{"record":{"id":"ATTACK:enterprise:T1569.002","title":"Service Execution","type":"Subtechnique","source_url":"https://attack.mitre.org/techniques/T1569/002","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--f1951e8a-500e-4a26-8803-76d95c4554b4","external_id":"T1569.002","domain":"enterprise","created":"2020-03-10T18:33:36.159Z","modified":"2026-09-11T19:43:47.298Z","version":"1.3","aliases":[],"tactics":["execution"],"source_references":[{"source_name":"Microsoft Service Control Manager","url":"https://docs.microsoft.com/windows/win32/services/service-control-manager"},{"source_name":"Russinovich Sysinternals","url":"https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx"}]},"assertions":[{"id":"enterprise:relationship--00822c6a-a881-4678-8d74-6a52b2ca27c9","subject":"ATTACK:enterprise:S0192","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--00822c6a-a881-4678-8d74-6a52b2ca27c9","modified":"2026-04-29T14:23:05.903Z","references":[{"source_name":"GitHub Pupy","url":"https://github.com/n1nj4sec/pupy"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--08a0175a-eb34-4ed2-a9ca-d458da65326a","subject":"ATTACK:enterprise:S1111","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--08a0175a-eb34-4ed2-a9ca-d458da65326a","modified":"2026-04-29T14:23:05.915Z","references":[{"source_name":"Trellix Darkgate 2023","url":"https://www.trellix.com/blogs/research/the-continued-evolution-of-the-darkgate-malware-as-a-service/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--10625b4c-7ecc-49a0-b8e3-c9f2d8cba2da","subject":"ATTACK:enterprise:M1026","predicate":"mitigates","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--10625b4c-7ecc-49a0-b8e3-c9f2d8cba2da","modified":"2026-04-29T14:23:05.926Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--155a8883-7b22-4fa8-8d2f-bd76c8efd5b3","subject":"ATTACK:enterprise:S0154","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--155a8883-7b22-4fa8-8d2f-bd76c8efd5b3","modified":"2026-04-29T14:23:05.933Z","references":[{"source_name":"Cobalt Strike TTPs Dec 2017","url":"https://web.archive.org/web/20210924171429/https://www.cobaltstrike.com/downloads/reports/tacticstechniquesandprocedures.pdf"},{"source_name":"cobaltstrike manual","url":"https://web.archive.org/web/20210825130434/https://cobaltstrike.com/downloads/csmanual38.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--177888f1-a326-4642-98c3-66aa91ef18dd","subject":"ATTACK:enterprise:S9050","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--177888f1-a326-4642-98c3-66aa91ef18dd","modified":"2026-09-11T19:43:47.041Z","references":[{"source_name":"Cyfirma_Vidar_June2024","url":"https://www.cyfirma.com/research/vidar-stealer-an-in-depth-analysis-of-an-information-stealing-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1b92df4d-d064-4615-b27d-cf4d53ecc97b","subject":"ATTACK:enterprise:S0260","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1b92df4d-d064-4615-b27d-cf4d53ecc97b","modified":"2026-04-29T14:23:05.942Z","references":[{"source_name":"ESET InvisiMole June 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1c0e8084-c8a5-4c8d-bac1-bfb7eb07b586","subject":"ATTACK:enterprise:S0203","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1c0e8084-c8a5-4c8d-bac1-bfb7eb07b586","modified":"2026-04-29T14:23:05.943Z","references":[{"source_name":"Symantec Hydraq Persistence Jan 2010","url":"https://www.symantec.com/connect/blogs/how-trojanhydraq-stays-your-computer"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--21c271aa-7bdd-44ea-afd0-ca3f542ee425","subject":"ATTACK:enterprise:S1063","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--21c271aa-7bdd-44ea-afd0-ca3f542ee425","modified":"2026-04-29T14:23:05.951Z","references":[{"source_name":"Palo Alto Brute Ratel July 2022","url":"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--235a7fee-dfe1-4812-b553-e88bc9d56e89","subject":"ATTACK:enterprise:S0368","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--235a7fee-dfe1-4812-b553-e88bc9d56e89","modified":"2026-04-29T14:23:05.953Z","references":[{"source_name":"Talos Nyetya June 2017","url":"https://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html"},{"source_name":"US-CERT NotPetya 2017","url":"https://www.us-cert.gov/ncas/alerts/TA17-181A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--23f36f2f-9bc4-4c95-a75b-65e5c74aed88","subject":"ATTACK:enterprise:G0114","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--23f36f2f-9bc4-4c95-a75b-65e5c74aed88","modified":"2026-07-31T20:48:41.201Z","references":[{"source_name":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--292248d9-30b0-4de3-9041-407db4e78f78","subject":"ATTACK:enterprise:S0166","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--292248d9-30b0-4de3-9041-407db4e78f78","modified":"2026-04-29T14:23:05.961Z","references":[{"source_name":"Symantec Buckeye","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--29c9b21f-7ea0-48f0-bd90-978d4f37813f","subject":"ATTACK:enterprise:S0698","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--29c9b21f-7ea0-48f0-bd90-978d4f37813f","modified":"2026-04-29T14:23:05.962Z","references":[{"source_name":"ESET Hermetic Wizard March 2022","url":"https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2ebf0505-4b0a-4e17-b303-b860585f7c11","subject":"ATTACK:enterprise:S0668","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2ebf0505-4b0a-4e17-b303-b860585f7c11","modified":"2026-04-29T14:23:05.968Z","references":[{"source_name":"Talos TinyTurla September 2021","url":"https://blog.talosintelligence.com/2021/09/tinyturla.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--341ef3b2-3f92-4ea1-b36f-93fdb1d15816","subject":"ATTACK:enterprise:S0606","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--341ef3b2-3f92-4ea1-b36f-93fdb1d15816","modified":"2026-04-29T14:23:05.989Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--347de212-26bf-4ad4-963f-c4dfa3c821d1","subject":"ATTACK:enterprise:S0481","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--347de212-26bf-4ad4-963f-c4dfa3c821d1","modified":"2026-04-29T14:23:05.989Z","references":[{"source_name":"Sophos Ragnar May 2020","url":"https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--364be248-6fa2-42a2-847b-35e6f43fd06d","subject":"ATTACK:enterprise:G0087","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--364be248-6fa2-42a2-847b-35e6f43fd06d","modified":"2026-07-31T18:47:53.304Z","references":[{"source_name":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"},{"source_name":"Symantec Chafer February 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--37b7ba1e-5093-4a0d-920b-c86d3c9c766b","subject":"ATTACK:enterprise:S0378","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--37b7ba1e-5093-4a0d-920b-c86d3c9c766b","modified":"2026-04-29T14:23:05.996Z","references":[{"source_name":"GitHub PoshC2","url":"https://github.com/nettitude/PoshC2_Python"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--395cee0e-ee8b-4e90-b2a7-f3a271ef0b1a","subject":"ATTACK:enterprise:S1060","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--395cee0e-ee8b-4e90-b2a7-f3a271ef0b1a","modified":"2026-04-29T14:23:05.999Z","references":[{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3d6d167f-6a45-4e4f-8576-6f7713444acd","subject":"ATTACK:enterprise:S1202","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3d6d167f-6a45-4e4f-8576-6f7713444acd","modified":"2026-04-29T14:23:06.009Z","references":[{"source_name":"Joint Cybersecurity Advisory LockBit JUN 2023","url":"https://www.cisa.gov/sites/default/files/2023-06/aa23-165a_understanding_TA_LockBit_0.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3f416bd3-a06f-4ec2-8cf6-4a84e0611c63","subject":"ATTACK:enterprise:S0123","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3f416bd3-a06f-4ec2-8cf6-4a84e0611c63","modified":"2026-04-29T14:23:06.011Z","references":[{"source_name":"xCmd","url":"https://ashwinrayaprolu.wordpress.com/2011/04/12/xcmd-an-alternative-to-psexec/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--421f569c-e961-4112-a527-1aa5cabd37a1","subject":"ATTACK:enterprise:M1040","predicate":"mitigates","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--421f569c-e961-4112-a527-1aa5cabd37a1","modified":"2026-04-29T14:23:06.015Z","references":[{"source_name":"win10_asr","url":"https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4d7faa7b-2fd2-4c40-89c2-e8171055733c","subject":"ATTACK:enterprise:C0014","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4d7faa7b-2fd2-4c40-89c2-e8171055733c","modified":"2026-07-31T18:47:31.554Z","references":[{"source_name":"FoxIT Wocao December 2019","url":"https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5765c7d1-884f-4d6d-a938-4a92c86a9e21","subject":"ATTACK:enterprise:S0191","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5765c7d1-884f-4d6d-a938-4a92c86a9e21","modified":"2026-04-29T14:23:06.044Z","references":[{"source_name":"Secpod Winexe June 2017","url":"https://web.archive.org/web/20211019012628/https://www.secpod.com/blog/winexe/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--59b39f06-a71c-42f7-92f2-244a183113d6","subject":"ATTACK:enterprise:S0127","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--59b39f06-a71c-42f7-92f2-244a183113d6","modified":"2026-04-29T14:23:06.047Z","references":[{"source_name":"Palo Alto Networks BBSRAT","url":"http://researchcenter.paloaltonetworks.com/2015/12/bbsrat-attacks-targeting-russian-organizations-linked-to-roaming-tiger/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5c0b2098-6f0d-4c99-ac9d-bb3ea4ca9d52","subject":"ATTACK:enterprise:S0660","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5c0b2098-6f0d-4c99-ac9d-bb3ea4ca9d52","modified":"2026-04-29T14:23:06.051Z","references":[{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5d6984fc-52cb-429b-9e68-64e656d9ad30","subject":"ATTACK:enterprise:S0238","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5d6984fc-52cb-429b-9e68-64e656d9ad30","modified":"2026-04-29T14:23:06.053Z","references":[{"source_name":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5fc0ca38-bb65-43ab-b8b2-6861442b25a8","subject":"ATTACK:enterprise:S0039","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5fc0ca38-bb65-43ab-b8b2-6861442b25a8","modified":"2026-04-29T14:23:06.055Z","references":[{"source_name":"Savill 1999","url":"https://web.archive.org/web/20150511162820/http://windowsitpro.com/windows/netexe-reference"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--606d0114-e9a5-49a6-a6b9-0f67da987969","subject":"ATTACK:enterprise:S0533","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--606d0114-e9a5-49a6-a6b9-0f67da987969","modified":"2026-04-29T14:23:06.056Z","references":[{"source_name":"CISA MAR SLOTHFULMEDIA October 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--619998d9-cbe8-40b1-ad0e-bc47f9c8037a","subject":"ATTACK:enterprise:G0046","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--619998d9-cbe8-40b1-ad0e-bc47f9c8037a","modified":"2026-07-31T20:48:31.944Z","references":[{"source_name":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6397d645-207c-4d1b-9a65-5f1b69a84e7c","subject":"ATTACK:enterprise:S0032","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6397d645-207c-4d1b-9a65-5f1b69a84e7c","modified":"2026-04-29T14:23:06.060Z","references":[{"source_name":"Gh0stRAT ATT March 2019","url":"https://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6bbb4292-0496-412d-8277-af752703c46a","subject":"ATTACK:enterprise:G1032","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6bbb4292-0496-412d-8277-af752703c46a","modified":"2026-07-31T20:48:47.685Z","references":[{"source_name":"Huntress INC Ransom Group August 2023","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6c1da156-9a34-4aa4-a57a-b376edb8707e","subject":"ATTACK:enterprise:G1047","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6c1da156-9a34-4aa4-a57a-b376edb8707e","modified":"2026-07-31T18:48:23.997Z","references":[{"source_name":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6d137f11-8f05-45e8-960c-d64bc14167be","subject":"ATTACK:enterprise:T1569.002","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1569","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6d137f11-8f05-45e8-960c-d64bc14167be","modified":"2026-04-29T14:23:06.073Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6e1e5bab-151b-4be9-9c96-5cb4c66ff540","subject":"ATTACK:enterprise:S0357","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6e1e5bab-151b-4be9-9c96-5cb4c66ff540","modified":"2026-04-29T14:23:06.075Z","references":[{"source_name":"Impacket Tools","url":"https://www.secureauth.com/labs/open-source-tools/impacket"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--737788fa-f921-4147-9148-c39228f76e85","subject":"ATTACK:enterprise:S0398","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--737788fa-f921-4147-9148-c39228f76e85","modified":"2026-04-29T14:23:06.083Z","references":[{"source_name":"Unit42 Emissary Panda May 2019","url":"https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--73a53379-746e-46db-b101-1fc45df5e458","subject":"ATTACK:enterprise:S0140","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--73a53379-746e-46db-b101-1fc45df5e458","modified":"2026-04-29T14:23:06.083Z","references":[{"source_name":"Palo Alto Shamoon Nov 2016","url":"http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/"},{"source_name":"McAfee Shamoon December19 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-attackers-employ-new-tool-kit-to-wipe-infected-systems/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7447ce8c-6c1a-497e-86d5-1adf960e23a3","subject":"ATTACK:enterprise:S0363","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7447ce8c-6c1a-497e-86d5-1adf960e23a3","modified":"2026-04-29T14:23:06.084Z","references":[{"source_name":"Github PowerShell Empire","url":"https://github.com/PowerShellEmpire/Empire"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--83140b4e-03aa-4f6f-ad80-d1080ffafae4","subject":"ATTACK:enterprise:C0061","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--83140b4e-03aa-4f6f-ad80-d1080ffafae4","modified":"2026-07-31T18:47:24.645Z","references":[{"source_name":"sentinelone operationDigitalEye Dec 2024","url":"https://www.sentinelone.com/labs/operation-digital-eye-chinese-apt-compromises-critical-digital-infrastructure-via-visual-studio-code-tunnels/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8483ad9a-84c9-4c83-a4d7-d403e44735dc","subject":"ATTACK:enterprise:S0439","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8483ad9a-84c9-4c83-a4d7-d403e44735dc","modified":"2026-04-29T14:23:06.106Z","references":[{"source_name":"ESET Okrum July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--84dc2fd1-a443-4ce6-866a-c58cffc1b0f3","subject":"ATTACK:enterprise:G0096","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--84dc2fd1-a443-4ce6-866a-c58cffc1b0f3","modified":"2026-07-31T20:48:27.245Z","references":[{"source_name":"FireEye APT41 March 2020","url":"https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"},{"source_name":"Group IB APT 41 June 2021","url":"https://www.group-ib.com/blog/colunmtk-apt41/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--84fd38cb-2310-4cac-abdd-6418223bc51c","subject":"ATTACK:enterprise:S9051","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--84fd38cb-2310-4cac-abdd-6418223bc51c","modified":"2026-09-23T17:07:52.341Z","references":[{"source_name":"MSTI_GentelmenRansomware_May2026","url":"https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--85be49ac-785e-48af-8d0e-4b74818428fc","subject":"ATTACK:enterprise:G0091","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--85be49ac-785e-48af-8d0e-4b74818428fc","modified":"2026-07-31T18:48:21.248Z","references":[{"source_name":"SecureList Silence Nov 2017","url":"https://securelist.com/the-silence/83009/"},{"source_name":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8bfa94cf-4eeb-442c-8f18-25b07cd3cbf5","subject":"ATTACK:enterprise:G0004","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8bfa94cf-4eeb-442c-8f18-25b07cd3cbf5","modified":"2026-07-31T18:48:01.364Z","references":[{"source_name":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8c0f1ff3-4188-423d-ae8c-19f799a9fb73","subject":"ATTACK:enterprise:G1051","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8c0f1ff3-4188-423d-ae8c-19f799a9fb73","modified":"2026-07-31T18:48:10.757Z","references":[{"source_name":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source_name":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8dc7e200-3c90-4611-9bbe-aa90056f423e","subject":"ATTACK:enterprise:G0108","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8dc7e200-3c90-4611-9bbe-aa90056f423e","modified":"2026-07-31T18:48:02.868Z","references":[{"source_name":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8eed7d01-46dc-4b25-a42d-bd9afcb84963","subject":"ATTACK:enterprise:S0376","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8eed7d01-46dc-4b25-a42d-bd9afcb84963","modified":"2026-04-29T14:23:06.120Z","references":[{"source_name":"US-CERT HOPLIGHT Apr 2019","url":"https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--90febb12-39b4-4138-99da-93f1e987ac2a","subject":"ATTACK:enterprise:S0689","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--90febb12-39b4-4138-99da-93f1e987ac2a","modified":"2026-04-29T14:23:06.123Z","references":[{"source_name":"Unit 42 WhisperGate January 2022","url":"https://unit42.paloaltonetworks.com/ukraine-cyber-conflict-cve-2021-32648-whispergate/#whispergate-malware-family"},{"source_name":"Medium S2W WhisperGate January 2022","url":"https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--91ca1017-0b33-4fa1-a61f-b3dae24c7e40","subject":"ATTACK:enterprise:S0176","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--91ca1017-0b33-4fa1-a61f-b3dae24c7e40","modified":"2026-04-29T14:23:06.124Z","references":[{"source_name":"Microsoft SIR Vol 21","url":"http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf"},{"source_name":"Microsoft Wingbird Nov 2017","url":"https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Wingbird.A!dha"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--927a3c20-7d5c-42ac-97c8-e3546a11c411","subject":"ATTACK:enterprise:S1134","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--927a3c20-7d5c-42ac-97c8-e3546a11c411","modified":"2026-04-29T14:23:06.125Z","references":[{"source_name":"SentinelOne Agrius 2021","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9453d60b-4f3f-494f-985d-e29094ef8945","subject":"ATTACK:enterprise:S0056","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9453d60b-4f3f-494f-985d-e29094ef8945","modified":"2026-04-29T14:23:06.127Z","references":[{"source_name":"Cylance Cleaver","url":"https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--94824fdd-25fa-4d23-9220-825f04c4bcc6","subject":"ATTACK:enterprise:S0451","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--94824fdd-25fa-4d23-9220-825f04c4bcc6","modified":"2026-04-29T14:23:06.127Z","references":[{"source_name":"ESET LoudMiner June 2019","url":"https://www.welivesecurity.com/2019/06/20/loudminer-mining-cracked-vst-software/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--96417d00-2a6b-4a22-b43c-f65cb60da952","subject":"ATTACK:enterprise:S0583","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--96417d00-2a6b-4a22-b43c-f65cb60da952","modified":"2026-04-29T14:23:06.130Z","references":[{"source_name":"CERT-FR PYSA April 2020","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-003.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--968911f0-2158-4c76-9fab-562a00ecc418","subject":"ATTACK:enterprise:C0006","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--968911f0-2158-4c76-9fab-562a00ecc418","modified":"2026-07-31T18:47:20.790Z","references":[{"source_name":"McAfee Honeybee","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9aebe474-f443-4007-bb8d-dc7c9f22d5f9","subject":"ATTACK:enterprise:S0141","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9aebe474-f443-4007-bb8d-dc7c9f22d5f9","modified":"2026-04-29T14:23:06.136Z","references":[{"source_name":"Novetta Winnti April 2015","url":"https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a491cb90-9480-450b-9a57-55b95b249d31","subject":"ATTACK:enterprise:G0050","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a491cb90-9480-450b-9a57-55b95b249d31","modified":"2026-07-31T18:47:45.174Z","references":[{"source_name":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a55e0219-f440-4523-9bfa-00c562824005","subject":"ATTACK:enterprise:S0664","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a55e0219-f440-4523-9bfa-00c562824005","modified":"2026-04-29T14:23:06.150Z","references":[{"source_name":"Trend Micro Iron Tiger April 2021","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a66aff09-0635-44a3-b591-a530a25c9012","subject":"ATTACK:enterprise:S0029","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a66aff09-0635-44a3-b591-a530a25c9012","modified":"2026-04-29T14:23:06.152Z","references":[{"source_name":"Russinovich Sysinternals","url":"https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a7aa8345-4b70-43aa-924c-bb7d1caf2c7f","subject":"ATTACK:enterprise:G1043","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a7aa8345-4b70-43aa-924c-bb7d1caf2c7f","modified":"2026-07-31T18:47:36.380Z","references":[{"source_name":"Cisco BlackByte 2024","url":"https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/"},{"source_name":"Symantec BlackByte 2022","url":"https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aaa2f519-62f6-4dcb-8193-6ed33b8ff4ab","subject":"ATTACK:enterprise:S0250","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aaa2f519-62f6-4dcb-8193-6ed33b8ff4ab","modified":"2026-04-29T14:23:06.157Z","references":[{"source_name":"Github Koadic","url":"https://github.com/offsecginger/koadic"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b106e9ad-dbde-43c7-a38d-da5c87e1da05","subject":"ATTACK:enterprise:G0037","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b106e9ad-dbde-43c7-a38d-da5c87e1da05","modified":"2026-07-31T20:48:31.032Z","references":[{"source_name":"FireEye FIN6 Apr 2019","url":"https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c05978ea-b814-473e-a073-9bae9ab7695b","subject":"ATTACK:enterprise:S0438","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c05978ea-b814-473e-a073-9bae9ab7695b","modified":"2026-04-29T14:23:06.188Z","references":[{"source_name":"ESET Attor Oct 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c24808aa-a503-459a-b867-a44b55fbd6bf","subject":"ATTACK:enterprise:S1132","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c24808aa-a503-459a-b867-a44b55fbd6bf","modified":"2026-04-29T14:23:06.191Z","references":[{"source_name":"SentinelOne Agrius 2021","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c2d27932-5a39-46ed-ab21-c1b2f02dee15","subject":"ATTACK:enterprise:C0040","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c2d27932-5a39-46ed-ab21-c1b2f02dee15","modified":"2026-07-31T18:47:30.654Z","references":[{"source_name":"Google Cloud APT41 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c992481b-fe93-416d-b8a3-c5ed752c17f4","subject":"ATTACK:enterprise:S0365","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c992481b-fe93-416d-b8a3-c5ed752c17f4","modified":"2026-04-29T14:23:06.201Z","references":[{"source_name":"Talos Olympic Destroyer 2018","url":"https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ceadf11d-d89c-4ec6-a7a2-fe842570bb4c","subject":"ATTACK:enterprise:S0612","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ceadf11d-d89c-4ec6-a7a2-fe842570bb4c","modified":"2026-04-29T14:23:06.208Z","references":[{"source_name":"NCC Group WastedLocker June 2020","url":"https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cfc5761e-2c94-420a-a985-a4a1d7fe0b7c","subject":"ATTACK:enterprise:G1036","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cfc5761e-2c94-420a-a985-a4a1d7fe0b7c","modified":"2026-07-31T18:48:25.015Z","references":[{"source_name":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d107e5fd-53fc-478d-9040-85087070d7ff","subject":"ATTACK:enterprise:M1022","predicate":"mitigates","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d107e5fd-53fc-478d-9040-85087070d7ff","modified":"2026-04-29T14:23:06.211Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d5e069df-6933-417e-b62d-6c8701438382","subject":"ATTACK:enterprise:C0058","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d5e069df-6933-417e-b62d-6c8701438382","modified":"2026-07-31T18:47:19.130Z","references":[{"source_name":"Microsoft SharePoint Exploit JUL 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/#storm-2603"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--db7a1676-ec8d-41af-a392-2ee2e0b4d31d","subject":"ATTACK:enterprise:S1181","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--db7a1676-ec8d-41af-a392-2ee2e0b4d31d","modified":"2026-04-29T14:23:06.225Z","references":[{"source_name":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--db85221a-3d34-4e8d-bcb1-95b507617b84","subject":"ATTACK:enterprise:S0697","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--db85221a-3d34-4e8d-bcb1-95b507617b84","modified":"2026-04-29T14:23:06.225Z","references":[{"source_name":"Qualys Hermetic Wiper March 2022","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/03/01/ukrainian-targets-hit-by-hermeticwiper-new-datawiper-malware"},{"source_name":"SentinelOne Hermetic Wiper February 2022","url":"https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack"},{"source_name":"Crowdstrike DriveSlayer February 2022","url":"https://www.crowdstrike.com/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dda9f6bb-eb66-422b-aa58-fede809b6a6a","subject":"ATTACK:enterprise:S0457","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dda9f6bb-eb66-422b-aa58-fede809b6a6a","modified":"2026-04-29T14:23:06.228Z","references":[{"source_name":"Sophos Netwalker May 2020","url":"https://news.sophos.com/en-us/2020/05/27/netwalker-ransomware-tools-give-insight-into-threat-actor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e63477f0-9081-4633-a375-8cb72320f4ad","subject":"ATTACK:enterprise:S1247","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e63477f0-9081-4633-a375-8cb72320f4ad","modified":"2026-04-29T14:23:06.238Z","references":[{"source_name":"ESET Embargo Ransomware October 2024","url":"https://www.welivesecurity.com/en/eset-research/embargo-ransomware-rocknrust/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e7b10c00-0860-4592-a72c-e14e993e972b","subject":"ATTACK:enterprise:S0491","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e7b10c00-0860-4592-a72c-e14e993e972b","modified":"2026-09-03T14:50:24.144Z","references":[{"source_name":"Talos Promethium June 2020","url":"https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"},{"source_name":"Bitdefender StrongPity June 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e7fd3986-ae47-4301-9299-a3f8be437d03","subject":"ATTACK:enterprise:S0663","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e7fd3986-ae47-4301-9299-a3f8be437d03","modified":"2026-04-29T14:23:06.241Z","references":[{"source_name":"Trend Micro Iron Tiger April 2021","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ed40dd97-0ad0-4501-8f1e-a4bd4625432d","subject":"ATTACK:enterprise:S0412","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ed40dd97-0ad0-4501-8f1e-a4bd4625432d","modified":"2026-04-29T14:23:06.248Z","references":[{"source_name":"Talos ZxShell Oct 2014","url":"https://blogs.cisco.com/security/talos/opening-zxshell"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--efaecf33-d565-40fa-baf5-976138f6c883","subject":"ATTACK:enterprise:G0082","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--efaecf33-d565-40fa-baf5-976138f6c883","modified":"2026-09-30T20:58:55.711Z","references":[{"source_name":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"},{"source_name":"MIcrosoft Mastra npm Compromise JUN 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f3b210e4-9784-4305-8cad-6bdb4d44250f","subject":"ATTACK:enterprise:G0102","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f3b210e4-9784-4305-8cad-6bdb4d44250f","modified":"2026-07-31T20:48:50.598Z","references":[{"source_name":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"},{"source_name":"DFIR Ryuk in 5 Hours October 2020","url":"https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/"},{"source_name":"DFIR Ryuk's Return October 2020","url":"https://thedfirreport.com/2020/10/08/ryuks-return/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f71de781-3899-46ad-9c57-a63f683afab2","subject":"ATTACK:enterprise:S0504","predicate":"uses","object":"ATTACK:enterprise:T1569.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f71de781-3899-46ad-9c57-a63f683afab2","modified":"2026-04-29T14:23:06.261Z","references":[{"source_name":"Cyberreason Anchor December 2019","url":"https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"},{"source_name":"Medium Anchor DNS July 2020","url":"https://medium.com/stage-2-security/anchor-dns-malware-family-goes-cross-platform-d807ba13ca30"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}