{"record":{"id":"ATTACK:enterprise:T1027.002","title":"Software Packing","type":"Subtechnique","source_url":"https://attack.mitre.org/techniques/T1027/002","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--deb98323-e13f-4b0c-8d94-175379069062","external_id":"T1027.002","domain":"enterprise","created":"2020-02-05T14:17:46.686Z","modified":"2026-09-11T19:21:13.428Z","version":"2.0","aliases":[],"tactics":["stealth"],"source_references":[{"source_name":"Awesome Executable Packing","url":"https://github.com/dhondta/awesome-executable-packing"},{"source_name":"ESET FinFisher Jan 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/01/WP-FinFisher.pdf"}]},"assertions":[{"id":"enterprise:relationship--03913b3d-2078-4ef1-b155-918cc9baf49c","subject":"ATTACK:enterprise:G1058","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--03913b3d-2078-4ef1-b155-918cc9baf49c","modified":"2026-09-23T22:38:03.835Z","references":[{"source_name":"SoučekESET_Gentlemen_Jun2026","url":"https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0bb1573c-f30f-449c-931e-c5de024e96f8","subject":"ATTACK:enterprise:S0588","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0bb1573c-f30f-449c-931e-c5de024e96f8","modified":"2026-04-29T14:23:05.919Z","references":[{"source_name":"FireEye SUNSHUTTLE Mar 2021","url":"https://www.fireeye.com/blog/threat-research/2021/03/sunshuttle-second-stage-backdoor-targeting-us-based-entity.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0c5577aa-30c5-47f5-83f3-34260860e2b6","subject":"ATTACK:enterprise:S0447","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0c5577aa-30c5-47f5-83f3-34260860e2b6","modified":"2026-04-29T14:23:05.920Z","references":[{"source_name":"Infoblox Lokibot January 2019","url":"https://insights.infoblox.com/threat-intelligence-reports/threat-intelligence--22"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1161865b-7120-4ca3-a4dd-6d1ee0e02609","subject":"ATTACK:enterprise:S0625","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1161865b-7120-4ca3-a4dd-6d1ee0e02609","modified":"2026-04-29T14:23:05.928Z","references":[{"source_name":"McAfee Cuba April 2021","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--141d1c0d-2f56-4b56-8834-ca3dab22faf9","subject":"ATTACK:enterprise:S0257","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--141d1c0d-2f56-4b56-8834-ca3dab22faf9","modified":"2026-04-29T14:23:05.931Z","references":[{"source_name":"Unit 42 VERMIN Jan 2018","url":"https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1820202b-0994-452a-93e7-ce21496d2ab4","subject":"ATTACK:enterprise:S0020","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1820202b-0994-452a-93e7-ce21496d2ab4","modified":"2026-04-29T14:23:05.937Z","references":[{"source_name":"Lee 2013","url":"https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--191364fd-6564-4adc-a717-cfec6b13f438","subject":"ATTACK:enterprise:C0017","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--191364fd-6564-4adc-a717-cfec6b13f438","modified":"2026-07-31T21:12:30.959Z","references":[{"source_name":"Mandiant APT41","url":"https://www.mandiant.com/resources/apt41-us-state-governments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1b2eddbb-5a76-4488-9b65-b6ead43c2ddc","subject":"ATTACK:enterprise:S1130","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1b2eddbb-5a76-4488-9b65-b6ead43c2ddc","modified":"2026-04-29T14:23:05.942Z","references":[{"source_name":"TrendMicro RaspberryRobin 2022","url":"https://www.trendmicro.com/en_us/research/22/l/raspberry-robin-malware-targets-telecom-governments.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1c8951ff-5de9-4842-b889-0c439aa76e8f","subject":"ATTACK:enterprise:S0565","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1c8951ff-5de9-4842-b889-0c439aa76e8f","modified":"2026-04-29T14:23:05.944Z","references":[{"source_name":"Symantec RAINDROP January 2021","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware"},{"source_name":"Microsoft Deep Dive Solorigate January 2021","url":"https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1f9e644f-1ec9-4d2d-a475-3fca1bceaf20","subject":"ATTACK:enterprise:S1196","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1f9e644f-1ec9-4d2d-a475-3fca1bceaf20","modified":"2026-04-29T14:23:05.948Z","references":[{"source_name":"ASEC Troll Stealer 2024","url":"https://asec.ahnlab.com/en/61934/"},{"source_name":"S2W Troll Stealer 2024","url":"https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2155f707-de4f-4ef1-9982-1af90392af5f","subject":"ATTACK:enterprise:G0089","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2155f707-de4f-4ef1-9982-1af90392af5f","modified":"2026-07-31T18:47:59.826Z","references":[{"source_name":"Cylance Shaheen Nov 2018","url":"https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--229e8b6e-6c16-406a-8def-7588aaae4fcb","subject":"ATTACK:enterprise:S0022","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--229e8b6e-6c16-406a-8def-7588aaae4fcb","modified":"2026-04-29T14:23:05.952Z","references":[{"source_name":"Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023","url":"https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"},{"source_name":"Symantec Waterbug","url":"https://www.threatminer.org/report.php?q=waterbug-attack-group.pdf&y=2015#gsc.tab=0&gsc.q=waterbug-attack-group.pdf&gsc.page=1"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--25df53ed-4a07-4e71-8a1b-a84a2571e043","subject":"ATTACK:enterprise:S0543","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--25df53ed-4a07-4e71-8a1b-a84a2571e043","modified":"2026-04-29T14:23:05.957Z","references":[{"source_name":"Unit42 Molerat Mar 2020","url":"https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2909d2e7-ec59-4100-ad7a-f1197d419ae6","subject":"ATTACK:enterprise:G1018","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2909d2e7-ec59-4100-ad7a-f1197d419ae6","modified":"2026-07-31T18:47:55.104Z","references":[{"source_name":"Cisco Operation Layover September 2021","url":"https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--295f4cf0-1fb7-4d60-8e15-af8f301d0e1b","subject":"ATTACK:enterprise:S0198","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--295f4cf0-1fb7-4d60-8e15-af8f301d0e1b","modified":"2026-04-29T14:23:05.961Z","references":[{"source_name":"Red Canary NETWIRE January 2020","url":"https://redcanary.com/blog/netwire-remote-access-trojan-on-linux/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--29dcecc6-83ea-4e82-b368-b54812157b41","subject":"ATTACK:enterprise:S0409","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--29dcecc6-83ea-4e82-b368-b54812157b41","modified":"2026-04-29T14:23:05.962Z","references":[{"source_name":"ESET Machete July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2a04cfdd-a27a-498c-bbe2-8677a13811e0","subject":"ATTACK:enterprise:S0622","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2a04cfdd-a27a-498c-bbe2-8677a13811e0","modified":"2026-04-29T14:23:05.962Z","references":[{"source_name":"Malwarebytes Kimsuky June 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2f507d82-1df4-4c9c-804a-2e6060944142","subject":"ATTACK:enterprise:S0187","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2f507d82-1df4-4c9c-804a-2e6060944142","modified":"2026-04-29T14:23:05.970Z","references":[{"source_name":"Trend Micro Daserf Nov 2017","url":"http://blog.trendmicro.com/trendlabs-security-intelligence/redbaldknight-bronze-butler-daserf-backdoor-now-using-steganography/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2ff57c5f-523f-41f0-a6d4-676b939b561a","subject":"ATTACK:enterprise:G0096","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2ff57c5f-523f-41f0-a6d4-676b939b561a","modified":"2026-07-31T20:48:26.907Z","references":[{"source_name":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--30db098c-7e7b-42bc-b4dc-f2b54e7dde65","subject":"ATTACK:enterprise:S0281","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--30db098c-7e7b-42bc-b4dc-f2b54e7dde65","modified":"2026-04-29T14:23:05.979Z","references":[{"source_name":"hexed osx.dok analysis 2019","url":"https://web.archive.org/web/20221007144948/http://www.hexed.in/2019/07/osxdok-analysis.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--31fb3ebe-3fc9-4257-b7d5-a1b12b54bbe3","subject":"ATTACK:enterprise:G0070","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--31fb3ebe-3fc9-4257-b7d5-a1b12b54bbe3","modified":"2026-09-02T18:51:44.275Z","references":[{"source_name":"Lookout Dark Caracal Jan 2018","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--33b2a8e7-658a-4c00-bd88-bcc36c980012","subject":"ATTACK:enterprise:C0058","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--33b2a8e7-658a-4c00-bd88-bcc36c980012","modified":"2026-07-31T18:47:18.022Z","references":[{"source_name":"Palo Alto SharePoint Vulnerabilities JUL 2025","url":"https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--347b7512-1e76-456f-9f04-0179d056ca9a","subject":"ATTACK:enterprise:S0356","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--347b7512-1e76-456f-9f04-0179d056ca9a","modified":"2026-04-29T14:23:05.989Z","references":[{"source_name":"Malwarebytes KONNI Evolves Jan 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/konni-evolves-into-stealthier-rat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3570d377-9139-4221-9c4b-15147b78e8ad","subject":"ATTACK:enterprise:S1202","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3570d377-9139-4221-9c4b-15147b78e8ad","modified":"2026-04-29T14:23:05.991Z","references":[{"source_name":"INCIBE-CERT LockBit MAR 2024","url":"https://www.incibe.es/en/incibe-cert/blog/lockbit-response-and-recovery-actions"},{"source_name":"Sentinel Labs LockBit 3.0 JUL 2022","url":"https://www.sentinelone.com/labs/lockbit-3-0-update-unpicking-the-ransomwares-latest-anti-analysis-and-evasion-techniques"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3ae882d8-8c06-40e2-b953-8747bb720a8c","subject":"ATTACK:enterprise:S9046","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3ae882d8-8c06-40e2-b953-8747bb720a8c","modified":"2026-09-26T03:46:46.324Z","references":[{"source_name":"Claroty-IOCONTROL","url":"https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol"},{"source_name":"Dragos-2026-Year-In-Review","url":"https://5943619.hs-sites.com/hubfs/312-Year-in-Review/2026/Dragos-2026-OT-Cybersecurity-Report-A-Year-in-Review.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3be6aadd-ea5f-4910-a8a0-d1019977dc43","subject":"ATTACK:enterprise:C0002","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3be6aadd-ea5f-4910-a8a0-d1019977dc43","modified":"2026-07-31T18:47:30.738Z","references":[{"source_name":"McAfee Night Dragon","url":"https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3da56da6-08fe-406b-bd0d-cd4f72dd67f4","subject":"ATTACK:enterprise:C0005","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3da56da6-08fe-406b-bd0d-cd4f72dd67f4","modified":"2026-07-31T18:47:22.517Z","references":[{"source_name":"ESET Operation Spalax Jan 2021","url":"https://www.welivesecurity.com/2021/01/12/operation-spalax-targeted-malware-attacks-colombia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3e36bc27-d1c1-4ccd-bf6d-2868843664c8","subject":"ATTACK:enterprise:S0373","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3e36bc27-d1c1-4ccd-bf6d-2868843664c8","modified":"2026-04-29T14:23:06.010Z","references":[{"source_name":"Cybereason Astaroth Feb 2019","url":"https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3f42c6bd-332d-40b0-9e5f-ead557d021c9","subject":"ATTACK:enterprise:G1007","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3f42c6bd-332d-40b0-9e5f-ead557d021c9","modified":"2026-07-31T18:47:59.467Z","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--40c202ae-fd92-4506-b72a-5fb0e7bcf99a","subject":"ATTACK:enterprise:S0094","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--40c202ae-fd92-4506-b72a-5fb0e7bcf99a","modified":"2026-04-29T14:23:06.013Z","references":[{"source_name":"Symantec Dragonfly","url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"},{"source_name":"Secureworks Karagany July 2019","url":"https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--41d56dfa-e797-4bd1-826c-3e78d346f5ed","subject":"ATTACK:enterprise:G1019","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--41d56dfa-e797-4bd1-826c-3e78d346f5ed","modified":"2026-07-31T20:48:38.800Z","references":[{"source_name":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4636d747-9b81-4139-b86d-6e4edbc4111e","subject":"ATTACK:enterprise:S0182","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4636d747-9b81-4139-b86d-6e4edbc4111e","modified":"2026-04-29T14:23:06.021Z","references":[{"source_name":"FinFisher Citation","url":"https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html"},{"source_name":"Securelist BlackOasis Oct 2017","url":"https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4bc2e50e-0753-497f-9ec0-af270abe2af1","subject":"ATTACK:enterprise:G0087","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4bc2e50e-0753-497f-9ec0-af270abe2af1","modified":"2026-07-31T18:47:53.459Z","references":[{"source_name":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"},{"source_name":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4cb25ac9-9eb9-47ee-b3f9-53c5a6365c46","subject":"ATTACK:enterprise:S0638","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4cb25ac9-9eb9-47ee-b3f9-53c5a6365c46","modified":"2026-04-29T14:23:06.030Z","references":[{"source_name":"Sogeti CERT ESEC Babuk March 2021","url":"https://www.sogeti.com/globalassets/reports/cybersecchronicles_-_babuk.pdf"},{"source_name":"McAfee Babuk February 2021","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-babuk-ransomware.pdf"},{"source_name":"Medium Babuk February 2021","url":"https://sebdraven.medium.com/babuk-is-distributed-packed-78e2f5dd2e62"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--531ba99f-18d6-4ecd-a8ec-6d40550bf4af","subject":"ATTACK:enterprise:S1183","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--531ba99f-18d6-4ecd-a8ec-6d40550bf4af","modified":"2026-04-29T14:23:06.039Z","references":[{"source_name":"PaloAlto StrelaStealer 2024","url":"https://unit42.paloaltonetworks.com/strelastealer-campaign/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5344358d-8558-44b1-910d-cbb6d1aae714","subject":"ATTACK:enterprise:S0601","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5344358d-8558-44b1-910d-cbb6d1aae714","modified":"2026-04-29T14:23:06.039Z","references":[{"source_name":"Unit 42 Hildegard Malware","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--552c3e40-dbb9-4675-bc31-5436a15253d8","subject":"ATTACK:enterprise:S0554","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--552c3e40-dbb9-4675-bc31-5436a15253d8","modified":"2026-04-29T14:23:06.041Z","references":[{"source_name":"NHS Digital Egregor Nov 2020","url":"https://digital.nhs.uk/cyber-alerts/2020/cc-3681#summary"},{"source_name":"Cyble Egregor Oct 2020","url":"https://cybleinc.com/2020/10/31/egregor-ransomware-a-deep-dive-into-its-activities-and-techniques/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--573f3932-8435-4b4a-b138-d9c955495197","subject":"ATTACK:enterprise:G0092","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--573f3932-8435-4b4a-b138-d9c955495197","modified":"2026-07-31T18:48:05.492Z","references":[{"source_name":"IBM TA505 April 2020","url":"https://web.archive.org/web/20200420201624/https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--583335b0-7d65-4fbb-aa41-3bbbd08598cd","subject":"ATTACK:enterprise:C0016","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--583335b0-7d65-4fbb-aa41-3bbbd08598cd","modified":"2026-07-31T20:48:14.685Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--59b6b4e2-f2fe-4d81-b85c-1fe6c8102eba","subject":"ATTACK:enterprise:G1017","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--59b6b4e2-f2fe-4d81-b85c-1fe6c8102eba","modified":"2026-07-31T18:47:40.380Z","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5ae4207c-95db-4a16-bfac-1d8daf29ba4a","subject":"ATTACK:enterprise:S0266","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5ae4207c-95db-4a16-bfac-1d8daf29ba4a","modified":"2026-04-29T14:23:06.049Z","references":[{"source_name":"S2 Grupo TrickBot June 2017","url":"https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5d256f6f-9501-4fec-9255-941b8c2fe35a","subject":"ATTACK:enterprise:S1240","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5d256f6f-9501-4fec-9255-941b8c2fe35a","modified":"2026-04-29T14:23:06.052Z","references":[{"source_name":"ESET RedLine Stealer November 2024","url":"https://www.welivesecurity.com/en/eset-research/life-crooked-redline-analyzing-infamous-infostealers-backend/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5d4f48e5-48a1-4ade-ae59-b34824b8181f","subject":"ATTACK:enterprise:S0532","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5d4f48e5-48a1-4ade-ae59-b34824b8181f","modified":"2026-04-29T14:23:06.052Z","references":[{"source_name":"Unit 42 Lucifer June 2020","url":"https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5d8315ce-3c76-4b78-8d6a-f0b7b101bcc0","subject":"ATTACK:enterprise:G0093","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5d8315ce-3c76-4b78-8d6a-f0b7b101bcc0","modified":"2026-07-31T18:47:37.260Z","references":[{"source_name":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--60d3d7d8-408e-4663-b081-69fe66303983","subject":"ATTACK:enterprise:S0695","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--60d3d7d8-408e-4663-b081-69fe66303983","modified":"2026-04-29T14:23:06.057Z","references":[{"source_name":"Donut Github","url":"https://github.com/TheWover/donut"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--60db2ece-4f5e-4c47-a7eb-fd8bcf7ddc49","subject":"ATTACK:enterprise:G0139","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--60db2ece-4f5e-4c47-a7eb-fd8bcf7ddc49","modified":"2026-07-31T18:47:49.519Z","references":[{"source_name":"Trend Micro TeamTNT","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--61986499-5358-4edc-aab1-6a13ae0f7c06","subject":"ATTACK:enterprise:G0082","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--61986499-5358-4edc-aab1-6a13ae0f7c06","modified":"2026-07-31T20:48:23.195Z","references":[{"source_name":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--63ae56fe-04c2-41f5-a2be-c1880e67b490","subject":"ATTACK:enterprise:S0461","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--63ae56fe-04c2-41f5-a2be-c1880e67b490","modified":"2026-04-29T14:23:06.061Z","references":[{"source_name":"IBM TA505 April 2020","url":"https://web.archive.org/web/20200420201624/https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--63e47b19-5fe4-485d-9544-ab90a66edf6d","subject":"ATTACK:enterprise:S0671","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--63e47b19-5fe4-485d-9544-ab90a66edf6d","modified":"2026-04-29T14:23:06.061Z","references":[{"source_name":"Kaspersky Tomiris Sep 2021","url":"https://securelist.com/darkhalo-after-solarwinds-the-tomiris-connection/104311/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--65a21b2c-a631-4a3e-982e-5086a0b8b944","subject":"ATTACK:enterprise:S1210","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--65a21b2c-a631-4a3e-982e-5086a0b8b944","modified":"2026-04-29T14:23:06.063Z","references":[{"source_name":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--66c79e9f-7528-4a14-9525-866325b6abce","subject":"ATTACK:enterprise:S0614","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--66c79e9f-7528-4a14-9525-866325b6abce","modified":"2026-04-29T14:23:06.065Z","references":[{"source_name":"BlackBerry CostaRicto November 2020","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6801470e-9db4-4900-9bf0-aaef2774cdd3","subject":"ATTACK:enterprise:S1160","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6801470e-9db4-4900-9bf0-aaef2774cdd3","modified":"2026-04-29T14:23:06.066Z","references":[{"source_name":"Elastic Latrodectus May 2024","url":"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--68067ea4-1d06-4c3d-bee2-2c59f43d41f4","subject":"ATTACK:enterprise:S0611","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--68067ea4-1d06-4c3d-bee2-2c59f43d41f4","modified":"2026-04-29T14:23:06.066Z","references":[{"source_name":"Mcafee Clop Aug 2019","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/"},{"source_name":"Cybereason Clop Dec 2020","url":"https://www.cybereason.com/blog/cybereason-vs.-clop-ransomware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6901f3e3-6a46-4596-880d-341afff59aa1","subject":"ATTACK:enterprise:S9018","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6901f3e3-6a46-4596-880d-341afff59aa1","modified":"2026-04-29T14:23:06.068Z","references":[{"source_name":"Check Point Blind Eagle MAR 2025","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"},{"source_name":"Palo Alto HeartCrypt DEC 2024","url":"https://unit42.paloaltonetworks.com/packer-as-a-service-heartcrypt-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6af4810f-3abe-43eb-92b0-ee8fefc2a4b9","subject":"ATTACK:enterprise:S0512","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6af4810f-3abe-43eb-92b0-ee8fefc2a4b9","modified":"2026-04-29T14:23:06.071Z","references":[{"source_name":"ESET Dukes October 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6ebb24bf-8e82-4824-8959-b6f4348d2efd","subject":"ATTACK:enterprise:S1018","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6ebb24bf-8e82-4824-8959-b6f4348d2efd","modified":"2026-04-29T14:23:06.076Z","references":[{"source_name":"Malwarebytes Saint Bot April 2021","url":"https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7226ed2f-506e-4608-913f-953aca532413","subject":"ATTACK:enterprise:S0678","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7226ed2f-506e-4608-913f-953aca532413","modified":"2026-04-29T14:23:06.081Z","references":[{"source_name":"McAfee Lazarus Nov 2020","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--74f14668-7111-4f96-a307-4aac00d91cf4","subject":"ATTACK:enterprise:S0431","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--74f14668-7111-4f96-a307-4aac00d91cf4","modified":"2026-04-29T14:23:06.085Z","references":[{"source_name":"Carbon Black HotCroissant April 2020","url":"https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--75d297b3-bd2e-4815-9c28-649f7f1d4a62","subject":"ATTACK:enterprise:S0520","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--75d297b3-bd2e-4815-9c28-649f7f1d4a62","modified":"2026-04-29T14:23:06.086Z","references":[{"source_name":"US-CERT BLINDINGCAN Aug 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--78fc38f6-88ee-4f26-84e1-7532d95a4fbe","subject":"ATTACK:enterprise:G0106","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--78fc38f6-88ee-4f26-84e1-7532d95a4fbe","modified":"2026-07-31T18:47:52.481Z","references":[{"source_name":"Talos Rocke August 2018","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"},{"source_name":"Unit 42 Rocke January 2019","url":"https://unit42.paloaltonetworks.com/malware-used-by-rocke-group-evolves-to-evade-detection-by-cloud-security-products/"},{"source_name":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--79127e56-edbc-422b-9c32-72ce55f5ec04","subject":"ATTACK:enterprise:S0352","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--79127e56-edbc-422b-9c32-72ce55f5ec04","modified":"2026-04-29T14:23:06.090Z","references":[{"source_name":"ESET OceanLotus macOS April 2019","url":"https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--891a97f1-d3e2-45ff-a079-43dcad21a175","subject":"ATTACK:enterprise:G0040","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--891a97f1-d3e2-45ff-a079-43dcad21a175","modified":"2026-07-31T20:48:26.340Z","references":[{"source_name":"Securelist Dropping Elephant","url":"https://securelist.com/the-dropping-elephant-actor/75328/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--89210061-1ce3-4fdf-af84-2afee2062296","subject":"ATTACK:enterprise:S0283","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--89210061-1ce3-4fdf-af84-2afee2062296","modified":"2026-04-29T14:23:06.112Z","references":[{"source_name":"Kaspersky Adwind Feb 2016","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07195002/KL_AdwindPublicReport_2016.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--895a3c63-26d1-4846-8b8d-8f6b2c266910","subject":"ATTACK:enterprise:S0251","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--895a3c63-26d1-4846-8b8d-8f6b2c266910","modified":"2026-04-29T14:23:06.113Z","references":[{"source_name":"Unit42 Sofacy Dec 2018","url":"https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/"},{"source_name":"Accenture SNAKEMACKEREL Nov 2018","url":"https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8a48e56d-f837-4a5a-99b6-db0f60b541a0","subject":"ATTACK:enterprise:S0053","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8a48e56d-f837-4a5a-99b6-db0f60b541a0","modified":"2026-04-29T14:23:06.114Z","references":[{"source_name":"Unit 42 SeaDuke 2015","url":"http://researchcenter.paloaltonetworks.com/2015/07/unit-42-technical-analysis-seaduke/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--94883652-f338-47e5-95d9-b38060137fde","subject":"ATTACK:enterprise:S1105","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--94883652-f338-47e5-95d9-b38060137fde","modified":"2026-04-29T14:23:06.127Z","references":[{"source_name":"NCSC-NL COATHANGER Feb 2024","url":"https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear/TLP-CLEAR+MIVD+AIVD+Advisory+COATHANGER.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--97784aa6-4d45-4698-9acd-918bb0502e32","subject":"ATTACK:enterprise:S0398","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--97784aa6-4d45-4698-9acd-918bb0502e32","modified":"2026-04-29T14:23:06.131Z","references":[{"source_name":"Trend Micro Iron Tiger April 2021","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9873626b-74e8-456d-9e34-95a313daa27b","subject":"ATTACK:enterprise:S0085","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9873626b-74e8-456d-9e34-95a313daa27b","modified":"2026-04-29T14:23:06.133Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9877098c-6643-49fb-8b7c-72ea44718cae","subject":"ATTACK:enterprise:S0513","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9877098c-6643-49fb-8b7c-72ea44718cae","modified":"2026-04-29T14:23:06.133Z","references":[{"source_name":"ESET Dukes October 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--98aeed7c-e88b-4c5b-8e8e-21ee3534abe9","subject":"ATTACK:enterprise:S0132","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--98aeed7c-e88b-4c5b-8e8e-21ee3534abe9","modified":"2026-04-29T14:23:06.133Z","references":[{"source_name":"Cisco H1N1 Part 1","url":"http://blogs.cisco.com/security/h1n1-technical-analysis-reveals-new-capabilities"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--998add45-ac31-4020-9179-5730f06ae9cd","subject":"ATTACK:enterprise:C0025","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--998add45-ac31-4020-9179-5730f06ae9cd","modified":"2026-07-31T21:05:26.076Z","references":[{"source_name":"Dragos Crashoverride 2018","url":"https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9ab85095-bac1-4b21-8e9d-e24c084af0d2","subject":"ATTACK:enterprise:S0476","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9ab85095-bac1-4b21-8e9d-e24c084af0d2","modified":"2026-04-29T14:23:06.136Z","references":[{"source_name":"SentinelOne Valak June 2020","url":"https://assets.sentinelone.com/labs/sentinel-one-valak-i"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a44728b1-9cb4-4307-8c4c-37b5acba536e","subject":"ATTACK:enterprise:M1049","predicate":"mitigates","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a44728b1-9cb4-4307-8c4c-37b5acba536e","modified":"2026-04-29T14:23:06.148Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a5347b54-6020-4e8e-acef-6428731cbd7d","subject":"ATTACK:enterprise:S0694","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a5347b54-6020-4e8e-acef-6428731cbd7d","modified":"2026-04-29T14:23:06.150Z","references":[{"source_name":"ClearSky Lazarus Aug 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a78cd480-758b-4fb5-a60a-ecb86d837012","subject":"ATTACK:enterprise:G0094","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a78cd480-758b-4fb5-a60a-ecb86d837012","modified":"2026-07-31T20:48:25.312Z","references":[{"source_name":"Malwarebytes Kimsuky June 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ac88262c-e14d-4f52-a5df-bbddc6d5c1bc","subject":"ATTACK:enterprise:S0444","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ac88262c-e14d-4f52-a5df-bbddc6d5c1bc","modified":"2026-04-29T14:23:06.160Z","references":[{"source_name":"FOX-IT May 2016 Mofang","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ae5e7681-f93e-4b5f-80f9-8235a9015e7f","subject":"ATTACK:enterprise:G0128","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ae5e7681-f93e-4b5f-80f9-8235a9015e7f","modified":"2026-07-31T18:47:52.444Z","references":[{"source_name":"Check Point APT31 February 2021","url":"https://research.checkpoint.com/2021/the-story-of-jian/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--afe14ecc-81be-4724-aea6-cc1266425d1a","subject":"ATTACK:enterprise:S0268","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--afe14ecc-81be-4724-aea6-cc1266425d1a","modified":"2026-04-29T14:23:06.165Z","references":[{"source_name":"Talos Bisonal Mar 2020","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b01660bb-1725-42f4-9419-495b8710e930","subject":"ATTACK:enterprise:C0022","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b01660bb-1725-42f4-9419-495b8710e930","modified":"2026-07-31T21:14:22.811Z","references":[{"source_name":"McAfee Lazarus Nov 2020","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/"},{"source_name":"McAfee Lazarus Jul 2020","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-a-job-offer-thats-too-good-to-be-true/?hilite=%27Operation%27%2C%27North%27%2C%27Star%27"},{"source_name":"ClearSky Lazarus Aug 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b50a1ecc-5c2e-472e-8320-6d708a4bd043","subject":"ATTACK:enterprise:G1051","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b50a1ecc-5c2e-472e-8320-6d708a4bd043","modified":"2026-07-31T18:48:10.933Z","references":[{"source_name":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b703258a-ea4b-4778-9b98-b053bd16a959","subject":"ATTACK:enterprise:S0230","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b703258a-ea4b-4778-9b98-b053bd16a959","modified":"2026-04-29T14:23:06.175Z","references":[{"source_name":"Proofpoint ZeroT Feb 2017","url":"https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bf20f37d-ce08-44f1-bc68-f444aabde3c7","subject":"ATTACK:enterprise:G1053","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bf20f37d-ce08-44f1-bc68-f444aabde3c7","modified":"2026-07-31T18:48:03.928Z","references":[{"source_name":"Google Mandiant Storm-0501 Sabbath Ransomware November 2021","url":"https://cloud.google.com/blog/topics/threat-intelligence/sabbath-ransomware-affiliate/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c2266528-a862-4fc0-bfa1-4fb1d48daa56","subject":"ATTACK:enterprise:S1030","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c2266528-a862-4fc0-bfa1-4fb1d48daa56","modified":"2026-04-29T14:23:06.191Z","references":[{"source_name":"ZScaler Squirrelwaffle Sep 2021","url":"https://www.zscaler.com/blogs/security-research/squirrelwaffle-new-loader-delivering-cobalt-strike"},{"source_name":"Netskope Squirrelwaffle Oct 2021","url":"https://www.netskope.com/blog/squirrelwaffle-new-malware-loader-delivering-cobalt-strike-and-qakbot"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c241606f-e0e2-4179-8e8d-444fb1406df4","subject":"ATTACK:enterprise:S0334","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c241606f-e0e2-4179-8e8d-444fb1406df4","modified":"2026-04-29T14:23:06.191Z","references":[{"source_name":"Malwarebytes DarkComet March 2018","url":"https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c63696bf-8b36-4366-9c3f-7a2d0053c481","subject":"ATTACK:enterprise:S0342","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c63696bf-8b36-4366-9c3f-7a2d0053c481","modified":"2026-04-29T14:23:06.196Z","references":[{"source_name":"ESET GreyEnergy Oct 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c6467df1-e2fd-4fff-b647-606be50a9078","subject":"ATTACK:enterprise:S0024","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c6467df1-e2fd-4fff-b647-606be50a9078","modified":"2026-04-29T14:23:06.196Z","references":[{"source_name":"Malwarebytes Dyreza November 2015","url":"https://blog.malwarebytes.com/threat-analysis/2015/11/a-technical-look-at-dyreza/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c90424e7-4d58-4b2f-b72e-fc630a1a8199","subject":"ATTACK:enterprise:S0530","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c90424e7-4d58-4b2f-b72e-fc630a1a8199","modified":"2026-04-29T14:23:06.200Z","references":[{"source_name":"Securelist Brazilian Banking Malware July 2020","url":"https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c9747fcc-b249-49cc-8f8b-aad9e89bdc31","subject":"ATTACK:enterprise:S0455","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c9747fcc-b249-49cc-8f8b-aad9e89bdc31","modified":"2026-04-29T14:23:06.201Z","references":[{"source_name":"Fortinet Metamorfo Feb 2020","url":"https://www.fortinet.com/blog/threat-research/another-metamorfo-variant-targeting-customers-of-financial-institutions"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cbaf6578-b0f6-4d48-86c1-bfe5089b1b1f","subject":"ATTACK:enterprise:G0027","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cbaf6578-b0f6-4d48-86c1-bfe5089b1b1f","modified":"2026-07-31T18:48:29.658Z","references":[{"source_name":"Trend Micro Iron Tiger April 2021","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"},{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cbb27eed-2e1c-4675-a077-28765060b349","subject":"ATTACK:enterprise:S0248","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cbb27eed-2e1c-4675-a077-28765060b349","modified":"2026-04-29T14:23:06.204Z","references":[{"source_name":"ASERT Donot March 2018","url":"https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d4c5a3a8-203d-4201-80fa-48b5ac9a533f","subject":"ATTACK:enterprise:S0367","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d4c5a3a8-203d-4201-80fa-48b5ac9a533f","modified":"2026-04-29T14:23:06.216Z","references":[{"source_name":"Trend Micro Emotet Jan 2019","url":"https://documents.trendmicro.com/assets/white_papers/ExploringEmotetsActivities_Final.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d5c6c2bd-e49f-4d88-9351-a1c3d7f3ef99","subject":"ATTACK:enterprise:S0264","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d5c6c2bd-e49f-4d88-9351-a1c3d7f3ef99","modified":"2026-04-29T14:23:06.217Z","references":[{"source_name":"Unit 42 OopsIE! Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d81d7589-14cb-4f29-b05c-02cb01f183e4","subject":"ATTACK:enterprise:G1031","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d81d7589-14cb-4f29-b05c-02cb01f183e4","modified":"2026-07-31T18:48:00.445Z","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d9d86c0c-6ee9-4fdc-bb9b-6d331a44bbde","subject":"ATTACK:enterprise:S0527","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d9d86c0c-6ee9-4fdc-bb9b-6d331a44bbde","modified":"2026-04-29T14:23:06.223Z","references":[{"source_name":"Cybereason Kimsuky November 2020","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dca5cde1-ebf3-4cb8-ab80-1a5ab13000fa","subject":"ATTACK:enterprise:T1027.002","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1027","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dca5cde1-ebf3-4cb8-ab80-1a5ab13000fa","modified":"2026-04-29T14:23:06.226Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dd2ef18a-1072-4f5b-a360-a01017b421e2","subject":"ATTACK:enterprise:S0663","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dd2ef18a-1072-4f5b-a360-a01017b421e2","modified":"2026-04-29T14:23:06.227Z","references":[{"source_name":"Lunghi Iron Tiger Linux","url":"https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"},{"source_name":"Trend Micro Iron Tiger April 2021","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--df0d3103-a054-43a5-9b18-d40977171736","subject":"ATTACK:enterprise:S1026","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--df0d3103-a054-43a5-9b18-d40977171736","modified":"2026-04-29T14:23:06.229Z","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--df4bb33c-a98d-4c02-a160-ce3cfd36f291","subject":"ATTACK:enterprise:S0083","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--df4bb33c-a98d-4c02-a160-ce3cfd36f291","modified":"2026-04-29T14:23:06.230Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e01de877-6987-4264-92f7-bb1d1c195d07","subject":"ATTACK:enterprise:S1207","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e01de877-6987-4264-92f7-bb1d1c195d07","modified":"2026-04-29T14:23:06.231Z","references":[{"source_name":"Netskope XLoader 2022","url":"https://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e7169b87-569a-4433-b7f5-f4cdfb43d8fa","subject":"ATTACK:enterprise:S0628","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e7169b87-569a-4433-b7f5-f4cdfb43d8fa","modified":"2026-04-29T14:23:06.240Z","references":[{"source_name":"Securelist APT10 March 2021","url":"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ec62edb4-a463-46f8-82de-1a893caceb5e","subject":"ATTACK:enterprise:S0650","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ec62edb4-a463-46f8-82de-1a893caceb5e","modified":"2026-04-29T14:23:06.247Z","references":[{"source_name":"Cyberint Qakbot May 2021","url":"https://blog.cyberint.com/qakbot-banking-trojan"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ee6b93d4-71f1-4d8c-bc2d-3cbb9b30c866","subject":"ATTACK:enterprise:S0483","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ee6b93d4-71f1-4d8c-bc2d-3cbb9b30c866","modified":"2026-04-29T14:23:06.249Z","references":[{"source_name":"Juniper IcedID June 2020","url":"https://blogs.juniper.net/en-us/threat-research/covid-19-and-fmla-campaigns-used-to-install-new-icedid-banking-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ef1cdbe7-29c9-4be9-a3f7-96e5b7bae031","subject":"ATTACK:enterprise:G0022","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ef1cdbe7-29c9-4be9-a3f7-96e5b7bae031","modified":"2026-07-31T18:47:38.288Z","references":[{"source_name":"APT3 Adversary Emulation Plan","url":"https://attack.mitre.org/docs/APT3_Adversary_Emulation_Plan.pdf"},{"source_name":"FireEye Clandestine Wolf","url":"https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-wolf-adobe-flash-zero-day.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f278e83c-f93e-403d-a088-30c4d9d3f984","subject":"ATTACK:enterprise:S0504","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f278e83c-f93e-403d-a088-30c4d9d3f984","modified":"2026-04-29T14:23:06.255Z","references":[{"source_name":"Cyberreason Anchor December 2019","url":"https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f8c27264-e42d-48fd-9a18-4b275383f155","subject":"ATTACK:enterprise:G0066","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f8c27264-e42d-48fd-9a18-4b275383f155","modified":"2026-07-31T18:47:36.159Z","references":[{"source_name":"Symantec Elderwood Sept 2012","url":"https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f8f63dca-91a1-4bbf-811c-4ed083b36246","subject":"ATTACK:enterprise:S0534","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f8f63dca-91a1-4bbf-811c-4ed083b36246","modified":"2026-04-29T14:23:06.263Z","references":[{"source_name":"Cybereason Bazar July 2020","url":"https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"},{"source_name":"Zscaler Bazar September 2020","url":"https://www.zscaler.com/blogs/research/spear-phishing-campaign-delivers-buer-and-bazar-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ff4e1b0e-eea2-4329-aecc-e5353be8c1f4","subject":"ATTACK:enterprise:G0016","predicate":"uses","object":"ATTACK:enterprise:T1027.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ff4e1b0e-eea2-4329-aecc-e5353be8c1f4","modified":"2026-07-31T18:48:09.480Z","references":[{"source_name":"Mandiant No Easy Breach","url":"https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}