Source assertions are not new attribution claims. No sole inventor or transitive actor-CVE inference. { "record": { "id": "ATTACK:enterprise:T1012", "title": "Query Registry", "type": "Technique", "source_url": "https://attack.mitre.org/techniques/T1012", "snapshot": "enterprise-attack-20.0.json", "status": "active", "rights": "Source metadata only; source notices retained; no operational prose or payloads", "review_status": "machine-extracted; source-specific checks passed, editorial review pending", "stix_id": "attack-pattern--c32f7008-9fea-41f7-8366-5eb9b74bd896", "external_id": "T1012", "domain": "enterprise", "created": "2017-05-31T21:30:25.584Z", "modified": "2026-05-12T15:12:00.714Z", "version": "1.3", "aliases": [ ], "tactics": [ "discovery" ], "source_references": [ { "source_name": "Wikipedia Windows Registry", "url": "https://en.wikipedia.org/wiki/Windows_Registry" } ] }, "assertions": [ { "id": "enterprise:relationship--0032f447-1ab7-427d-b7ae-baa436dc2411", "subject": "ATTACK:enterprise:C0014", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--0032f447-1ab7-427d-b7ae-baa436dc2411", "modified": "2026-07-31T18:47:31.302Z", "references": [ { "source_name": "FoxIT Wocao December 2019", "url": "https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--014010a2-7bb8-4b11-bef9-c85609b2d94b", "subject": "ATTACK:enterprise:S0091", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--014010a2-7bb8-4b11-bef9-c85609b2d94b", "modified": "2026-04-29T14:23:05.904Z", "references": [ { "source_name": "Kaspersky Turla", "url": "https://securelist.com/the-epic-turla-operation/65545/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--018a5e33-ef18-4a6b-8389-c950053d4a75", "subject": "ATTACK:enterprise:S1159", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--018a5e33-ef18-4a6b-8389-c950053d4a75", "modified": "2026-04-29T14:23:05.905Z", "references": [ { "source_name": "Google Cloud APT41 2024", "url": "https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--03070395-3b76-4351-a3bd-0d9eaaa6652c", "subject": "ATTACK:enterprise:S0589", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--03070395-3b76-4351-a3bd-0d9eaaa6652c", "modified": "2026-04-29T14:23:05.907Z", "references": [ { "source_name": "MSTIC NOBELIUM Mar 2021", "url": "https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--052c54bf-b92b-4a7e-bca4-bc884437a327", "subject": "ATTACK:enterprise:S0512", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--052c54bf-b92b-4a7e-bca4-bc884437a327", "modified": "2026-04-29T14:23:05.910Z", "references": [ { "source_name": "ESET Dukes October 2019", "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--0825b101-deff-45cf-867c-af3ccb233744", "subject": "ATTACK:enterprise:S0203", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--0825b101-deff-45cf-867c-af3ccb233744", "modified": "2026-04-29T14:23:05.914Z", "references": [ { "source_name": "Symantec Trojan.Hydraq Jan 2010", "url": "https://www.symantec.com/connect/blogs/trojanhydraq-incident" }, { "source_name": "Symantec Hydraq Jan 2010", "url": "https://www.symantec.com/security_response/writeup.jsp?docid=2010-011114-1830-99" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--10514be7-2dcb-4e70-a579-e1e1e6c2d900", "subject": "ATTACK:enterprise:S1064", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--10514be7-2dcb-4e70-a579-e1e1e6c2d900", "modified": "2026-04-29T14:23:05.926Z", "references": [ { "source_name": "HP SVCReady Jun 2022", "url": "https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--1558f550-390d-4c40-a2f7-c9aa1fcf9f1b", "subject": "ATTACK:enterprise:G0128", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--1558f550-390d-4c40-a2f7-c9aa1fcf9f1b", "modified": "2026-07-31T18:47:52.025Z", "references": [ { "source_name": "Zscaler APT31 Covid-19 October 2020", "url": "https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--184739bd-f45e-4f2b-8caf-19e2cb30ae92", "subject": "ATTACK:enterprise:S0560", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--184739bd-f45e-4f2b-8caf-19e2cb30ae92", "modified": "2026-04-29T14:23:05.938Z", "references": [ { "source_name": "FireEye SUNBURST Backdoor December 2020", "url": "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html" }, { "source_name": "Microsoft Deep Dive Solorigate January 2021", "url": "https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--1c548d89-557e-4c48-9b71-8a761d94e77b", "subject": "ATTACK:enterprise:S0376", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--1c548d89-557e-4c48-9b71-8a761d94e77b", "modified": "2026-04-29T14:23:05.943Z", "references": [ { "source_name": "US-CERT HOPLIGHT Apr 2019", "url": "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--1d7661c8-82cf-481c-89e4-927eedaffc22", "subject": "ATTACK:enterprise:S1019", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--1d7661c8-82cf-481c-89e4-927eedaffc22", "modified": "2026-04-29T14:23:05.945Z", "references": [ { "source_name": "Accenture Lyceum Targets November 2021", "url": "https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--2133b98d-891c-4602-8c01-4fc93b807980", "subject": "ATTACK:enterprise:S1180", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--2133b98d-891c-4602-8c01-4fc93b807980", "modified": "2026-04-29T14:23:05.950Z", "references": [ { "source_name": "Trustwave BlackByte 2021", "url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--26fcd59e-5758-47ec-8a5e-68150d1ff805", "subject": "ATTACK:enterprise:S0344", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--26fcd59e-5758-47ec-8a5e-68150d1ff805", "modified": "2026-04-29T14:23:05.958Z", "references": [ { "source_name": "Unit42 Azorult Nov 2018", "url": "https://researchcenter.paloaltonetworks.com/2018/11/unit42-new-wine-old-bottle-new-azorult-variant-found-findmyname-campaign-using-fallout-exploit-kit/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--27f4a7f3-7086-471d-8826-7bc544069c44", "subject": "ATTACK:enterprise:S0660", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--27f4a7f3-7086-471d-8826-7bc544069c44", "modified": "2026-04-29T14:23:05.959Z", "references": [ { "source_name": "Talent-Jump Clambling February 2020", "url": "https://www.talent-jump.com/article/2020/02/17/CLAMBLING-A-New-Backdoor-Base-On-Dropbox-en/" }, { "source_name": "Trend Micro DRBControl February 2020", "url": "https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--2a945fce-862b-46ff-8ee5-b78b220803f3", "subject": "ATTACK:enterprise:S0180", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--2a945fce-862b-46ff-8ee5-b78b220803f3", "modified": "2026-04-29T14:23:05.962Z", "references": [ { "source_name": "US-CERT Volgmer 2 Nov 2017", "url": "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-D_WHITE_S508C.PDF" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--2bc482f0-f5ee-433c-81bd-566ef8a8d7a6", "subject": "ATTACK:enterprise:S0385", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--2bc482f0-f5ee-433c-81bd-566ef8a8d7a6", "modified": "2026-04-29T14:23:05.964Z", "references": [ { "source_name": "Trend Micro njRAT 2018", "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/autoit-compiled-worm-affecting-removable-media-delivers-fileless-version-of-bladabindi-njrat-backdoor/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--2de4d7df-18fc-4202-93ee-2fcfe6f2e501", "subject": "ATTACK:enterprise:S0240", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--2de4d7df-18fc-4202-93ee-2fcfe6f2e501", "modified": "2026-04-29T14:23:05.967Z", "references": [ { "source_name": "Talos Group123", "url": "https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--2dfbcf5d-8563-440c-bd9c-0cfc15059bd5", "subject": "ATTACK:enterprise:S0140", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--2dfbcf5d-8563-440c-bd9c-0cfc15059bd5", "modified": "2026-04-29T14:23:05.967Z", "references": [ { "source_name": "Palo Alto Shamoon Nov 2016", "url": "http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--2f28f6e0-795f-4e0d-8459-514a42a96ce9", "subject": "ATTACK:enterprise:S0414", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--2f28f6e0-795f-4e0d-8459-514a42a96ce9", "modified": "2026-04-29T14:23:05.970Z", "references": [ { "source_name": "Unit42 BabyShark Feb 2019", "url": "https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--31028cf4-870e-490e-871e-ec55814dcef8", "subject": "ATTACK:enterprise:S0354", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--31028cf4-870e-490e-871e-ec55814dcef8", "modified": "2026-04-29T14:23:05.979Z", "references": [ { "source_name": "Cybereason Cobalt Kitty 2017", "url": "https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--312c929a-abf6-44c1-95d6-6dde60c7a3fe", "subject": "ATTACK:enterprise:S0194", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--312c929a-abf6-44c1-95d6-6dde60c7a3fe", "modified": "2026-04-29T14:23:05.980Z", "references": [ { "source_name": "GitHub PowerSploit May 2012", "url": "https://github.com/PowerShellMafia/PowerSploit" }, { "source_name": "PowerSploit Documentation", "url": "http://powersploit.readthedocs.io" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--3454bb10-fad3-48b6-b20a-81cb45e7bbc1", "subject": "ATTACK:enterprise:S0517", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--3454bb10-fad3-48b6-b20a-81cb45e7bbc1", "modified": "2026-04-29T14:23:05.989Z", "references": [ { "source_name": "Trustwave Pillowmint June 2020", "url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--3559da63-5706-4e5a-b130-89858c2c0f44", "subject": "ATTACK:enterprise:G0027", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--3559da63-5706-4e5a-b130-89858c2c0f44", "modified": "2026-07-31T18:48:28.611Z", "references": [ { "source_name": "Nccgroup Emissary Panda May 2018", "url": "https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--3598d32e-306d-421d-af3c-8c9f5d1628a2", "subject": "ATTACK:enterprise:S0335", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--3598d32e-306d-421d-af3c-8c9f5d1628a2", "modified": "2026-04-29T14:23:05.992Z", "references": [ { "source_name": "ESET Carbon Mar 2017", "url": "https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--39b63ba5-41dc-4b47-9858-97abdda827cd", "subject": "ATTACK:enterprise:S1240", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--39b63ba5-41dc-4b47-9858-97abdda827cd", "modified": "2026-04-29T14:23:05.999Z", "references": [ { "source_name": "McAfee RedLine Stealer April 2024", "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/redline-stealer-a-novel-approach/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--39b735d3-c659-4d1a-8e7e-082c0f049c2d", "subject": "ATTACK:enterprise:G0032", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--39b735d3-c659-4d1a-8e7e-082c0f049c2d", "modified": "2026-07-31T20:48:46.587Z", "references": [ { "source_name": "Novetta Blockbuster Loaders", "url": "https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf" }, { "source_name": "Novetta Blockbuster", "url": "https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf" }, { "source_name": "McAfee Lazarus Resurfaces Feb 2018", "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--3a217a5a-b6c4-47c5-822a-5b278385c811", "subject": "ATTACK:enterprise:S0030", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--3a217a5a-b6c4-47c5-822a-5b278385c811", "modified": "2026-04-29T14:23:06.000Z", "references": [ { "source_name": "FireEye CARBANAK June 2017", "url": "https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--3a50e0b3-fe35-4cfe-bdd6-306946b15abc", "subject": "ATTACK:enterprise:S0496", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--3a50e0b3-fe35-4cfe-bdd6-306946b15abc", "modified": "2026-04-29T14:23:06.000Z", "references": [ { "source_name": "Secureworks REvil September 2019", "url": "https://www.secureworks.com/research/revil-sodinokibi-ransomware" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--3b035642-31cc-498e-9dff-9e145b35b968", "subject": "ATTACK:enterprise:S0680", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--3b035642-31cc-498e-9dff-9e145b35b968", "modified": "2026-04-29T14:23:06.002Z", "references": [ { "source_name": "Kaspersky WIRTE November 2021", "url": "https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--3c786b4b-b146-4511-b3ca-65fe7c3521e8", "subject": "ATTACK:enterprise:S0201", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--3c786b4b-b146-4511-b3ca-65fe7c3521e8", "modified": "2026-04-29T14:23:06.006Z", "references": [ { "source_name": "Microsoft PLATINUM April 2016", "url": "https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--46144407-0f14-4358-8d4e-23b3ef13cb4e", "subject": "ATTACK:enterprise:G0050", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--46144407-0f14-4358-8d4e-23b3ef13cb4e", "modified": "2026-07-31T18:47:44.288Z", "references": [ { "source_name": "ESET OceanLotus Mar 2019", "url": "https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--47f611f4-b9f0-42ef-9629-ee4a56e737ed", "subject": "ATTACK:enterprise:S0155", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--47f611f4-b9f0-42ef-9629-ee4a56e737ed", "modified": "2026-04-29T14:23:06.023Z", "references": [ { "source_name": "FireEye APT32 May 2017", "url": "https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--4cb1a0d0-6276-4c2c-b299-c26c982e9e1e", "subject": "ATTACK:enterprise:S0013", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--4cb1a0d0-6276-4c2c-b299-c26c982e9e1e", "modified": "2026-04-29T14:23:06.030Z", "references": [ { "source_name": "Eset PlugX Korplug Mustang Panda March 2022", "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/" }, { "source_name": "CIRCL PlugX March 2013", "url": "http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf" }, { "source_name": "Lastline PlugX Analysis", "url": "https://lastline3.rssing.com/chan-29044929/all_p1.html#c29044929a2" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--4d5240d1-508f-4cf0-bf38-9f9276894cbf", "subject": "ATTACK:enterprise:G0035", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--4d5240d1-508f-4cf0-bf38-9f9276894cbf", "modified": "2026-07-31T20:48:28.440Z", "references": [ { "source_name": "US-CERT TA18-074A", "url": "https://www.us-cert.gov/ncas/alerts/TA18-074A" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--4e5de254-8dd4-46cd-a8af-8cdfd335e5f1", "subject": "ATTACK:enterprise:S1013", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--4e5de254-8dd4-46cd-a8af-8cdfd335e5f1", "modified": "2026-04-29T14:23:06.032Z", "references": [ { "source_name": "Cisco Talos Bitter Bangladesh May 2022", "url": "https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--4f5c53df-7076-4580-bd45-c4c9201269ae", "subject": "ATTACK:enterprise:S0267", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--4f5c53df-7076-4580-bd45-c4c9201269ae", "modified": "2026-04-29T14:23:06.033Z", "references": [ { "source_name": "ESET GreyEnergy Oct 2018", "url": "https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf" }, { "source_name": "FireEye FELIXROOT July 2018", "url": "https://web.archive.org/web/20200607025424/https://www.fireeye.com/blog/threat-research/2018/07/microsoft-office-vulnerabilities-used-to-distribute-felixroot-backdoor.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--519c4c7f-8495-4b8a-b58e-551a78e469cc", "subject": "ATTACK:enterprise:G0010", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--519c4c7f-8495-4b8a-b58e-551a78e469cc", "modified": "2026-07-31T18:48:03.835Z", "references": [ { "source_name": "Kaspersky Turla", "url": "https://securelist.com/the-epic-turla-operation/65545/" }, { "source_name": "ESET Turla PowerShell May 2019", "url": "https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--521146dd-185d-4a8c-a3b4-b3caedbc7a14", "subject": "ATTACK:enterprise:S0186", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--521146dd-185d-4a8c-a3b4-b3caedbc7a14", "modified": "2026-04-29T14:23:06.037Z", "references": [ { "source_name": "ClearSky Charming Kitten Dec 2017", "url": "http://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--5365d764-76fa-49ce-b76b-d0344322b037", "subject": "ATTACK:enterprise:S0075", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--5365d764-76fa-49ce-b76b-d0344322b037", "modified": "2026-04-29T14:23:06.039Z", "references": [ { "source_name": "Microsoft Reg", "url": "https://technet.microsoft.com/en-us/library/cc732643.aspx" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--564de5da-7ecc-45c7-bbd5-619a8f316f70", "subject": "ATTACK:enterprise:S0031", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--564de5da-7ecc-45c7-bbd5-619a8f316f70", "modified": "2026-04-29T14:23:06.043Z", "references": [ { "source_name": "FireEye APT30", "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--59c92aeb-1e62-4e60-8ead-63100e068c0d", "subject": "ATTACK:enterprise:S0513", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--59c92aeb-1e62-4e60-8ead-63100e068c0d", "modified": "2026-04-29T14:23:06.047Z", "references": [ { "source_name": "ESET Dukes October 2019", "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--5acaf47e-4608-4548-81e8-368a2687844e", "subject": "ATTACK:enterprise:S0412", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--5acaf47e-4608-4548-81e8-368a2687844e", "modified": "2026-04-29T14:23:06.049Z", "references": [ { "source_name": "Talos ZxShell Oct 2014", "url": "https://blogs.cisco.com/security/talos/opening-zxshell" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--5ccac771-a984-4f06-b109-21ea7cd60b02", "subject": "ATTACK:enterprise:S0011", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--5ccac771-a984-4f06-b109-21ea7cd60b02", "modified": "2026-04-29T14:23:06.052Z", "references": [ { "source_name": "CISA MAR-10292089-1.v2 TAIDOOR August 2021", "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--5da42f91-d58e-48bd-b8b2-3d35db7edcf2", "subject": "ATTACK:enterprise:S1018", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--5da42f91-d58e-48bd-b8b2-3d35db7edcf2", "modified": "2026-04-29T14:23:06.053Z", "references": [ { "source_name": "Malwarebytes Saint Bot April 2021", "url": "https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--5dc5e7d5-8d4d-450c-826d-7719de39ab28", "subject": "ATTACK:enterprise:G0082", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--5dc5e7d5-8d4d-450c-826d-7719de39ab28", "modified": "2026-09-30T20:51:26.892Z", "references": [ { "source_name": "MIcrosoft Mastra npm Compromise JUN 2026", "url": "https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--60198640-1e5a-4b8e-9a69-5f275f7e0e68", "subject": "ATTACK:enterprise:S0165", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--60198640-1e5a-4b8e-9a69-5f275f7e0e68", "modified": "2026-04-29T14:23:06.056Z", "references": [ { "source_name": "Symantec Buckeye", "url": "https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--62784c03-0ee3-4a53-ba0e-876db5ede08a", "subject": "ATTACK:enterprise:G0094", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--62784c03-0ee3-4a53-ba0e-876db5ede08a", "modified": "2026-07-31T20:48:24.913Z", "references": [ { "source_name": "Talos Kimsuky Nov 2021", "url": "https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--69c3aaaf-0922-4662-a8b3-026dc5ea0aae", "subject": "ATTACK:enterprise:S0242", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--69c3aaaf-0922-4662-a8b3-026dc5ea0aae", "modified": "2026-04-29T14:23:06.069Z", "references": [ { "source_name": "SecureList SynAck Doppelgänging May 2018", "url": "https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--6ae983c6-b332-42d9-b489-87f475b6b9d6", "subject": "ATTACK:enterprise:S0022", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--6ae983c6-b332-42d9-b489-87f475b6b9d6", "modified": "2026-04-29T14:23:06.070Z", "references": [ { "source_name": "Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023", "url": "https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--6b55412a-760f-4ff8-b48a-6ff3bed8b0e9", "subject": "ATTACK:enterprise:S0567", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--6b55412a-760f-4ff8-b48a-6ff3bed8b0e9", "modified": "2026-04-29T14:23:06.071Z", "references": [ { "source_name": "CyberBit Dtrack", "url": "https://www.cyberbit.com/blog/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--732a3283-d7ae-4d09-8446-edbd28c38ec0", "subject": "ATTACK:enterprise:S1015", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--732a3283-d7ae-4d09-8446-edbd28c38ec0", "modified": "2026-04-29T14:23:06.083Z", "references": [ { "source_name": "Accenture Lyceum Targets November 2021", "url": "https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--746b0def-62c8-438d-b5ec-aa6b7dbfb860", "subject": "ATTACK:enterprise:G0038", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--746b0def-62c8-438d-b5ec-aa6b7dbfb860", "modified": "2026-07-31T18:48:07.288Z", "references": [ { "source_name": "Citizen Lab Stealth Falcon May 2016", "url": "https://citizenlab.org/2016/05/stealth-falcon/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--749a620d-a87e-45b7-a9f6-8fa926320c59", "subject": "ATTACK:enterprise:G0047", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--749a620d-a87e-45b7-a9f6-8fa926320c59", "modified": "2026-10-01T23:35:36.847Z", "references": [ { "source_name": "SymantecCarbonBlack_ShuckwormUSB_Apr2025", "url": "https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--75a3cfad-a9e7-453f-88b8-787304575a33", "subject": "ATTACK:enterprise:S0534", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--75a3cfad-a9e7-453f-88b8-787304575a33", "modified": "2026-04-29T14:23:06.086Z", "references": [ { "source_name": "Cybereason Bazar July 2020", "url": "https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles" }, { "source_name": "NCC Group Team9 June 2020", "url": "https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--75a89128-fcdd-4bcf-98a7-9f0ea162a794", "subject": "ATTACK:enterprise:S0692", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--75a89128-fcdd-4bcf-98a7-9f0ea162a794", "modified": "2026-04-29T14:23:06.086Z", "references": [ { "source_name": "GitHub SILENTTRINITY Modules July 2019", "url": "https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--77d079b6-2df9-4ae9-bc7c-1ebe99708660", "subject": "ATTACK:enterprise:S0239", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--77d079b6-2df9-4ae9-bc7c-1ebe99708660", "modified": "2026-04-29T14:23:06.089Z", "references": [ { "source_name": "US-CERT Bankshot Dec 2017", "url": "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-B_WHITE.PDF" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--794caee4-34cd-493f-a047-1f4a8b4c8de8", "subject": "ATTACK:enterprise:S0673", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--794caee4-34cd-493f-a047-1f4a8b4c8de8", "modified": "2026-04-29T14:23:06.091Z", "references": [ { "source_name": "Prevailion DarkWatchman 2021", "url": "https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--798d8217-a605-450c-9634-2297adcd227e", "subject": "ATTACK:enterprise:S1242", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--798d8217-a605-450c-9634-2297adcd227e", "modified": "2026-04-29T14:23:06.091Z", "references": [ { "source_name": "Trend Micro Agenda Ransomware AUG 2022", "url": "https://www.trendmicro.com/en_us/research/22/h/new-golang-ransomware-agenda-customizes-attacks.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--79cebb53-3154-4512-9343-2942b1f72ff5", "subject": "ATTACK:enterprise:S0182", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--79cebb53-3154-4512-9343-2942b1f72ff5", "modified": "2026-04-29T14:23:06.092Z", "references": [ { "source_name": "Microsoft FinFisher March 2018", "url": "https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/" }, { "source_name": "FinFisher Citation", "url": "https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--7ad999fd-9d57-40d3-b942-d8749a6f46cc", "subject": "ATTACK:enterprise:S1060", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--7ad999fd-9d57-40d3-b942-d8749a6f46cc", "modified": "2026-04-29T14:23:06.093Z", "references": [ { "source_name": "SentinelLabs Metador Technical Appendix Sept 2022", "url": "https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--7d71658b-2b9f-4639-9fe7-7c7924b52ff7", "subject": "ATTACK:enterprise:S0570", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--7d71658b-2b9f-4639-9fe7-7c7924b52ff7", "modified": "2026-04-29T14:23:06.097Z", "references": [ { "source_name": "Crowdstrike Indrik November 2018", "url": "https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--80d8e746-f0a0-4781-824a-0147dbbee072", "subject": "ATTACK:enterprise:S0032", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--80d8e746-f0a0-4781-824a-0147dbbee072", "modified": "2026-04-29T14:23:06.102Z", "references": [ { "source_name": "Gh0stRAT ATT March 2019", "url": "https://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--8875e27f-9f8d-418b-8937-a2c4d1858607", "subject": "ATTACK:enterprise:S0348", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--8875e27f-9f8d-418b-8937-a2c4d1858607", "modified": "2026-04-29T14:23:06.111Z", "references": [ { "source_name": "PaloAlto CardinalRat Apr 2017", "url": "https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--8db65d27-ddf4-4edd-9ccb-8112a78e9f47", "subject": "ATTACK:enterprise:S1044", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--8db65d27-ddf4-4edd-9ccb-8112a78e9f47", "modified": "2026-04-29T14:23:06.118Z", "references": [ { "source_name": "Bitdefender FunnyDream Campaign November 2020", "url": "https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--8de816a1-c89b-47ea-9456-c3bc139e6885", "subject": "ATTACK:enterprise:S0484", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--8de816a1-c89b-47ea-9456-c3bc139e6885", "modified": "2026-04-29T14:23:06.119Z", "references": [ { "source_name": "Prevx Carberp March 2011", "url": "https://web.archive.org/web/20231227000328/http://pxnow.prevx.com/content/blog/carberp-a_modular_information_stealing_trojan.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--8e12d3f8-6c2b-4622-889e-63c9abcff04b", "subject": "ATTACK:enterprise:S0154", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--8e12d3f8-6c2b-4622-889e-63c9abcff04b", "modified": "2026-04-29T14:23:06.119Z", "references": [ { "source_name": "Talos Cobalt Strike September 2020", "url": "https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf" }, { "source_name": "Cobalt Strike Manual 4.3 November 2020", "url": "https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--93741cce-12ce-4cc0-9fa6-5db7d8a1309a", "subject": "ATTACK:enterprise:S0579", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--93741cce-12ce-4cc0-9fa6-5db7d8a1309a", "modified": "2026-04-29T14:23:06.126Z", "references": [ { "source_name": "Trend Micro Waterbear December 2019", "url": "https://www.trendmicro.com/en_us/research/19/l/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--9677d051-2bac-4686-8611-2d089d3d4b58", "subject": "ATTACK:enterprise:S0612", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--9677d051-2bac-4686-8611-2d089d3d4b58", "modified": "2026-04-29T14:23:06.130Z", "references": [ { "source_name": "NCC Group WastedLocker June 2020", "url": "https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--9753bc87-1ed3-4a28-a9d3-80e004d83e62", "subject": "ATTACK:enterprise:S0574", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--9753bc87-1ed3-4a28-a9d3-80e004d83e62", "modified": "2026-04-29T14:23:06.131Z", "references": [ { "source_name": "Unit42 BendyBear Feb 2021", "url": "https://unit42.paloaltonetworks.com/bendybear-shellcode-blacktech/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--9a1da7be-9aaf-495a-bd56-f196f26b6240", "subject": "ATTACK:enterprise:G1043", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--9a1da7be-9aaf-495a-bd56-f196f26b6240", "modified": "2026-07-31T18:47:36.306Z", "references": [ { "source_name": "Picus BlackByte 2022", "url": "https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--9bab0784-d593-4fbc-8f03-0f2340184beb", "subject": "ATTACK:enterprise:S1047", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--9bab0784-d593-4fbc-8f03-0f2340184beb", "modified": "2026-04-29T14:23:06.137Z", "references": [ { "source_name": "DHS CISA AA22-055A MuddyWater February 2022", "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-055a" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--9c79076c-341f-4eb3-bed7-300723747b18", "subject": "ATTACK:enterprise:S0145", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--9c79076c-341f-4eb3-bed7-300723747b18", "modified": "2026-04-29T14:23:06.138Z", "references": [ { "source_name": "Cisco DNSMessenger March 2017", "url": "http://blog.talosintelligence.com/2017/03/dnsmessenger.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--9d12ae29-b183-49c1-8171-52322f7971df", "subject": "ATTACK:enterprise:S1190", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--9d12ae29-b183-49c1-8171-52322f7971df", "modified": "2026-04-29T14:23:06.139Z", "references": [ { "source_name": "WithSecure Kapeka 2024", "url": "https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Research-Kapeka.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--9f496c45-eac5-464f-858b-ef481f2f37ff", "subject": "ATTACK:enterprise:S0045", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--9f496c45-eac5-464f-858b-ef481f2f37ff", "modified": "2026-04-29T14:23:06.142Z", "references": [ { "source_name": "ESET Sednit Part 2", "url": "http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf" }, { "source_name": "Bitdefender APT28 Dec 2015", "url": "https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--9fedbd2e-93d1-4693-8365-f25ae4374e6a", "subject": "ATTACK:enterprise:S1050", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--9fedbd2e-93d1-4693-8365-f25ae4374e6a", "modified": "2026-04-29T14:23:06.143Z", "references": [ { "source_name": "Bitdefender FunnyDream Campaign November 2020", "url": "https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--a16da3e1-c81e-4565-a78f-607cb937010b", "subject": "ATTACK:enterprise:S0386", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--a16da3e1-c81e-4565-a78f-607cb937010b", "modified": "2026-04-29T14:23:06.145Z", "references": [ { "source_name": "TrendMicro Ursnif Mar 2015", "url": "https://web.archive.org/web/20210719165945/https://www.trendmicro.com/en_us/research/15/c/ursnif-the-multifaceted-malware.html?_ga=2.165628854.808042651.1508120821-744063452.1505819992" }, { "source_name": "TrendMicro BKDR_URSNIF.SM", "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/BKDR_URSNIF.SM?_ga=2.129468940.1462021705.1559742358-1202584019.1549394279" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--a455cf4b-2402-4b72-a5e8-e5f5ed6d2bfc", "subject": "ATTACK:enterprise:S0268", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--a455cf4b-2402-4b72-a5e8-e5f5ed6d2bfc", "modified": "2026-04-29T14:23:06.148Z", "references": [ { "source_name": "Talos Bisonal Mar 2020", "url": "https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--ab08048c-4d1f-4214-9f53-1e87f6a20988", "subject": "ATTACK:enterprise:S0252", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--ab08048c-4d1f-4214-9f53-1e87f6a20988", "modified": "2026-04-29T14:23:06.158Z", "references": [ { "source_name": "McAfee Gold Dragon", "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--acbf0f3f-5dd4-42ad-9399-047b8ff5dc0a", "subject": "ATTACK:enterprise:S1039", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--acbf0f3f-5dd4-42ad-9399-047b8ff5dc0a", "modified": "2026-04-29T14:23:06.160Z", "references": [ { "source_name": "Medium Ali Salem Bumblebee April 2022", "url": "https://elis531989.medium.com/the-chronicles-of-bumblebee-the-hook-the-bee-and-the-trickbot-connection-686379311056" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--b0d3ef27-8854-486f-942b-f0cd42c8a85c", "subject": "ATTACK:enterprise:S0476", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--b0d3ef27-8854-486f-942b-f0cd42c8a85c", "modified": "2026-04-29T14:23:06.166Z", "references": [ { "source_name": "Unit 42 Valak July 2020", "url": "https://unit42.paloaltonetworks.com/valak-evolution/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--b33486bc-c7f4-46d7-9e20-3863c5508820", "subject": "ATTACK:enterprise:S0668", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--b33486bc-c7f4-46d7-9e20-3863c5508820", "modified": "2026-04-29T14:23:06.170Z", "references": [ { "source_name": "Talos TinyTurla September 2021", "url": "https://blog.talosintelligence.com/2021/09/tinyturla.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--b511900a-9bfe-4f8c-b1e2-b95669a5eaeb", "subject": "ATTACK:enterprise:S0126", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--b511900a-9bfe-4f8c-b1e2-b95669a5eaeb", "modified": "2026-04-29T14:23:06.173Z", "references": [ { "source_name": "ESET ComRAT May 2020", "url": "https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--b7316e86-545b-4397-9b1f-d05a8ea64f4f", "subject": "ATTACK:enterprise:S0380", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--b7316e86-545b-4397-9b1f-d05a8ea64f4f", "modified": "2026-04-29T14:23:06.175Z", "references": [ { "source_name": "Kaspersky StoneDrill 2017", "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--b8b16140-82bc-42a0-82f7-bfc402f4b4a4", "subject": "ATTACK:enterprise:G0117", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--b8b16140-82bc-42a0-82f7-bfc402f4b4a4", "modified": "2026-07-31T18:48:17.600Z", "references": [ { "source_name": "CISA AA20-259A Iran-Based Actor September 2020", "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-259a" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--bbdcf7d5-4a03-4654-b719-8c3456db9a12", "subject": "ATTACK:enterprise:S1148", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--bbdcf7d5-4a03-4654-b719-8c3456db9a12", "modified": "2026-04-29T14:23:06.182Z", "references": [ { "source_name": "Sekoia Raccoon2 2022", "url": "https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis/" }, { "source_name": "Sekoia Raccoon1 2022", "url": "https://blog.sekoia.io/raccoon-stealer-v2-part-1-the-return-of-the-dead/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--bca618ac-7867-4dc4-b683-ae3f61addc68", "subject": "ATTACK:enterprise:S0241", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--bca618ac-7867-4dc4-b683-ae3f61addc68", "modified": "2026-04-29T14:23:06.183Z", "references": [ { "source_name": "RATANKBA", "url": "https://www.trendmicro.com/en_us/research/17/b/ratankba-watering-holes-against-enterprises.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--bfe610a9-83be-47b4-8928-c5a33007ddb6", "subject": "ATTACK:enterprise:S1201", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--bfe610a9-83be-47b4-8928-c5a33007ddb6", "modified": "2026-04-29T14:23:06.188Z", "references": [ { "source_name": "Zscaler Kimsuky TRANSLATEXT", "url": "https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--c174f9d0-513c-440a-8a99-65eb68b494bb", "subject": "ATTACK:enterprise:S1228", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--c174f9d0-513c-440a-8a99-65eb68b494bb", "modified": "2026-04-29T14:23:06.190Z", "references": [ { "source_name": "Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024", "url": "https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--c2e58b40-7644-4c0c-92ac-b63a565aca44", "subject": "ATTACK:enterprise:S0269", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--c2e58b40-7644-4c0c-92ac-b63a565aca44", "modified": "2026-04-29T14:23:06.192Z", "references": [ { "source_name": "Unit 42 QUADAGENT July 2018", "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--c3cef083-71f7-46ed-85c1-0b44ac24b85e", "subject": "ATTACK:enterprise:G0087", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--c3cef083-71f7-46ed-85c1-0b44ac24b85e", "modified": "2026-07-31T18:47:53.935Z", "references": [ { "source_name": "FBI FLASH APT39 September 2020", "url": "https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--c4179f06-f1e8-432c-81db-c88b3a37f0bc", "subject": "ATTACK:enterprise:S1099", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--c4179f06-f1e8-432c-81db-c88b3a37f0bc", "modified": "2026-04-29T14:23:06.193Z", "references": [ { "source_name": "Kaspersky ToddyCat June 2022", "url": "https://securelist.com/toddycat/106799/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--c495478b-6bae-4d1e-a43e-be07fe7cdb48", "subject": "ATTACK:enterprise:G0114", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--c495478b-6bae-4d1e-a43e-be07fe7cdb48", "modified": "2026-07-31T20:48:41.568Z", "references": [ { "source_name": "NCC Group Chimera January 2021", "url": "https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--c4e03a2f-3617-4017-8dab-8904b1060c87", "subject": "ATTACK:enterprise:S0251", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--c4e03a2f-3617-4017-8dab-8904b1060c87", "modified": "2026-04-29T14:23:06.194Z", "references": [ { "source_name": "ESET Zebrocy May 2019", "url": "https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--c6a7e9fe-cdf3-451a-b97f-788b5839606c", "subject": "ATTACK:enterprise:S0666", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--c6a7e9fe-cdf3-451a-b97f-788b5839606c", "modified": "2026-04-29T14:23:06.197Z", "references": [ { "source_name": "ESET Gelsemium June 2021", "url": "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--c844b416-6de4-4fd5-9255-91c1783cad2a", "subject": "ATTACK:enterprise:S0332", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--c844b416-6de4-4fd5-9255-91c1783cad2a", "modified": "2026-04-29T14:23:06.199Z", "references": [ { "source_name": "Fortinet Remcos Campaign NOV 2024", "url": "https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--c88502ec-f0f7-4b86-865b-8dc0a21b9580", "subject": "ATTACK:enterprise:S0603", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--c88502ec-f0f7-4b86-865b-8dc0a21b9580", "modified": "2026-04-29T14:23:06.199Z", "references": [ { "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011", "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--c8bf1e63-1275-46c7-b378-b4a3cc3eb369", "subject": "ATTACK:enterprise:S0238", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--c8bf1e63-1275-46c7-b378-b4a3cc3eb369", "modified": "2026-04-29T14:23:06.200Z", "references": [ { "source_name": "McAfee GhostSecret", "url": "https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--cedfb953-2088-4e8d-a21b-57fdfce65337", "subject": "ATTACK:enterprise:S0559", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--cedfb953-2088-4e8d-a21b-57fdfce65337", "modified": "2026-04-29T14:23:06.208Z", "references": [ { "source_name": "FireEye SUNBURST Backdoor December 2020", "url": "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--d078f862-c090-4e79-808b-ff69887a920c", "subject": "ATTACK:enterprise:S0184", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--d078f862-c090-4e79-808b-ff69887a920c", "modified": "2026-04-29T14:23:06.211Z", "references": [ { "source_name": "FireEye APT34 Dec 2017", "url": "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--d18d7fab-1f10-4b83-83e1-a288ec4db2bd", "subject": "ATTACK:enterprise:S0330", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--d18d7fab-1f10-4b83-83e1-a288ec4db2bd", "modified": "2026-04-29T14:23:06.212Z", "references": [ { "source_name": "GDATA Zeus Panda June 2017", "url": "https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--d4e65cc4-3cd3-4d0e-b3b5-09fd12c659bf", "subject": "ATTACK:enterprise:G0096", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--d4e65cc4-3cd3-4d0e-b3b5-09fd12c659bf", "modified": "2026-07-31T20:48:27.579Z", "references": [ { "source_name": "Rostovcev APT41 2021", "url": "https://www.group-ib.com/blog/apt41-world-tour-2021/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--da139c4d-ee2f-4d07-9d0b-fb60bdf0353c", "subject": "ATTACK:enterprise:G1034", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--da139c4d-ee2f-4d07-9d0b-fb60bdf0353c", "modified": "2026-07-31T18:48:27.254Z", "references": [ { "source_name": "Symantec Daggerfly 2023", "url": "https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--dac3df5a-9569-41ac-94d2-115062b7b632", "subject": "ATTACK:enterprise:S0448", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--dac3df5a-9569-41ac-94d2-115062b7b632", "modified": "2026-04-29T14:23:06.224Z", "references": [ { "source_name": "McAfee Sharpshooter December 2018", "url": "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--de4a0c7c-2a21-4038-8466-7f933be35d95", "subject": "ATTACK:enterprise:G1017", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--de4a0c7c-2a21-4038-8466-7f933be35d95", "modified": "2026-07-31T18:47:41.372Z", "references": [ { "source_name": "CISA AA24-038A PRC Critical Infrastructure February 2024", "url": "https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf" }, { "source_name": "Joint Cybersecurity Advisory Volt Typhoon June 2023", "url": "https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--e1caf917-c15f-4388-8ca0-6cdefd01da8f", "subject": "ATTACK:enterprise:S0115", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--e1caf917-c15f-4388-8ca0-6cdefd01da8f", "modified": "2026-04-29T14:23:06.233Z", "references": [ { "source_name": "Proofpoint Operation Transparent Tribe March 2016", "url": "https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--e30c24d3-d440-4395-88b3-3192a02c4364", "subject": "ATTACK:enterprise:G0049", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--e30c24d3-d440-4395-88b3-3192a02c4364", "modified": "2026-07-31T20:48:35.946Z", "references": [ { "source_name": "Palo Alto OilRig May 2016", "url": "http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--e56386ab-5c44-403a-bfaf-dce6c6129c0c", "subject": "ATTACK:enterprise:G0119", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--e56386ab-5c44-403a-bfaf-dce6c6129c0c", "modified": "2026-07-31T18:47:36.069Z", "references": [ { "source_name": "Mandiant_UNC2165", "url": "https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--e611b2ca-ecb4-47f4-acc2-614d37926d5b", "subject": "ATTACK:enterprise:S1065", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--e611b2ca-ecb4-47f4-acc2-614d37926d5b", "modified": "2026-04-29T14:23:06.238Z", "references": [ { "source_name": "MalwareBytes WoodyRAT Aug 2022", "url": "https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--e8805949-55f7-47cd-965c-2edd4221da12", "subject": "ATTACK:enterprise:S1076", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--e8805949-55f7-47cd-965c-2edd4221da12", "modified": "2026-04-29T14:23:06.241Z", "references": [ { "source_name": "Mandiant Suspected Turla Campaign February 2023", "url": "https://www.mandiant.com/resources/blog/turla-galaxy-opportunity" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--e9a4e4bd-717a-4048-a623-4a1758b93acd", "subject": "ATTACK:enterprise:S0627", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--e9a4e4bd-717a-4048-a623-4a1758b93acd", "modified": "2026-04-29T14:23:06.243Z", "references": [ { "source_name": "Securelist APT10 March 2021", "url": "https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--f023577a-e87f-4d0e-beef-575293a86153", "subject": "ATTACK:enterprise:S0021", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--f023577a-e87f-4d0e-beef-575293a86153", "modified": "2026-04-29T14:23:06.252Z", "references": [ { "source_name": "FireEye Periscope March 2018", "url": "https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--f1183695-42c7-4d17-81b3-18d3fdd8822a", "subject": "ATTACK:enterprise:S0674", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--f1183695-42c7-4d17-81b3-18d3fdd8822a", "modified": "2026-04-29T14:23:06.253Z", "references": [ { "source_name": "Check Point APT35 CharmPower January 2022", "url": "https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--f44478f1-fdd7-4e84-8b96-60e6c6a10683", "subject": "ATTACK:enterprise:S0172", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--f44478f1-fdd7-4e84-8b96-60e6c6a10683", "modified": "2026-04-29T14:23:06.257Z", "references": [ { "source_name": "Palo Alto Reaver Nov 2017", "url": "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--f55d54fe-27ed-41f9-81db-11ccbe2d2125", "subject": "ATTACK:enterprise:S0023", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--f55d54fe-27ed-41f9-81db-11ccbe2d2125", "modified": "2026-04-29T14:23:06.258Z", "references": [ { "source_name": "FireEye APT28", "url": "https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--f6c9d3c4-2e47-4881-a376-e60791092fc5", "subject": "ATTACK:enterprise:S0604", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--f6c9d3c4-2e47-4881-a376-e60791092fc5", "modified": "2026-04-29T14:23:06.260Z", "references": [ { "source_name": "ESET Industroyer", "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--f8705660-10d1-4eca-80c6-f2884cdecb36", "subject": "ATTACK:enterprise:S0249", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--f8705660-10d1-4eca-80c6-f2884cdecb36", "modified": "2026-04-29T14:23:06.263Z", "references": [ { "source_name": "McAfee Gold Dragon", "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--f8c754dd-a4a8-4507-bce2-c738e5354a3c", "subject": "ATTACK:enterprise:S0532", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--f8c754dd-a4a8-4507-bce2-c738e5354a3c", "modified": "2026-04-29T14:23:06.263Z", "references": [ { "source_name": "Unit 42 Lucifer June 2020", "url": "https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--fc661e81-fc5e-4243-874e-f311bc5a2d8d", "subject": "ATTACK:enterprise:S0438", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--fc661e81-fc5e-4243-874e-f311bc5a2d8d", "modified": "2026-04-29T14:23:06.267Z", "references": [ { "source_name": "ESET Attor Oct 2019", "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--fdb02bf4-a950-4ae7-b07c-a3ed0322ef6e", "subject": "ATTACK:enterprise:S0260", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--fdb02bf4-a950-4ae7-b07c-a3ed0322ef6e", "modified": "2026-04-29T14:23:06.270Z", "references": [ { "source_name": "ESET InvisiMole June 2018", "url": "https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 }, { "id": "enterprise:relationship--feef4e0f-c65b-42ed-9fdf-e5fe38a6adaa", "subject": "ATTACK:enterprise:G0030", "predicate": "uses", "object": "ATTACK:enterprise:T1012", "asserted_by": "MITRE ATT&CK", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "snapshot": "enterprise-attack-20.0.json", "evidence_locator": "relationship--feef4e0f-c65b-42ed-9fdf-e5fe38a6adaa", "modified": "2026-07-31T18:48:07.218Z", "references": [ { "source_name": "Cisco LotusBlossom 2025", "url": "https://blog.talosintelligence.com/lotus-blossom-espionage-group/" } ], "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.", "source_occurrences": 1 } ], "source_snapshot": { "file": "enterprise-attack-20.0.json", "url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json", "sha256": "81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352", "bytes": 55271014, "checked_at": "2026-10-16T03:31:39Z" }, "notices_url": "https://aol.pm/source-notices.txt", "notices": "License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n" } License ------- The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. "© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation." Disclaimers ----------- MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or variations on existing techniques not documented by ATT&CK. ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.