a4e398b7-f518-467c-ae1b-4ea973afb11b","subject":"ATTACK:enterprise:G1059","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a4e398b7-f518-467c-ae1b-4ea973afb11b","modified":"2026-10-02T13:18:38.803Z","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"},{"source_name":"CheckPoint_NimbusManticore_May2026","url":"https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"},{"source_name":"Mandiant_UNC1549TTPsTools_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"},{"source_name":"Mandiant_UNC1549_Feb2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a7492314-41f3-4785-afee-8869f16d0204","subject":"ATTACK:enterprise:G0090","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a7492314-41f3-4785-afee-8869f16d0204","modified":"2026-07-31T20:48:52.526Z","references":[{"source_name":"Check Point Wirte NOV 2024","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a8e36e77-3899-4e7c-b27e-ab6ebf049066","subject":"ATTACK:enterprise:G0085","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a8e36e77-3899-4e7c-b27e-ab6ebf049066","modified":"2026-07-31T20:48:48.787Z","references":[{"source_name":"FireEye Hacking FIN4 Video Dec 2014","url":"https://www2.fireeye.com/WBNR-14Q4NAMFIN4.html"},{"source_name":"FireEye Hacking FIN4 Dec 2014","url":"https://web.archive.org/web/20220313062515/https://www.mandiant.com/sites/default/files/2021-09/rpt-fin4.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aafab4f1-96d9-4c9e-8f87-98a38db520fe","subject":"ATTACK:enterprise:C0021","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aafab4f1-96d9-4c9e-8f87-98a38db520fe","modified":"2026-07-31T18:47:24.557Z","references":[{"source_name":"FireEye APT29 Nov 2018","url":"https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html"},{"source_name":"Microsoft Unidentified Dec 2018","url":"https://www.microsoft.com/security/blog/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b1ed7715-2145-4b26-b414-8f83a29e1f74","subject":"ATTACK:enterprise:S1086","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b1ed7715-2145-4b26-b414-8f83a29e1f74","modified":"2026-04-29T14:23:06.168Z","references":[{"source_name":"Telefonica Snip3 December 2021","url":"https://telefonicatech.com/blog/snip3-investigacion-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b5e98443-7d3a-4a0a-975d-a5c1d564bd15","subject":"ATTACK:enterprise:S0650","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b5e98443-7d3a-4a0a-975d-a5c1d564bd15","modified":"2026-04-29T14:23:06.174Z","references":[{"source_name":"Group IB Ransomware September 2020","url":"https://web.archive.org/web/20220119114433/https://groupib.pathfactory.com/ransomware-reports/prolock_wp"},{"source_name":"Trend Micro Black Basta October 2022","url":"https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html"},{"source_name":"Kaspersky QakBot September 2021","url":"https://securelist.com/qakbot-technical-analysis/103931/"},{"source_name":"Trend Micro Qakbot May 2020","url":"https://www.trendmicro.com/vinfo/ph/security/news/cybercrime-and-digital-threats/qakbot-resurges-spreads-through-vbs-files"},{"source_name":"ATT QakBot April 2021","url":"https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot"},{"source_name":"Kroll Qakbot June 2020","url":"https://www.kroll.com/en/insights/publications/cyber/qakbot-malware-exfiltrating-emails-thread-hijacking-attacks"},{"source_name":"Trend Micro Qakbot December 2020","url":"https://success.trendmicro.com/en-US/solution/KA-0011282"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b711fa36-192b-4ad6-9462-790533469ce9","subject":"ATTACK:enterprise:C0060","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b711fa36-192b-4ad6-9462-790533469ce9","modified":"2026-07-31T18:47:27.217Z","references":[{"source_name":"Trend Micro Earth Kasha Anel NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--baa39a74-fd81-4e25-9e5e-a8b95147bdd5","subject":"ATTACK:enterprise:G1018","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--baa39a74-fd81-4e25-9e5e-a8b95147bdd5","modified":"2026-07-31T18:47:55.521Z","references":[{"source_name":"Telefonica Snip3 December 2021","url":"https://telefonicatech.com/blog/snip3-investigacion-malware"},{"source_name":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bcf302f3-bffc-4c59-84cf-dbd0477ec207","subject":"ATTACK:enterprise:G0099","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bcf302f3-bffc-4c59-84cf-dbd0477ec207","modified":"2026-07-31T18:48:18.696Z","references":[{"source_name":"Check Point Blind Eagle MAR 2025","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"},{"source_name":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"},{"source_name":"Recorded Future TAG-144 AUG 2025","url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c1b55dea-5e5d-4cff-bfac-5880507389c1","subject":"ATTACK:enterprise:S0499","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c1b55dea-5e5d-4cff-bfac-5880507389c1","modified":"2026-04-29T14:23:06.190Z","references":[{"source_name":"Threatpost Hancitor","url":"https://threatpost.com/spammers-revive-hancitor-downloader-campaigns/123011/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c36deed2-7da5-4c41-b6f0-eebc94bb17e9","subject":"ATTACK:enterprise:S0534","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c36deed2-7da5-4c41-b6f0-eebc94bb17e9","modified":"2026-04-29T14:23:06.192Z","references":[{"source_name":"Cybereason Bazar July 2020","url":"https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"},{"source_name":"Zscaler Bazar September 2020","url":"https://www.zscaler.com/blogs/research/spear-phishing-campaign-delivers-buer-and-bazar-malware"},{"source_name":"CrowdStrike Wizard Spider October 2020","url":"https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cff64310-fe63-44ad-9791-d1b4b50f0229","subject":"ATTACK:enterprise:G1006","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cff64310-fe63-44ad-9791-d1b4b50f0229","modified":"2026-07-31T20:48:48.399Z","references":[{"source_name":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d2187598-ade7-4ce0-8375-da55aa3369c2","subject":"ATTACK:enterprise:G1039","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d2187598-ade7-4ce0-8375-da55aa3369c2","modified":"2026-07-31T18:48:06.444Z","references":[{"source_name":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source_name":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d2d8fc99-7aaf-41c3-98e0-0ceae6ff48ad","subject":"ATTACK:enterprise:G1046","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d2d8fc99-7aaf-41c3-98e0-0ceae6ff48ad","modified":"2026-07-31T18:47:48.104Z","references":[{"source_name":"Microsoft Storm-1811 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d42b9304-293a-4b95-a946-dcda81be5c87","subject":"ATTACK:enterprise:G0010","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d42b9304-293a-4b95-a946-dcda81be5c87","modified":"2026-07-31T18:48:04.335Z","references":[{"source_name":"ESET Turla Mosquito Jan 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d4f9d2ab-70d0-4aaf-9c7f-d94fc0818ecb","subject":"ATTACK:enterprise:M1017","predicate":"mitigates","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d4f9d2ab-70d0-4aaf-9c7f-d94fc0818ecb","modified":"2026-04-29T14:23:06.216Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d87925c8-23ed-4913-81d6-c4d93d65c798","subject":"ATTACK:enterprise:G0102","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d87925c8-23ed-4913-81d6-c4d93d65c798","modified":"2026-07-31T20:48:50.552Z","references":[{"source_name":"DHS/CISA Ransomware Targeting Healthcare October 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-302a"},{"source_name":"DFIR Ryuk 2 Hour Speed Run November 2020","url":"https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d9a681a0-bf13-40b2-9534-f244d48d3a92","subject":"ATTACK:enterprise:S1160","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d9a681a0-bf13-40b2-9534-f244d48d3a92","modified":"2026-04-29T14:23:06.222Z","references":[{"source_name":"Bleeping Computer Latrodectus April 2024","url":"https://www.bleepingcomputer.com/news/security/new-latrodectus-malware-attacks-use-microsoft-cloudflare-themes/"},{"source_name":"Latrodectus APR 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e1a9a121-0ae4-4757-940c-42293f8c1c73","subject":"ATTACK:enterprise:G0082","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e1a9a121-0ae4-4757-940c-42293f8c1c73","modified":"2026-09-30T20:08:31.276Z","references":[{"source_name":"Microsoft Sapphire Sleet APR 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e34de44b-fec4-40b2-978b-a0ee54f8fc0e","subject":"ATTACK:enterprise:G1037","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e34de44b-fec4-40b2-978b-a0ee54f8fc0e","modified":"2026-07-31T18:47:38.806Z","references":[{"source_name":"Latrodectus APR 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e35a6a79-0ffc-4835-aaf8-e42dd20a7e45","subject":"ATTACK:enterprise:G0040","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e35a6a79-0ffc-4835-aaf8-e42dd20a7e45","modified":"2026-07-31T20:48:26.480Z","references":[{"source_name":"Symantec Patchwork","url":"http://www.symantec.com/connect/blogs/patchwork-cyberespionage-group-expands-targets-governments-wide-range-industries"},{"source_name":"Unit 42 BackConfig May 2020","url":"https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"},{"source_name":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e3f7935d-0f3a-440a-be19-ef9383914441","subject":"ATTACK:enterprise:G0092","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e3f7935d-0f3a-440a-be19-ef9383914441","modified":"2026-07-31T18:48:05.887Z","references":[{"source_name":"Proofpoint TA505 Sep 2017","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter"},{"source_name":"Proofpoint TA505 Jan 2019","url":"https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505"},{"source_name":"Trend Micro TA505 June 2019","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/shifting-tactics-breaking-down-ta505-groups-use-of-html-rats-and-other-techniques-in-latest-campaigns/"},{"source_name":"Proofpoint TA505 October 2019","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e4946803-e448-4c85-902b-100e4d627ec3","subject":"ATTACK:enterprise:G0140","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e4946803-e448-4c85-902b-100e4d627ec3","modified":"2026-07-31T18:48:13.711Z","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e6c6afdc-a52f-405c-8480-a4b2d2d797bf","subject":"ATTACK:enterprise:S0530","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e6c6afdc-a52f-405c-8480-a4b2d2d797bf","modified":"2026-04-29T14:23:06.239Z","references":[{"source_name":"Securelist Brazilian Banking Malware July 2020","url":"https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e8009877-1d59-4742-8d9a-61e0cda1f0b1","subject":"ATTACK:enterprise:C0016","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e8009877-1d59-4742-8d9a-61e0cda1f0b1","modified":"2026-07-31T20:48:14.888Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ea7cd259-9065-4762-b7e1-f17d42b4af67","subject":"ATTACK:enterprise:S0531","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ea7cd259-9065-4762-b7e1-f17d42b4af67","modified":"2026-04-29T14:23:06.244Z","references":[{"source_name":"IBM Grandoreiro April 2020","url":"https://securityintelligence.com/posts/grandoreiro-malware-now-targeting-banks-in-spain/"},{"source_name":"ESET Grandoreiro April 2020","url":"https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--edb83e19-bc71-455e-bf38-4ab5c823ebc8","subject":"ATTACK:enterprise:S0476","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--edb83e19-bc71-455e-bf38-4ab5c823ebc8","modified":"2026-04-29T14:23:06.249Z","references":[{"source_name":"SentinelOne Valak June 2020","url":"https://assets.sentinelone.com/labs/sentinel-one-valak-i"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f565693e-80f4-40a8-8f28-f1a9bd0d1918","subject":"ATTACK:enterprise:G1044","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f565693e-80f4-40a8-8f28-f1a9bd0d1918","modified":"2026-07-31T18:48:16.568Z","references":[{"source_name":"TAG APT42","url":"https://blog.google/threat-analysis-group/iranian-backed-group-steps-up-phishing-campaigns-against-israel-us/"},{"source_name":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"},{"source_name":"Mandiant APT42-untangling","url":"https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f5cd03ce-93e0-4458-ba90-ca3926bb41b9","subject":"ATTACK:enterprise:G0087","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f5cd03ce-93e0-4458-ba90-ca3926bb41b9","modified":"2026-07-31T18:47:54.152Z","references":[{"source_name":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"},{"source_name":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f61d2fc5-84df-4816-ae34-e6666a1082fe","subject":"ATTACK:enterprise:S1229","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f61d2fc5-84df-4816-ae34-e6666a1082fe","modified":"2026-04-29T14:23:06.259Z","references":[{"source_name":"Fortinet Havoc MAR 2025","url":"https://www.fortinet.com/blog/threat-research/havoc-sharepoint-with-microsoft-graph-api-turns-into-fud-c2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f9957b8a-0ece-4d97-8a56-8ca320e1828d","subject":"ATTACK:enterprise:S1213","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f9957b8a-0ece-4d97-8a56-8ca320e1828d","modified":"2026-04-29T14:23:06.264Z","references":[{"source_name":"Cybereason LumaStealer Undated","url":"https://www.cybereason.com/blog/threat-analysis-rise-of-lummastealer"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f998689d-ce01-4ece-87a0-906255177e55","subject":"ATTACK:enterprise:C0022","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f998689d-ce01-4ece-87a0-906255177e55","modified":"2026-07-31T21:14:22.943Z","references":[{"source_name":"ESET Lazarus Jun 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_Operation_Interception.pdf"},{"source_name":"ClearSky Lazarus Aug 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ff1d0eba-a675-4ebb-a9a3-b28b8d3a15fc","subject":"ATTACK:enterprise:C0036","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ff1d0eba-a675-4ebb-a9a3-b28b8d3a15fc","modified":"2026-07-31T18:47:26.656Z","references":[{"source_name":"Elastic Pikabot 2024","url":"https://www.elastic.co/security-labs/pikabot-i-choose-you"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}