{"record":{"id":"ATTACK:enterprise:G0032","title":"Lazarus Group","type":"IntrusionSet","source_url":"https://attack.mitre.org/groups/G0032","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"intrusion-set--c93fccb1-e8e8-42cf-ae33-2ad1d183913a","external_id":"G0032","domain":"enterprise","created":"2017-05-31T21:32:03.807Z","modified":"2026-07-31T20:48:46.106Z","version":"5.0","aliases":["Lazarus Group","Labyrinth Chollima","HIDDEN COBRA","Guardians of Peace","ZINC","NICKEL ACADEMY","Diamond Sleet"],"tactics":[],"source_references":[{"source_name":"Labyrinth Chollima"},{"source_name":"Diamond Sleet"},{"source_name":"ZINC"},{"source_name":"Lazarus Group"},{"source_name":"NICKEL ACADEMY"},{"source_name":"Guardians of Peace"},{"source_name":"CrowdStrike Labyrinth Chollima Feb 2022","url":"https://web.archive.org/web/20210723190317/https://adversary.crowdstrike.com/en-US/adversary/labyrinth-chollima/"},{"source_name":"Mandiant DPRK Groups 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/north-korea-cyber-structure-alignment-2023"},{"source_name":"Mandiant DPRK Laz Org Breakdown 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/mapping-dprk-groups-to-government/"},{"source_name":"Microsoft Threat Actor Naming July 2023","url":"https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"Secureworks NICKEL ACADEMY Dec 2017","url":"https://www.secureworks.com/about/press/media-alert-secureworks-discovers-north-korean-cyber-threat-group-lazarus-spearphishing"},{"source_name":"Microsoft ZINC disruption Dec 2017","url":"https://blogs.microsoft.com/on-the-issues/2017/12/19/microsoft-facebook-disrupt-zinc-malware-attack-protect-customers-internet-ongoing-cyberthreats/"},{"source_name":"HIDDEN COBRA"},{"source_name":"Treasury North Korean Cyber Groups September 2019","url":"https://home.treasury.gov/news/press-releases/sm774"},{"source_name":"US-CERT HIDDEN COBRA June 2017","url":"https://www.us-cert.gov/ncas/alerts/TA17-164A"},{"source_name":"US-CERT HOPLIGHT Apr 2019","url":"https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"},{"source_name":"JPCert Blog Laz Subgroups 2025","url":"https://blogs.jpcert.or.jp/en/2025/03/classifying-lazaruss-subgroup.html"}]},"assertions":[{"id":"enterprise:relationship--00e9a38d-6dc5-4d67-b2fe-977b1c7d17dd","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0364","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--00e9a38d-6dc5-4d67-b2fe-977b1c7d17dd","modified":"2026-07-31T20:48:46.352Z","references":[{"source_name":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--032981a6-3299-4852-bd9c-c691f866bec5","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1059.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--032981a6-3299-4852-bd9c-c691f866bec5","modified":"2026-07-31T20:48:46.362Z","references":[{"source_name":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source_name":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"},{"source_name":"US-CERT SHARPKNOT June 2018","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--061841f1-5814-41e3-94b5-536b8a52d062","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1566.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--061841f1-5814-41e3-94b5-536b8a52d062","modified":"2026-07-31T20:48:46.375Z","references":[{"source_name":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"McAfee Bankshot","url":"https://securingtomorrow.mcafee.com/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/"},{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--09710ce1-9ed9-4c25-a86f-0a481174cc0d","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1202","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--09710ce1-9ed9-4c25-a86f-0a481174cc0d","modified":"2026-07-31T20:48:46.384Z","references":[{"source_name":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--09c957e3-f89b-4b41-93af-bde08f00ce36","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0238","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--09c957e3-f89b-4b41-93af-bde08f00ce36","modified":"2026-07-31T20:48:46.391Z","references":[{"source_name":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0a8ee649-e907-4a73-8513-3019b2d771a0","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1048.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0a8ee649-e907-4a73-8513-3019b2d771a0","modified":"2026-09-03T19:46:47.418Z","references":[{"source_name":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0b255cef-7177-48b8-ade1-752314f90b7e","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1001.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0b255cef-7177-48b8-ade1-752314f90b7e","modified":"2026-09-03T19:46:47.654Z","references":[{"source_name":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"McAfee-GhostSecret-fixurl","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0dcce53a-3ac1-4528-8c34-f85569638740","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1584.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0dcce53a-3ac1-4528-8c34-f85569638740","modified":"2026-07-31T20:48:46.415Z","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--115562b8-9d7c-435e-af6e-0be6249742d0","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1105","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--115562b8-9d7c-435e-af6e-0be6249742d0","modified":"2026-09-03T19:46:56.701Z","references":[{"source_name":"ESET Twitter Ida Pro Nov 2021","url":"https://x.com/ESETresearch/status/1458438155149922312"},{"source_name":"TrendMicro macOS Dacls May 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/"},{"source_name":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"SentinelOne Lazarus macOS July 2020","url":"https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/"},{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"},{"source_name":"Google TAG Lazarus Jan 2021","url":"https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--12c617b6-9c95-46fd-a3ef-845be82ac237","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1218.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--12c617b6-9c95-46fd-a3ef-845be82ac237","modified":"2026-07-31T20:48:46.436Z","references":[{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--170e2f76-5b6a-4eee-8ea4-d1171368b4a9","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1010","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--170e2f76-5b6a-4eee-8ea4-d1171368b4a9","modified":"2026-07-31T20:48:46.444Z","references":[{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster Tools","url":"https://web.archive.org/web/20220425194457/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1754cf51-f712-4e7c-9108-fa276b9f1543","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1587.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1754cf51-f712-4e7c-9108-fa276b9f1543","modified":"2026-07-31T20:48:46.452Z","references":[{"source_name":"CISA AppleJeus Feb 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-048a"},{"source_name":"Google TAG Lazarus Jan 2021","url":"https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1a40426a-355c-4d7e-b51c-e95a102b31e2","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1134.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1a40426a-355c-4d7e-b51c-e95a102b31e2","modified":"2026-07-31T20:48:46.459Z","references":[{"source_name":"Novetta Blockbuster Tools","url":"https://web.archive.org/web/20220425194457/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1c12b31e-7f17-4e00-a6b5-7eddb5828f34","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0245","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1c12b31e-7f17-4e00-a6b5-7eddb5828f34","modified":"2026-07-31T20:48:46.467Z","references":[{"source_name":"US-CERT BADCALL","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-G.PDF"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1cf34ba1-c2e4-4277-86fc-b511ae416a0e","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1021.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1cf34ba1-c2e4-4277-86fc-b511ae416a0e","modified":"2026-07-31T20:48:46.474Z","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--216c15b0-3091-49f2-ba85-356d56265671","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0181","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--216c15b0-3091-49f2-ba85-356d56265671","modified":"2026-07-31T20:48:46.482Z","references":[{"source_name":"US-CERT FALLCHILL Nov 2017","url":"https://www.us-cert.gov/ncas/alerts/TA17-318A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2325c0b2-fb89-44e1-9206-e495811f2907","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1098","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2325c0b2-fb89-44e1-9206-e495811f2907","modified":"2026-07-31T20:48:46.489Z","references":[{"source_name":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2426519f-c915-4c8f-8164-0d93dbbf0be1","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1564.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2426519f-c915-4c8f-8164-0d93dbbf0be1","modified":"2026-07-31T20:48:46.497Z","references":[{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source_name":"SentinelOne Lazarus macOS July 2020","url":"https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/"},{"source_name":"TrendMicro macOS Dacls May 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/"},{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--25e7ca82-2784-433a-90a9-a3483615a655","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0366","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--25e7ca82-2784-433a-90a9-a3483615a655","modified":"2026-07-31T20:48:46.507Z","references":[{"source_name":"FireEye WannaCry 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html"},{"source_name":"SecureWorks WannaCry Analysis","url":"https://www.secureworks.com/research/wcry-ransomware-analysis"},{"source_name":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"},{"source_name":"LogRhythm WannaCry","url":"https://web.archive.org/web/20230522041200/https://logrhythm.com/blog/a-technical-analysis-of-wannacry-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--27323a25-ef80-4519-b934-19f5ff090c70","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1485","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--27323a25-ef80-4519-b934-19f5ff090c70","modified":"2026-07-31T20:48:46.516Z","references":[{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2b9855a9-f381-4a3e-a0c2-80310374b165","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1591","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2b9855a9-f381-4a3e-a0c2-80310374b165","modified":"2026-07-31T20:48:46.524Z","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2c131932-4632-4866-845f-212cbe29756d","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1106","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2c131932-4632-4866-845f-212cbe29756d","modified":"2026-07-31T20:48:46.532Z","references":[{"source_name":"McAfee Lazarus Jul 2020","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-a-job-offer-thats-too-good-to-be-true/?hilite=%27Operation%27%2C%27North%27%2C%27Star%27"},{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2c9c331c-0e39-43ad-95e4-38957ad7b956","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1078","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2c9c331c-0e39-43ad-95e4-38957ad7b956","modified":"2026-07-31T20:48:46.540Z","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--324d5c17-a282-4a61-8fad-50ab914f425c","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1027.009","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--324d5c17-a282-4a61-8fad-50ab914f425c","modified":"2026-07-31T20:48:46.555Z","references":[{"source_name":"Microsoft DiamondSleet 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/11/22/diamond-sleet-supply-chain-compromise-distributes-a-modified-cyberlink-installer/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--34bba6a3-6e01-4895-8eb6-df0ba2fab222","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S1182","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--34bba6a3-6e01-4895-8eb6-df0ba2fab222","modified":"2026-07-31T20:48:46.563Z","references":[{"source_name":"Cisco MagicRAT 2022","url":"https://blog.talosintelligence.com/lazarus-magicrat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--35305a51-69ac-4fe2-b9e2-3c9a296e9f9b","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0376","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--35305a51-69ac-4fe2-b9e2-3c9a296e9f9b","modified":"2026-07-31T20:48:46.570Z","references":[{"source_name":"US-CERT HOPLIGHT Apr 2019","url":"https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3933f2fa-9154-4ab4-b9cc-975a1dfbecf5","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0263","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3933f2fa-9154-4ab4-b9cc-975a1dfbecf5","modified":"2026-07-31T20:48:46.578Z","references":[{"source_name":"US-CERT TYPEFRAME June 2018","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--39b735d3-c659-4d1a-8e7e-082c0f049c2d","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1012","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--39b735d3-c659-4d1a-8e7e-082c0f049c2d","modified":"2026-07-31T20:48:46.587Z","references":[{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--39fdd17c-5f59-4daf-bf14-95841b5ec248","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1090.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--39fdd17c-5f59-4daf-bf14-95841b5ec248","modified":"2026-09-08T20:29:09.573Z","references":[{"source_name":"US-CERT FALLCHILL Nov 2017","url":"https://www.us-cert.gov/ncas/alerts/TA17-318A"},{"source_name":"TrendMicro macOS Dacls May 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3afd226c-934f-44fd-8194-9a6dee5cba59","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1027.013","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3afd226c-934f-44fd-8194-9a6dee5cba59","modified":"2026-07-31T20:48:46.603Z","references":[{"source_name":"TrendMicro macOS Dacls May 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/"},{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3b24afd4-b13b-4c73-bb20-aeff4a44574c","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0567","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3b24afd4-b13b-4c73-bb20-aeff4a44574c","modified":"2026-07-31T20:48:46.612Z","references":[{"source_name":"Kaspersky Dtrack","url":"https://usa.kaspersky.com/about/press-releases/2019_dtrack-previously-unknown-spy-tool-hits-financial-institutions-and-research-centers"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3cf183ef-05aa-47ad-b691-654c0648326a","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1104","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3cf183ef-05aa-47ad-b691-654c0648326a","modified":"2026-07-31T20:48:46.619Z","references":[{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3faf013a-e1c4-494a-b2a1-6e9abef908b9","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1046","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3faf013a-e1c4-494a-b2a1-6e9abef908b9","modified":"2026-07-31T20:48:46.626Z","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3fe9b64a-6435-4592-9181-2ad50ee93044","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3fe9b64a-6435-4592-9181-2ad50ee93044","modified":"2026-07-31T20:48:46.634Z","references":[{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--411aae3a-f612-41bb-b2f0-1639d2cbc290","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1489","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--411aae3a-f612-41bb-b2f0-1639d2cbc290","modified":"2026-07-31T20:48:46.642Z","references":[{"source_name":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4189f5b4-4c57-452a-a3fb-da5988804feb","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1016","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4189f5b4-4c57-452a-a3fb-da5988804feb","modified":"2026-07-31T20:48:46.649Z","references":[{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--41c193c1-8269-4a2e-9ed8-9dd51489a03f","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1588.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--41c193c1-8269-4a2e-9ed8-9dd51489a03f","modified":"2026-07-31T20:48:46.659Z","references":[{"source_name":"CISA AppleJeus Feb 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-048a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4b66e057-adbc-498d-99ee-156e0d17bd53","subject":"ATTACK:enterprise:C0022","predicate":"attributed-to","object":"ATTACK:enterprise:G0032","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4b66e057-adbc-498d-99ee-156e0d17bd53","modified":"2026-07-31T21:14:22.562Z","references":[{"source_name":"McAfee Lazarus Nov 2020","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/"},{"source_name":"ESET Lazarus Jun 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_Operation_Interception.pdf"},{"source_name":"McAfee Lazarus Jul 2020","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-a-job-offer-thats-too-good-to-be-true/?hilite=%27Operation%27%2C%27North%27%2C%27Star%27"},{"source_name":"ClearSky Lazarus Aug 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4c06e313-2cde-494c-a8dc-449649a1afa6","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4c06e313-2cde-494c-a8dc-449649a1afa6","modified":"2026-09-02T20:07:46.646Z","references":[{"source_name":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source_name":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4eec017c-8bf2-4eda-8c92-15926fc7e5aa","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1082","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4eec017c-8bf2-4eda-8c92-15926fc7e5aa","modified":"2026-07-31T20:48:46.682Z","references":[{"source_name":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source_name":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--500130c0-d049-4e67-9bcc-d60a5f6dfd4c","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1033","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--500130c0-d049-4e67-9bcc-d60a5f6dfd4c","modified":"2026-07-31T20:48:46.690Z","references":[{"source_name":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source_name":"SentinelOne Lazarus macOS July 2020","url":"https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--510616c2-f124-49b2-83a2-cac81d2d4155","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1620","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--510616c2-f124-49b2-83a2-cac81d2d4155","modified":"2026-07-31T20:48:46.699Z","references":[{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--520f5440-740f-4efe-850e-ea4db340aef1","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--520f5440-740f-4efe-850e-ea4db340aef1","modified":"2026-09-03T19:46:58.858Z","references":[{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--53a66a44-0620-4edc-bb9d-c40cfcb17546","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1102.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--53a66a44-0620-4edc-bb9d-c40cfcb17546","modified":"2026-09-03T19:46:49.822Z","references":[{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--552ac18c-4fac-4cb0-aefc-811a10e1c320","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--552ac18c-4fac-4cb0-aefc-811a10e1c320","modified":"2026-07-31T20:48:46.721Z","references":[{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5a0ce8c4-e941-4bd0-8e70-6ca440a29b9d","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1203","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5a0ce8c4-e941-4bd0-8e70-6ca440a29b9d","modified":"2026-07-31T20:48:46.732Z","references":[{"source_name":"McAfee Bankshot","url":"https://securingtomorrow.mcafee.com/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5df525ae-d983-4fde-ac10-b07a820d9046","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1059.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5df525ae-d983-4fde-ac10-b07a820d9046","modified":"2026-07-31T20:48:46.739Z","references":[{"source_name":"Google TAG Lazarus Jan 2021","url":"https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5e28da21-d977-4488-a8dc-10bad0833374","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1566.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5e28da21-d977-4488-a8dc-10bad0833374","modified":"2026-07-31T20:48:46.746Z","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5f055076-79d1-44e8-95cb-43fc515df2f6","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5f055076-79d1-44e8-95cb-43fc515df2f6","modified":"2026-07-31T20:48:46.754Z","references":[{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--636c3816-21ed-46f7-8837-2334bed88e42","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0431","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--636c3816-21ed-46f7-8837-2334bed88e42","modified":"2026-07-31T20:48:46.762Z","references":[{"source_name":"US-CERT HOTCROISSANT February 2020","url":"https://www.us-cert.gov/ncas/analysis-reports/ar20-045d"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--64175a23-67fa-4fa6-8aa6-890c9dc3d5d8","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0246","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--64175a23-67fa-4fa6-8aa6-890c9dc3d5d8","modified":"2026-07-31T20:48:46.768Z","references":[{"source_name":"US-CERT HARDRAIN March 2018","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-F.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6441d8c3-861f-4ce3-9121-809d2b0d173b","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1036.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6441d8c3-861f-4ce3-9121-809d2b0d173b","modified":"2026-07-31T20:48:46.776Z","references":[{"source_name":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--64a17aba-5182-4666-bd37-dafa9d835fe8","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1047","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--64a17aba-5182-4666-bd37-dafa9d835fe8","modified":"2026-07-31T20:48:46.783Z","references":[{"source_name":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6549c38d-46b4-4633-a479-0cbeb405f186","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1071.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6549c38d-46b4-4633-a479-0cbeb405f186","modified":"2026-09-03T19:47:00.358Z","references":[{"source_name":"ESET Twitter Ida Pro Nov 2021","url":"https://x.com/ESETresearch/status/1458438155149922312"},{"source_name":"TrendMicro macOS Dacls May 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/"},{"source_name":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source_name":"SentinelOne Lazarus macOS July 2020","url":"https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--670a7586-5833-4e00-903a-c699b9810c13","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1557.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--670a7586-5833-4e00-903a-c699b9810c13","modified":"2026-07-31T20:48:46.803Z","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--699ddfef-6e95-42cf-b212-dc661f790adc","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--699ddfef-6e95-42cf-b212-dc661f790adc","modified":"2026-07-31T20:48:46.810Z","references":[{"source_name":"TrendMicro macOS Dacls May 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/"},{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source_name":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6ab291a5-8061-4ad4-a6a7-07a6142e4c27","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1547.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6ab291a5-8061-4ad4-a6a7-07a6142e4c27","modified":"2026-07-31T20:48:46.818Z","references":[{"source_name":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6f08abbe-2b04-482f-98ec-ae9382ba3084","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1685","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6f08abbe-2b04-482f-98ec-ae9382ba3084","modified":"2026-07-31T20:48:46.827Z","references":[{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster Tools","url":"https://web.archive.org/web/20220425194457/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"US-CERT SHARPKNOT June 2018","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7104b56f-06ef-4888-ab9b-fac77fea3097","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1589.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7104b56f-06ef-4888-ab9b-fac77fea3097","modified":"2026-07-31T20:48:46.835Z","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--78ca7fcf-95b9-485c-a87b-2ac083312885","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1561.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--78ca7fcf-95b9-485c-a87b-2ac083312885","modified":"2026-07-31T20:48:46.842Z","references":[{"source_name":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--79904c38-8fb6-45e3-98f7-98856e08421f","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1491.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--79904c38-8fb6-45e3-98f7-98856e08421f","modified":"2026-07-31T20:48:46.850Z","references":[{"source_name":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--79f7d5d7-acbf-4f7e-8530-2f7e637580cd","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0497","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--79f7d5d7-acbf-4f7e-8530-2f7e637580cd","modified":"2026-07-31T20:48:46.857Z","references":[{"source_name":"SentinelOne Lazarus macOS July 2020","url":"https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/"},{"source_name":"TrendMicro macOS Dacls May 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7b18b0b1-1116-4e42-90b5-ffa3059955a7","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0271","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7b18b0b1-1116-4e42-90b5-ffa3059955a7","modified":"2026-07-31T20:48:46.864Z","references":[{"source_name":"US-CERT KEYMARBLE Aug 2018","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-221A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7b2e912e-4561-4edc-87fe-11f9e259a5a9","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7b2e912e-4561-4edc-87fe-11f9e259a5a9","modified":"2026-07-31T20:48:46.872Z","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7b4ee7bc-3a27-4142-a9bd-f65787193e8b","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1547.009","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7b4ee7bc-3a27-4142-a9bd-f65787193e8b","modified":"2026-07-31T20:48:46.882Z","references":[{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7c1e0451-66d7-4445-9b8d-8d9770043421","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1059.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7c1e0451-66d7-4445-9b8d-8d9770043421","modified":"2026-07-31T20:48:46.889Z","references":[{"source_name":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7ca1b40d-d1de-48ab-b8ad-023ad9877def","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1542.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7ca1b40d-d1de-48ab-b8ad-023ad9877def","modified":"2026-07-31T20:48:46.897Z","references":[{"source_name":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7cd04afd-b216-468b-a4af-71700c9fbefd","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1218.011","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7cd04afd-b216-468b-a4af-71700c9fbefd","modified":"2026-07-31T20:48:46.905Z","references":[{"source_name":"ESET Twitter Ida Pro Nov 2021","url":"https://x.com/ESETresearch/status/1458438155149922312"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7e2b9c63-69ac-4050-b057-2fe16ef1d355","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1583.006","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7e2b9c63-69ac-4050-b057-2fe16ef1d355","modified":"2026-07-31T20:48:46.912Z","references":[{"source_name":"CISA AppleJeus Feb 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-048a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7f695d14-17e1-46c6-92eb-7c2f57fc6553","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7f695d14-17e1-46c6-92eb-7c2f57fc6553","modified":"2026-07-31T20:48:46.919Z","references":[{"source_name":"Novetta Blockbuster Tools","url":"https://web.archive.org/web/20220425194457/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--800f3241-62f4-4eb4-b9a2-df62f67d27d6","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--800f3241-62f4-4eb4-b9a2-df62f67d27d6","modified":"2026-09-03T19:46:57.171Z","references":[{"source_name":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--81682d49-acb2-4439-a7da-1a28126cea94","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1132.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--81682d49-acb2-4439-a7da-1a28126cea94","modified":"2026-09-03T19:46:54.638Z","references":[{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--829f88fc-453a-40d1-8566-90dfe0934173","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1189","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--829f88fc-453a-40d1-8566-90dfe0934173","modified":"2026-07-31T20:48:46.942Z","references":[{"source_name":"RATANKBA","url":"https://www.trendmicro.com/en_us/research/17/b/ratankba-watering-holes-against-enterprises.html"},{"source_name":"Google TAG Lazarus Jan 2021","url":"https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--83ba5b2c-b3fd-4558-a3f8-cef4c31e02bd","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1110.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--83ba5b2c-b3fd-4558-a3f8-cef4c31e02bd","modified":"2026-07-31T20:48:46.952Z","references":[{"source_name":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--83bfee39-b6c9-48e6-8114-54b0c623a91f","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--83bfee39-b6c9-48e6-8114-54b0c623a91f","modified":"2026-07-31T20:48:46.959Z","references":[{"source_name":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"McAfee Bankshot","url":"https://securingtomorrow.mcafee.com/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/"},{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--83e8bdc8-6fad-4b83-92de-2b66e3e9205e","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0586","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--83e8bdc8-6fad-4b83-92de-2b66e3e9205e","modified":"2026-07-31T20:48:46.968Z","references":[{"source_name":"CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--83f844ec-b321-4a9d-8c43-edbf6e006a6b","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1553.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--83f844ec-b321-4a9d-8c43-edbf6e006a6b","modified":"2026-07-31T20:48:46.975Z","references":[{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--883e2f79-5bf5-4e08-bb83-f1cd36907958","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1218","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--883e2f79-5bf5-4e08-bb83-f1cd36907958","modified":"2026-07-31T20:48:46.982Z","references":[{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8c58cfe5-0b71-434c-939a-329b612d2337","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1560.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8c58cfe5-0b71-434c-939a-329b612d2337","modified":"2026-07-31T20:48:46.989Z","references":[{"source_name":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--90073373-434c-403c-bbb1-779b25fccb3d","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0347","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--90073373-434c-403c-bbb1-779b25fccb3d","modified":"2026-07-31T20:48:46.997Z","references":[{"source_name":"TrendMicro Lazarus Nov 2018","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-continues-heists-mounts-attacks-on-financial-organizations-in-latin-america/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--939b7c8a-3a2a-43a7-82e2-55f3b62c15da","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1027.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--939b7c8a-3a2a-43a7-82e2-55f3b62c15da","modified":"2026-07-31T20:48:47.005Z","references":[{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--979812c4-939e-4a7e-96b3-348028db10ce","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1070.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--979812c4-939e-4a7e-96b3-348028db10ce","modified":"2026-07-31T20:48:47.012Z","references":[{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--97bf5604-4b99-4851-85ea-83018d90c82c","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1090.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--97bf5604-4b99-4851-85ea-83018d90c82c","modified":"2026-09-08T20:28:43.347Z","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9f62c4e4-02d4-497b-8039-cc4e816386a5","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0108","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9f62c4e4-02d4-497b-8039-cc4e816386a5","modified":"2026-07-31T20:48:47.029Z","references":[{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ab687dca-2741-4920-a71e-e0e0444809c5","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1008","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ab687dca-2741-4920-a71e-e0e0444809c5","modified":"2026-09-09T18:39:16.983Z","references":[{"source_name":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ac47da26-22ae-43b9-947b-ed4ea6943d42","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1140","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ac47da26-22ae-43b9-947b-ed4ea6943d42","modified":"2026-07-31T20:48:47.045Z","references":[{"source_name":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--afa8a693-6e2f-40e8-a78d-2710e9683e4e","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--afa8a693-6e2f-40e8-a78d-2710e9683e4e","modified":"2026-07-31T20:48:47.052Z","references":[{"source_name":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source_name":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b00c9e09-d98f-40b4-bc4e-0c3e9fe873e1","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1561.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b00c9e09-d98f-40b4-bc4e-0c3e9fe873e1","modified":"2026-07-31T20:48:47.061Z","references":[{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"US-CERT SHARPKNOT June 2018","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b24131fe-0d25-456e-a2da-58da3ff5bc17","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1583.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b24131fe-0d25-456e-a2da-58da3ff5bc17","modified":"2026-07-31T20:48:47.071Z","references":[{"source_name":"CISA AppleJeus Feb 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-048a"},{"source_name":"Google TAG Lazarus Jan 2021","url":"https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b78b74a4-7fe3-4de5-9aba-b176f1929a7c","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0593","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b78b74a4-7fe3-4de5-9aba-b176f1929a7c","modified":"2026-07-31T20:48:47.080Z","references":[{"source_name":"CISA EB Aug 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-239a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b9259830-1b82-4303-bb5a-c0285a71f5ef","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b9259830-1b82-4303-bb5a-c0285a71f5ef","modified":"2026-07-31T20:48:47.089Z","references":[{"source_name":"ESET Twitter Ida Pro Nov 2021","url":"https://x.com/ESETresearch/status/1458438155149922312"},{"source_name":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ba9b20fb-04a8-403b-9549-c13a9bb2603c","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1566.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ba9b20fb-04a8-403b-9549-c13a9bb2603c","modified":"2026-07-31T20:48:47.098Z","references":[{"source_name":"Google TAG Lazarus Jan 2021","url":"https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bcc68931-0e79-4dc2-898d-3e553a7a9669","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bcc68931-0e79-4dc2-898d-3e553a7a9669","modified":"2026-07-31T20:48:47.105Z","references":[{"source_name":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source_name":"CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bcee230a-c671-4c71-afbf-d6216aeee5b6","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1070","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bcee230a-c671-4c71-afbf-d6216aeee5b6","modified":"2026-07-31T20:48:47.115Z","references":[{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bd745d11-93d8-45db-8a68-08a52383375a","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bd745d11-93d8-45db-8a68-08a52383375a","modified":"2026-07-31T20:48:47.122Z","references":[{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c0337d13-da6a-4e2b-91a4-a389c6b4ee28","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1574.013","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c0337d13-da6a-4e2b-91a4-a389c6b4ee28","modified":"2026-07-31T20:48:47.130Z","references":[{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c055d228-a0e6-4b76-961a-1eebe99679f5","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1055.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c055d228-a0e6-4b76-961a-1eebe99679f5","modified":"2026-07-31T20:48:47.138Z","references":[{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c0807a3c-a298-47ef-8705-7d7ca55d446e","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1585.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c0807a3c-a298-47ef-8705-7d7ca55d446e","modified":"2026-07-31T20:48:47.146Z","references":[{"source_name":"Google TAG Lazarus Jan 2021","url":"https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c79796c1-88d6-4cd8-95d3-4f81d3755859","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1021.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c79796c1-88d6-4cd8-95d3-4f81d3755859","modified":"2026-07-31T20:48:47.153Z","references":[{"source_name":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cc31afad-6349-4b66-a0a9-cd8f9de46aec","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1529","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cc31afad-6349-4b66-a0a9-cd8f9de46aec","modified":"2026-07-31T20:48:47.160Z","references":[{"source_name":"US-CERT SHARPKNOT June 2018","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d0076185-9619-4365-b74a-44f52cc92c79","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0584","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d0076185-9619-4365-b74a-44f52cc92c79","modified":"2026-07-31T20:48:47.168Z","references":[{"source_name":"CISA AppleJeus Feb 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-048a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d0327dce-ca02-48ba-8830-85fcc574113c","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1124","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d0327dce-ca02-48ba-8830-85fcc574113c","modified":"2026-07-31T20:48:47.174Z","references":[{"source_name":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d1e1fefe-5e60-463e-9fd3-bc5ca6d559ed","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0103","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d1e1fefe-5e60-463e-9fd3-bc5ca6d559ed","modified":"2026-07-31T20:48:47.184Z","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d29db5f7-25cb-49e3-81da-04263e32b65c","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1036.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d29db5f7-25cb-49e3-81da-04263e32b65c","modified":"2026-07-31T20:48:47.192Z","references":[{"source_name":"ESET Twitter Ida Pro Nov 2021","url":"https://x.com/ESETresearch/status/1458438155149922312"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d35f6c6f-c1ed-4b0d-b95f-9fd762eb3ac7","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1070.006","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d35f6c6f-c1ed-4b0d-b95f-9fd762eb3ac7","modified":"2026-07-31T20:48:47.199Z","references":[{"source_name":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d39e7197-a9b3-4915-8cf0-98bbbd885cd5","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1070.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d39e7197-a9b3-4915-8cf0-98bbbd885cd5","modified":"2026-07-31T20:48:47.207Z","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d927e540-e6b8-4ddb-8652-cd510fe285ed","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0520","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d927e540-e6b8-4ddb-8652-cd510fe285ed","modified":"2026-07-31T20:48:47.214Z","references":[{"source_name":"US-CERT BLINDINGCAN Aug 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--daf75556-254a-41af-960d-5b1012c739e3","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--daf75556-254a-41af-960d-5b1012c739e3","modified":"2026-07-31T20:48:47.221Z","references":[{"source_name":"ASEC Lazarus 2022","url":"https://asec.ahnlab.com/en/39828/"},{"source_name":"ESET Twitter Ida Pro Nov 2021","url":"https://x.com/ESETresearch/status/1458438155149922312"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--de8d46b7-d34d-4ea9-8d49-54eedd104c46","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1686.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--de8d46b7-d34d-4ea9-8d49-54eedd104c46","modified":"2026-07-31T20:48:47.229Z","references":[{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster Tools","url":"https://web.archive.org/web/20220425194457/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e29b85ff-9ae1-42ad-ba2e-53781b638e42","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0665","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e29b85ff-9ae1-42ad-ba2e-53781b638e42","modified":"2026-07-31T20:48:47.236Z","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e42eef1a-107e-40a3-9227-45621e277ff3","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1543.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e42eef1a-107e-40a3-9227-45621e277ff3","modified":"2026-07-31T20:48:47.243Z","references":[{"source_name":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e46836e5-8ffe-45e5-9398-bb9fbb3a4aeb","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0180","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e46836e5-8ffe-45e5-9398-bb9fbb3a4aeb","modified":"2026-07-31T20:48:47.251Z","references":[{"source_name":"US-CERT Volgmer Nov 2017","url":"https://www.us-cert.gov/ncas/alerts/TA17-318B"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e6cafa6a-22ce-49f7-8136-dc5a51c3aaeb","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1021.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e6cafa6a-22ce-49f7-8136-dc5a51c3aaeb","modified":"2026-07-31T20:48:47.261Z","references":[{"source_name":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e82e75df-12f9-4d95-b653-dd71a519524f","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0498","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e82e75df-12f9-4d95-b653-dd71a519524f","modified":"2026-07-31T20:48:47.269Z","references":[{"source_name":"SentinelOne Lazarus macOS July 2020","url":"https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ecfb4c82-5097-4273-8aeb-007922e92940","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0174","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ecfb4c82-5097-4273-8aeb-007922e92940","modified":"2026-07-31T20:48:47.276Z","references":[{"source_name":"ClearSky Lazarus Aug 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ee02be12-0884-43dc-b0b4-aaaa306b1f19","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0241","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ee02be12-0884-43dc-b0b4-aaaa306b1f19","modified":"2026-07-31T20:48:47.283Z","references":[{"source_name":"Lazarus RATANKBA","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-campaign-targeting-cryptocurrencies-reveals-remote-controller-tool-evolved-ratankba/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eea8a891-7ebb-4589-9d36-6a801ff00818","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1585.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eea8a891-7ebb-4589-9d36-6a801ff00818","modified":"2026-07-31T20:48:47.291Z","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f39a04e8-f4cf-482f-8d1a-7def044a03a0","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1049","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f39a04e8-f4cf-482f-8d1a-7def044a03a0","modified":"2026-07-31T20:48:47.298Z","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f60afd0d-68d1-4b71-bb07-b943e9542b2d","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1560.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f60afd0d-68d1-4b71-bb07-b943e9542b2d","modified":"2026-07-31T20:48:47.305Z","references":[{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fa0622d6-2b58-476f-9c57-e629785b0415","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:S0239","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fa0622d6-2b58-476f-9c57-e629785b0415","modified":"2026-07-31T20:48:47.313Z","references":[{"source_name":"McAfee Bankshot","url":"https://securingtomorrow.mcafee.com/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}