Source assertions are not new attribution claims. No sole inventor or transitive actor-CVE inference.
{
  "record": {
    "id": "ATTACK:enterprise:T1027.013",
    "title": "Encrypted/Encoded File",
    "type": "Subtechnique",
    "source_url": "https://attack.mitre.org/techniques/T1027/013",
    "snapshot": "enterprise-attack-20.0.json",
    "status": "active",
    "rights": "Source metadata only; source notices retained; no operational prose or payloads",
    "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
    "stix_id": "attack-pattern--0d91b3c0-5e50-47c3-949a-2a796f04d144",
    "external_id": "T1027.013",
    "domain": "enterprise",
    "created": "2024-03-29T12:38:17.135Z",
    "modified": "2026-09-11T19:42:10.060Z",
    "version": "2.0",
    "aliases": [

    ],
    "tactics": [
      "stealth"
    ],
    "source_references": [
      {
        "source_name": "File obfuscation",
        "url": "https://www.crowdstrike.com/blog/shlayer-malvertising-campaigns-still-using-flash-update-disguise/"
      },
      {
        "source_name": "SFX - Encrypted/Encoded File",
        "url": "https://www.crowdstrike.com/blog/self-extracting-archives-decoy-files-and-their-hidden-payloads/"
      }
    ]
  },
  "assertions": [
    {
      "id": "enterprise:relationship--0051db4d-9eb9-4b22-93a5-b6593176da75",
      "subject": "ATTACK:enterprise:S1052",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0051db4d-9eb9-4b22-93a5-b6593176da75",
      "modified": "2026-04-29T14:23:05.903Z",
      "references": [
        {
          "source_name": "Mandiant APT41",
          "url": "https://www.mandiant.com/resources/apt41-us-state-governments"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0059d5e7-7a7f-4a13-8730-00383bad2e98",
      "subject": "ATTACK:enterprise:S1242",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0059d5e7-7a7f-4a13-8730-00383bad2e98",
      "modified": "2026-04-29T14:23:05.903Z",
      "references": [
        {
          "source_name": "HC3 Qilin Threat Profile JUN 2024",
          "url": "https://www.aha.org/system/files/media/file/2024/06/tlp-clear-hc3-threat-profile-qilin-aka-agenda-ransomware-6-18-2024.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--00f44cd5-9afc-472f-9743-251d243798a0",
      "subject": "ATTACK:enterprise:S0678",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--00f44cd5-9afc-472f-9743-251d243798a0",
      "modified": "2026-04-29T14:23:05.904Z",
      "references": [
        {
          "source_name": "McAfee Lazarus Nov 2020",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0112eb25-7f6c-49cd-95c8-bf0d49f7c380",
      "subject": "ATTACK:enterprise:S0352",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0112eb25-7f6c-49cd-95c8-bf0d49f7c380",
      "modified": "2026-04-29T14:23:05.904Z",
      "references": [
        {
          "source_name": "TrendMicro MacOS April 2018",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--01323439-5287-43cd-b7d9-750e606db602",
      "subject": "ATTACK:enterprise:G0100",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--01323439-5287-43cd-b7d9-750e606db602",
      "modified": "2026-07-31T18:48:24.998Z",
      "references": [
        {
          "source_name": "Kaspersky Cloud Atlas December 2014",
          "url": "https://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--016dc21c-ade9-43cc-9d88-a0c4c0891ccc",
      "subject": "ATTACK:enterprise:S0136",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--016dc21c-ade9-43cc-9d88-a0c4c0891ccc",
      "modified": "2026-04-29T14:23:05.905Z",
      "references": [
        {
          "source_name": "ESET Sednit USBStealer 2014",
          "url": "http://www.welivesecurity.com/2014/11/11/sednit-espionage-group-attacking-air-gapped-networks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--021c3289-43bb-4787-9d7e-6ad17b3ce84f",
      "subject": "ATTACK:enterprise:S0082",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--021c3289-43bb-4787-9d7e-6ad17b3ce84f",
      "modified": "2026-04-29T14:23:05.906Z",
      "references": [
        {
          "source_name": "Emissary Trojan Feb 2016",
          "url": "http://researchcenter.paloaltonetworks.com/2016/02/emissary-trojan-changelog-did-operation-lotus-blossom-cause-it-to-evolve/"
        },
        {
          "source_name": "Lotus Blossom Dec 2015",
          "url": "http://researchcenter.paloaltonetworks.com/2015/12/attack-on-french-diplomat-linked-to-operation-lotus-blossom/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--023e615d-0988-4387-a182-ffc15f68581b",
      "subject": "ATTACK:enterprise:S1153",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--023e615d-0988-4387-a182-ffc15f68581b",
      "modified": "2026-04-29T14:23:05.906Z",
      "references": [
        {
          "source_name": "Kandji Cuckoo April 2024",
          "url": "https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware"
        },
        {
          "source_name": "SentinelOne Cuckoo Stealer May 2024",
          "url": "https://www.sentinelone.com/blog/macos-cuckoo-stealer-ensuring-detection-and-defense-as-new-samples-rapidly-emerge/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--02eba953-12a6-434a-bc67-2337864cf560",
      "subject": "ATTACK:enterprise:S0487",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--02eba953-12a6-434a-bc67-2337864cf560",
      "modified": "2026-04-29T14:23:05.907Z",
      "references": [
        {
          "source_name": "ESET ForSSHe December 2018",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--03cd94c9-73aa-4eed-b724-629d180e3002",
      "subject": "ATTACK:enterprise:S0565",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--03cd94c9-73aa-4eed-b724-629d180e3002",
      "modified": "2026-04-29T14:23:05.908Z",
      "references": [
        {
          "source_name": "Microsoft Deep Dive Solorigate January 2021",
          "url": "https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"
        },
        {
          "source_name": "Symantec RAINDROP January 2021",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--081406d8-0486-4bfe-8d99-cd505f5cceb6",
      "subject": "ATTACK:enterprise:S0433",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--081406d8-0486-4bfe-8d99-cd505f5cceb6",
      "modified": "2026-04-29T14:23:05.914Z",
      "references": [
        {
          "source_name": "Carbon Black HotCroissant April 2020",
          "url": "https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0c533013-a72e-4aef-bd19-8ea9ea415189",
      "subject": "ATTACK:enterprise:G0070",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0c533013-a72e-4aef-bd19-8ea9ea415189",
      "modified": "2026-09-02T18:51:44.081Z",
      "references": [
        {
          "source_name": "Lookout Dark Caracal Jan 2018",
          "url": "https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0c81e49d-53be-4fba-9a07-ec2fe5501267",
      "subject": "ATTACK:enterprise:G0066",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0c81e49d-53be-4fba-9a07-ec2fe5501267",
      "modified": "2026-07-31T18:47:35.744Z",
      "references": [
        {
          "source_name": "Symantec Elderwood Sept 2012",
          "url": "https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0fee6145-185d-417f-a431-201a5b3e3259",
      "subject": "ATTACK:enterprise:T1027.013",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0fee6145-185d-417f-a431-201a5b3e3259",
      "modified": "2026-04-29T14:23:05.925Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--10d22e64-01ff-4302-a615-ee23970d86ae",
      "subject": "ATTACK:enterprise:S1019",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--10d22e64-01ff-4302-a615-ee23970d86ae",
      "modified": "2026-04-29T14:23:05.927Z",
      "references": [
        {
          "source_name": "Accenture Lyceum Targets November 2021",
          "url": "https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns"
        },
        {
          "source_name": "ClearSky Siamesekitten August 2021",
          "url": "https://www.clearskysec.com/siamesekitten/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--117ca63e-7fdb-41e6-9f4b-e19a0e889061",
      "subject": "ATTACK:enterprise:S0386",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--117ca63e-7fdb-41e6-9f4b-e19a0e889061",
      "modified": "2026-04-29T14:23:05.928Z",
      "references": [
        {
          "source_name": "Bromium Ursnif Mar 2017",
          "url": "https://www.bromium.com/how-ursnif-evades-detection/"
        },
        {
          "source_name": "ProofPoint Ursnif Aug 2016",
          "url": "https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--11d7c83e-7b34-447a-9775-fb9c373bdfcd",
      "subject": "ATTACK:enterprise:S9037",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--11d7c83e-7b34-447a-9775-fb9c373bdfcd",
      "modified": "2026-04-29T14:23:05.928Z",
      "references": [
        {
          "source_name": "CloudSEK_RustyWater_Jan2026",
          "url": "https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--12ac0bbc-25b8-4f37-a9b8-d9f41538ae84",
      "subject": "ATTACK:enterprise:S9067",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--12ac0bbc-25b8-4f37-a9b8-d9f41538ae84",
      "modified": "2026-10-01T21:50:42.355Z",
      "references": [
        {
          "source_name": "Mandiant_UNC1549_Nov2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--12f96649-9314-4d5f-854b-6316737df1ed",
      "subject": "ATTACK:enterprise:S1150",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--12f96649-9314-4d5f-854b-6316737df1ed",
      "modified": "2026-04-29T14:23:05.930Z",
      "references": [
        {
          "source_name": "CISA Iran Albanian Attacks September 2022",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a"
        },
        {
          "source_name": "Mandiant ROADSWEEP August 2022",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"
        },
        {
          "source_name": "Microsoft Albanian Government Attacks September 2022",
          "url": "https://www.microsoft.com/en-us/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--12fbb06a-3bf9-4f7c-8385-8240859c7932",
      "subject": "ATTACK:enterprise:S1233",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--12fbb06a-3bf9-4f7c-8385-8240859c7932",
      "modified": "2026-04-29T14:23:05.930Z",
      "references": [
        {
          "source_name": "Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1330d8a5-c8be-4579-8a91-4cfda860ea0a",
      "subject": "ATTACK:enterprise:G0012",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1330d8a5-c8be-4579-8a91-4cfda860ea0a",
      "modified": "2026-07-31T18:48:11.820Z",
      "references": [
        {
          "source_name": "Securelist Darkhotel Aug 2015",
          "url": "https://securelist.com/darkhotels-attacks-in-2015/71713/"
        },
        {
          "source_name": "Microsoft DUBNIUM July 2016",
          "url": "https://www.microsoft.com/security/blog/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--153487c1-62aa-4465-8f8a-61674796df69",
      "subject": "ATTACK:enterprise:C0045",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--153487c1-62aa-4465-8f8a-61674796df69",
      "modified": "2026-07-31T18:47:23.394Z",
      "references": [
        {
          "source_name": "Oligo ShadowRay Campaign MAR 2024",
          "url": "https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--17087e76-4d84-443e-8fb1-0ec6498681db",
      "subject": "ATTACK:enterprise:G0134",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--17087e76-4d84-443e-8fb1-0ec6498681db",
      "modified": "2026-07-31T18:48:24.032Z",
      "references": [
        {
          "source_name": "Proofpoint Operation Transparent Tribe March 2016",
          "url": "https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--17823071-2338-4707-9d96-c20b293c9896",
      "subject": "ATTACK:enterprise:S1212",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--17823071-2338-4707-9d96-c20b293c9896",
      "modified": "2026-04-29T14:23:05.936Z",
      "references": [
        {
          "source_name": "Group-IB RansomHub FEB 2025",
          "url": "https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--18b6546b-90a1-4f70-8faf-505810bba9a6",
      "subject": "ATTACK:enterprise:S1100",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--18b6546b-90a1-4f70-8faf-505810bba9a6",
      "modified": "2026-04-29T14:23:05.938Z",
      "references": [
        {
          "source_name": "Kaspersky ToddyCat June 2022",
          "url": "https://securelist.com/toddycat/106799/"
        },
        {
          "source_name": "Kaspersky ToddyCat Check Logs October 2023",
          "url": "https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1b143de7-af2d-4991-9e2e-aa85a8d7d330",
      "subject": "ATTACK:enterprise:G0007",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1b143de7-af2d-4991-9e2e-aa85a8d7d330",
      "modified": "2026-07-31T20:48:44.447Z",
      "references": [
        {
          "source_name": "Accenture SNAKEMACKEREL Nov 2018",
          "url": "https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"
        },
        {
          "source_name": "Bitdefender APT28 Dec 2015",
          "url": "https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf"
        },
        {
          "source_name": "Unit 42 Sofacy Feb 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/"
        },
        {
          "source_name": "Palo Alto Sofacy 06-2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"
        },
        {
          "source_name": "Talos Seduploader Oct 2017",
          "url": "https://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--206ef2a2-192c-4739-a1bf-b5616dcacfed",
      "subject": "ATTACK:enterprise:S0391",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--206ef2a2-192c-4739-a1bf-b5616dcacfed",
      "modified": "2026-04-29T14:23:05.949Z",
      "references": [
        {
          "source_name": "FireEye HAWKBALL Jun 2019",
          "url": "https://www.fireeye.com/blog/threat-research/2019/06/government-in-central-asia-targeted-with-hawkball-backdoor.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2329d963-f01b-46bd-8868-99cf436a508a",
      "subject": "ATTACK:enterprise:S0468",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2329d963-f01b-46bd-8868-99cf436a508a",
      "modified": "2026-04-29T14:23:05.953Z",
      "references": [
        {
          "source_name": "Trend Micro Skidmap",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--23b77b77-e100-4ac2-93b9-b900a04844cd",
      "subject": "ATTACK:enterprise:S0373",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--23b77b77-e100-4ac2-93b9-b900a04844cd",
      "modified": "2026-04-29T14:23:05.954Z",
      "references": [
        {
          "source_name": "Securelist Brazilian Banking Malware July 2020",
          "url": "https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--23bd8e78-b20d-41bd-acfb-5ed356b327b2",
      "subject": "ATTACK:enterprise:G0026",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--23bd8e78-b20d-41bd-acfb-5ed356b327b2",
      "modified": "2026-07-31T18:47:50.606Z",
      "references": [
        {
          "source_name": "PaloAlto DNS Requests May 2016",
          "url": "https://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--249e7812-394b-44b0-adb7-d922139f7c38",
      "subject": "ATTACK:enterprise:S1051",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--249e7812-394b-44b0-adb7-d922139f7c38",
      "modified": "2026-04-29T14:23:05.955Z",
      "references": [
        {
          "source_name": "Mandiant APT41",
          "url": "https://www.mandiant.com/resources/apt41-us-state-governments"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--266a5edd-1425-4ab1-88bf-a0d7897699eb",
      "subject": "ATTACK:enterprise:S0074",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--266a5edd-1425-4ab1-88bf-a0d7897699eb",
      "modified": "2026-04-29T14:23:05.957Z",
      "references": [
        {
          "source_name": "Dell Sakula",
          "url": "http://www.secureworks.com/cyber-threat-intelligence/threats/sakula-malware-family/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2729dc4f-b327-4a13-a07c-39e8b1b39288",
      "subject": "ATTACK:enterprise:S0672",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2729dc4f-b327-4a13-a07c-39e8b1b39288",
      "modified": "2026-04-29T14:23:05.958Z",
      "references": [
        {
          "source_name": "Novetta-Axiom",
          "url": "https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--284d622d-8b28-4569-97a7-936edced1b18",
      "subject": "ATTACK:enterprise:S0170",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--284d622d-8b28-4569-97a7-936edced1b18",
      "modified": "2026-04-29T14:23:05.960Z",
      "references": [
        {
          "source_name": "Palo Alto OilRig May 2016",
          "url": "http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--28e637e9-480a-443b-82d7-13b7e2968733",
      "subject": "ATTACK:enterprise:S0370",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--28e637e9-480a-443b-82d7-13b7e2968733",
      "modified": "2026-04-29T14:23:05.960Z",
      "references": [
        {
          "source_name": "Sophos SamSam Apr 2018",
          "url": "https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-ransomware-chooses-Its-targets-carefully-wpna.pdf"
        },
        {
          "source_name": "Talos SamSam Jan 2018",
          "url": "https://blog.talosintelligence.com/2018/01/samsam-evolution-continues-netting-over.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--290a1ceb-68e1-42ae-be81-f474038aaa05",
      "subject": "ATTACK:enterprise:S0113",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--290a1ceb-68e1-42ae-be81-f474038aaa05",
      "modified": "2026-04-29T14:23:05.961Z",
      "references": [
        {
          "source_name": "ESET Operation Groundbait",
          "url": "http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--297b069f-7d1b-4335-9363-c73bd823c322",
      "subject": "ATTACK:enterprise:S0228",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--297b069f-7d1b-4335-9363-c73bd823c322",
      "modified": "2026-04-29T14:23:05.961Z",
      "references": [
        {
          "source_name": "fsecure NanHaiShu July 2016",
          "url": "https://www.f-secure.com/documents/996508/1030745/nanhaishu_whitepaper.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2a82c4cf-5c04-41b9-bfa4-c5e00d288eed",
      "subject": "ATTACK:enterprise:S1059",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2a82c4cf-5c04-41b9-bfa4-c5e00d288eed",
      "modified": "2026-04-29T14:23:05.962Z",
      "references": [
        {
          "source_name": "SentinelLabs Metador Technical Appendix Sept 2022",
          "url": "https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2b3a7b95-f253-4b43-b3b4-a158357f3820",
      "subject": "ATTACK:enterprise:S1244",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2b3a7b95-f253-4b43-b3b4-a158357f3820",
      "modified": "2026-04-29T14:23:05.963Z",
      "references": [
        {
          "source_name": "Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024",
          "url": "https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"
        },
        {
          "source_name": "Security Scorecard Medusa Ransomware January 2024",
          "url": "https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2c7d090e-09a1-4a45-baf4-b13790b483f6",
      "subject": "ATTACK:enterprise:G0065",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2c7d090e-09a1-4a45-baf4-b13790b483f6",
      "modified": "2026-07-31T20:48:38.078Z",
      "references": [
        {
          "source_name": "Proofpoint Leviathan Oct 2017",
          "url": "https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2e0eb5e4-37a3-435d-bdac-01f72b8cec4c",
      "subject": "ATTACK:enterprise:S0534",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2e0eb5e4-37a3-435d-bdac-01f72b8cec4c",
      "modified": "2026-04-29T14:23:05.967Z",
      "references": [
        {
          "source_name": "Cybereason Bazar July 2020",
          "url": "https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"
        },
        {
          "source_name": "NCC Group Team9 June 2020",
          "url": "https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"
        },
        {
          "source_name": "CrowdStrike Wizard Spider October 2020",
          "url": "https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2f17ddd3-40e5-4784-9a5b-eecbfbdd1c15",
      "subject": "ATTACK:enterprise:S1202",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2f17ddd3-40e5-4784-9a5b-eecbfbdd1c15",
      "modified": "2026-04-29T14:23:05.969Z",
      "references": [
        {
          "source_name": "Joint Cybersecurity Advisory LockBit 3.0 MAR 2023",
          "url": "https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"
        },
        {
          "source_name": "Sentinel Labs LockBit 3.0 JUL 2022",
          "url": "https://www.sentinelone.com/labs/lockbit-3-0-update-unpicking-the-ransomwares-latest-anti-analysis-and-evasion-techniques"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2f96597c-70d9-41ba-b019-fb7510d3d732",
      "subject": "ATTACK:enterprise:S0451",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2f96597c-70d9-41ba-b019-fb7510d3d732",
      "modified": "2026-04-29T14:23:05.972Z",
      "references": [
        {
          "source_name": "ESET LoudMiner June 2019",
          "url": "https://www.welivesecurity.com/2019/06/20/loudminer-mining-cracked-vst-software/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--30569541-2ced-428f-856b-06711471102c",
      "subject": "ATTACK:enterprise:S9021",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--30569541-2ced-428f-856b-06711471102c",
      "modified": "2026-04-29T14:23:05.977Z",
      "references": [
        {
          "source_name": "Kaspersky LODEINFO OCT 2022",
          "url": "https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--32e947a4-cbd3-45a8-ae74-7e51edf84d81",
      "subject": "ATTACK:enterprise:G0121",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--32e947a4-cbd3-45a8-ae74-7e51edf84d81",
      "modified": "2026-07-31T18:47:51.812Z",
      "references": [
        {
          "source_name": "Cyble Sidewinder September 2020",
          "url": "https://cybleinc.com/2020/09/26/sidewinder-apt-targets-with-futuristic-tactics-and-techniques/"
        },
        {
          "source_name": "ATT Sidewinder January 2021",
          "url": "https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"
        },
        {
          "source_name": "Rewterz Sidewinder APT April 2020",
          "url": "https://www.rewterz.com/threats/sidewinder-apt-group-campaign-analysis"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--35de5c62-00aa-4f6d-a0d8-399cda3bed36",
      "subject": "ATTACK:enterprise:S1220",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--35de5c62-00aa-4f6d-a0d8-399cda3bed36",
      "modified": "2026-04-29T14:23:05.993Z",
      "references": [
        {
          "source_name": "Google Cloud Mandiant UNC3886 2024",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--371958b3-0a01-48a4-b035-3a9d44b17388",
      "subject": "ATTACK:enterprise:S0657",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--371958b3-0a01-48a4-b035-3a9d44b17388",
      "modified": "2026-04-29T14:23:05.995Z",
      "references": [
        {
          "source_name": "Volexity InkySquid BLUELIGHT August 2021",
          "url": "https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--37451dee-6837-46c5-a9e5-ff64f26f66d2",
      "subject": "ATTACK:enterprise:S0501",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--37451dee-6837-46c5-a9e5-ff64f26f66d2",
      "modified": "2026-04-29T14:23:05.995Z",
      "references": [
        {
          "source_name": "ESET PipeMon May 2020",
          "url": "https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--374d1cee-7c9c-4b3b-8e75-8a5c4caf9d47",
      "subject": "ATTACK:enterprise:S1065",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--374d1cee-7c9c-4b3b-8e75-8a5c4caf9d47",
      "modified": "2026-04-29T14:23:05.995Z",
      "references": [
        {
          "source_name": "MalwareBytes WoodyRAT Aug 2022",
          "url": "https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--388b7632-476a-4194-be77-451ba13bcb10",
      "subject": "ATTACK:enterprise:S1033",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--388b7632-476a-4194-be77-451ba13bcb10",
      "modified": "2026-04-29T14:23:05.997Z",
      "references": [
        {
          "source_name": "Checkpoint MosesStaff Nov 2021",
          "url": "https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--38cf696a-f98d-4b32-a9f1-0183bd78b6d2",
      "subject": "ATTACK:enterprise:G0087",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--38cf696a-f98d-4b32-a9f1-0183bd78b6d2",
      "modified": "2026-07-31T18:47:53.340Z",
      "references": [
        {
          "source_name": "FBI FLASH APT39 September 2020",
          "url": "https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--393bc0b3-4c14-4e58-93d5-fc3daf68e90c",
      "subject": "ATTACK:enterprise:S9023",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--393bc0b3-4c14-4e58-93d5-fc3daf68e90c",
      "modified": "2026-04-29T14:23:05.998Z",
      "references": [
        {
          "source_name": "ESET HiddenFace 2024",
          "url": "https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_2_8_Breitenbacher_en.pdf"
        },
        {
          "source_name": "JPCERT MirrorFace JUL 2024",
          "url": "https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--394d53b3-da1c-44b4-8abf-e1092f34c8be",
      "subject": "ATTACK:enterprise:S0237",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--394d53b3-da1c-44b4-8abf-e1092f34c8be",
      "modified": "2026-04-29T14:23:05.998Z",
      "references": [
        {
          "source_name": "Talos GravityRAT",
          "url": "https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3a299dae-7ee2-4e5e-8be6-eb014f58205b",
      "subject": "ATTACK:enterprise:S0455",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3a299dae-7ee2-4e5e-8be6-eb014f58205b",
      "modified": "2026-04-29T14:23:06.000Z",
      "references": [
        {
          "source_name": "Medium Metamorfo Apr 2020",
          "url": "https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767"
        },
        {
          "source_name": "ESET Casbaneiro Oct 2019",
          "url": "https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3afd226c-934f-44fd-8194-9a6dee5cba59",
      "subject": "ATTACK:enterprise:G0032",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3afd226c-934f-44fd-8194-9a6dee5cba59",
      "modified": "2026-07-31T20:48:46.603Z",
      "references": [
        {
          "source_name": "TrendMicro macOS Dacls May 2020",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/"
        },
        {
          "source_name": "Novetta Blockbuster Loaders",
          "url": "https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"
        },
        {
          "source_name": "Novetta Blockbuster RATs",
          "url": "https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"
        },
        {
          "source_name": "Novetta Blockbuster",
          "url": "https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"
        },
        {
          "source_name": "Qualys LolZarus",
          "url": "https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"
        },
        {
          "source_name": "Lazarus APT January 2022",
          "url": "https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"
        },
        {
          "source_name": "McAfee Lazarus Resurfaces Feb 2018",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3b4e29f6-e040-431e-a6e9-a6a3f4e43ce5",
      "subject": "ATTACK:enterprise:S1207",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3b4e29f6-e040-431e-a6e9-a6a3f4e43ce5",
      "modified": "2026-04-29T14:23:06.003Z",
      "references": [
        {
          "source_name": "ANY.RUN XLoader 2023",
          "url": "https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/"
        },
        {
          "source_name": "Zscaler XLoader 2025",
          "url": "https://www.zscaler.com/blogs/security-research/technical-analysis-xloader-versions-6-and-7-part-1"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3c91f0ec-8944-43d8-9b55-153a4c031c44",
      "subject": "ATTACK:enterprise:G1031",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3c91f0ec-8944-43d8-9b55-153a4c031c44",
      "modified": "2026-07-31T18:48:00.344Z",
      "references": [
        {
          "source_name": "Palo Alto Unit 42 OutSteel SaintBot February 2022 ",
          "url": "https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3f29b80a-0444-4664-8faa-58a39de9264e",
      "subject": "ATTACK:enterprise:G0064",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3f29b80a-0444-4664-8faa-58a39de9264e",
      "modified": "2026-07-31T20:48:53.066Z",
      "references": [
        {
          "source_name": "FireEye APT33 Guardrail",
          "url": "https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--40d3f067-ee42-4d2f-b43a-b3ac76a55b04",
      "subject": "ATTACK:enterprise:S1210",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--40d3f067-ee42-4d2f-b43a-b3ac76a55b04",
      "modified": "2026-04-29T14:23:06.013Z",
      "references": [
        {
          "source_name": "Symantec Bilbug 2022",
          "url": "https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--41a691f8-4d5c-4678-9305-519dbb70ba46",
      "subject": "ATTACK:enterprise:S1183",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--41a691f8-4d5c-4678-9305-519dbb70ba46",
      "modified": "2026-04-29T14:23:06.015Z",
      "references": [
        {
          "source_name": "DCSO StrelaStealer 2022",
          "url": "https://medium.com/@DCSO_CyTec/shortandmalicious-strelastealer-aims-for-mail-credentials-a4c3e78c8abc"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--41c20ce1-3b9d-4293-a203-a4196d307c59",
      "subject": "ATTACK:enterprise:C0002",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--41c20ce1-3b9d-4293-a203-a4196d307c59",
      "modified": "2026-07-31T18:47:30.845Z",
      "references": [
        {
          "source_name": "McAfee Night Dragon",
          "url": "https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4224d1f3-e634-4aa1-a6a5-bad5c1e81604",
      "subject": "ATTACK:enterprise:S0395",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4224d1f3-e634-4aa1-a6a5-bad5c1e81604",
      "modified": "2026-04-29T14:23:06.015Z",
      "references": [
        {
          "source_name": "ESET LightNeuron May 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4272f467-c1b9-412e-9092-6340f4bdf847",
      "subject": "ATTACK:enterprise:S1014",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4272f467-c1b9-412e-9092-6340f4bdf847",
      "modified": "2026-04-29T14:23:06.016Z",
      "references": [
        {
          "source_name": "SecureWorks August 2019",
          "url": "https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--43908728-be5a-4bdf-a13e-8d373c1fc4fd",
      "subject": "ATTACK:enterprise:S0267",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--43908728-be5a-4bdf-a13e-8d373c1fc4fd",
      "modified": "2026-04-29T14:23:06.017Z",
      "references": [
        {
          "source_name": "ESET GreyEnergy Oct 2018",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf"
        },
        {
          "source_name": "FireEye FELIXROOT July 2018",
          "url": "https://web.archive.org/web/20200607025424/https://www.fireeye.com/blog/threat-research/2018/07/microsoft-office-vulnerabilities-used-to-distribute-felixroot-backdoor.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--43edea0b-efb8-41ab-bdda-f5aa62de439f",
      "subject": "ATTACK:enterprise:S0125",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--43edea0b-efb8-41ab-bdda-f5aa62de439f",
      "modified": "2026-04-29T14:23:06.018Z",
      "references": [
        {
          "source_name": "Kaspersky ProjectSauron Technical Analysis",
          "url": "https://securelist.com/files/2016/07/The-ProjectSauron-APT_Technical_Analysis_KL.pdf"
        },
        {
          "source_name": "Symantec Remsec IOCs",
          "url": "http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/Symantec_Remsec_IOCs.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--44b10433-b9b4-46d1-825b-6fe4183dc9c0",
      "subject": "ATTACK:enterprise:S0695",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--44b10433-b9b4-46d1-825b-6fe4183dc9c0",
      "modified": "2026-04-29T14:23:06.019Z",
      "references": [
        {
          "source_name": "Donut Github",
          "url": "https://github.com/TheWover/donut"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--44e55496-b39d-45b7-96b9-1840d2492a14",
      "subject": "ATTACK:enterprise:S1124",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--44e55496-b39d-45b7-96b9-1840d2492a14",
      "modified": "2026-04-29T14:23:06.019Z",
      "references": [
        {
          "source_name": "SentinelOne SocGholish Infrastructure November 2022",
          "url": "https://www.sentinelone.com/labs/socgholish-diversifies-and-expands-its-malware-staging-infrastructure-to-counter-defenders/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--44f1b846-9e75-4f7b-8b6c-a0e68ccbb3ac",
      "subject": "ATTACK:enterprise:G0094",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--44f1b846-9e75-4f7b-8b6c-a0e68ccbb3ac",
      "modified": "2026-07-31T20:48:24.746Z",
      "references": [
        {
          "source_name": "Gen Digital Kimsuky HTTPTroy October 2025",
          "url": "https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"
        },
        {
          "source_name": "Aryaka Kimsuky July 2025",
          "url": "https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--45192057-c5ef-4f18-81c0-ca9b6546cc22",
      "subject": "ATTACK:enterprise:S9025",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--45192057-c5ef-4f18-81c0-ca9b6546cc22",
      "modified": "2026-04-29T14:23:06.020Z",
      "references": [
        {
          "source_name": "Trend Micro Earth Kasha NOV 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--45258d6a-3717-4542-ac17-e7343fae0304",
      "subject": "ATTACK:enterprise:S1159",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--45258d6a-3717-4542-ac17-e7343fae0304",
      "modified": "2026-04-29T14:23:06.020Z",
      "references": [
        {
          "source_name": "Google Cloud APT41 2024",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--45803290-efab-46d3-873d-0c4f19f5e406",
      "subject": "ATTACK:enterprise:C0006",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--45803290-efab-46d3-873d-0c4f19f5e406",
      "modified": "2026-07-31T18:47:20.645Z",
      "references": [
        {
          "source_name": "McAfee Honeybee",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--462f46ec-2a7a-419a-8a62-06543e79d75f",
      "subject": "ATTACK:enterprise:S1221",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--462f46ec-2a7a-419a-8a62-06543e79d75f",
      "modified": "2026-04-29T14:23:06.021Z",
      "references": [
        {
          "source_name": "Google Cloud Mandiant UNC3886 2024",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4642135b-65d9-4b61-b25c-648c674c02dc",
      "subject": "ATTACK:enterprise:S0466",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4642135b-65d9-4b61-b25c-648c674c02dc",
      "modified": "2026-04-29T14:23:06.021Z",
      "references": [
        {
          "source_name": "objective-see windtail2 jan 2019",
          "url": "https://objective-see.com/blog/blog_0x3D.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4786019e-e2d4-4d31-94fa-b9ec19e65fa4",
      "subject": "ATTACK:enterprise:S0531",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4786019e-e2d4-4d31-94fa-b9ec19e65fa4",
      "modified": "2026-04-29T14:23:06.023Z",
      "references": [
        {
          "source_name": "ESET Grandoreiro April 2020",
          "url": "https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"
        },
        {
          "source_name": "Securelist Brazilian Banking Malware July 2020",
          "url": "https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--47fdcab0-5aca-4685-a2d8-8e743e3c4494",
      "subject": "ATTACK:enterprise:S1015",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--47fdcab0-5aca-4685-a2d8-8e743e3c4494",
      "modified": "2026-04-29T14:23:06.023Z",
      "references": [
        {
          "source_name": "ClearSky Siamesekitten August 2021",
          "url": "https://www.clearskysec.com/siamesekitten/"
        },
        {
          "source_name": "Kaspersky Lyceum October 2021",
          "url": "https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--48e36609-a492-43a6-b0ab-c27ce106b0e6",
      "subject": "ATTACK:enterprise:S0520",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--48e36609-a492-43a6-b0ab-c27ce106b0e6",
      "modified": "2026-04-29T14:23:06.024Z",
      "references": [
        {
          "source_name": "US-CERT BLINDINGCAN Aug 2020",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--49133c43-724f-41f8-a1de-2af251941311",
      "subject": "ATTACK:enterprise:C0063",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--49133c43-724f-41f8-a1de-2af251941311",
      "modified": "2026-07-31T20:48:19.603Z",
      "references": [
        {
          "source_name": "CERT Polska",
          "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--49df789a-5d6c-4820-af9f-7c4484531680",
      "subject": "ATTACK:enterprise:S0356",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--49df789a-5d6c-4820-af9f-7c4484531680",
      "modified": "2026-04-29T14:23:06.026Z",
      "references": [
        {
          "source_name": "Malwarebytes Konni Aug 2021",
          "url": "https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4afcb9c9-e490-446b-97b1-1c151974242f",
      "subject": "ATTACK:enterprise:S0131",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4afcb9c9-e490-446b-97b1-1c151974242f",
      "modified": "2026-04-29T14:23:06.028Z",
      "references": [
        {
          "source_name": "Forcepoint Monsoon",
          "url": "https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4bb228b7-a456-426a-9be0-68a8a8a1b2d0",
      "subject": "ATTACK:enterprise:G1002",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4bb228b7-a456-426a-9be0-68a8a8a1b2d0",
      "modified": "2026-07-31T20:48:39.536Z",
      "references": [
        {
          "source_name": "Forcepoint BITTER Pakistan Oct 2016",
          "url": "https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4d10ce98-d1c1-4e26-84c3-a309e7c30313",
      "subject": "ATTACK:enterprise:S0689",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4d10ce98-d1c1-4e26-84c3-a309e7c30313",
      "modified": "2026-04-29T14:23:06.030Z",
      "references": [
        {
          "source_name": "Cisco Ukraine Wipers January 2022",
          "url": "https://blog.talosintelligence.com/2022/01/ukraine-campaign-delivers-defacement.html"
        },
        {
          "source_name": "RecordedFuture WhisperGate Jan 2022",
          "url": "https://www.recordedfuture.com/research/whispergate-malware-corrupts-computers-ukraine"
        },
        {
          "source_name": "Medium S2W WhisperGate January 2022",
          "url": "https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4e51d058-8955-4d08-afb1-a7c3ad0cd433",
      "subject": "ATTACK:enterprise:S9062",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4e51d058-8955-4d08-afb1-a7c3ad0cd433",
      "modified": "2026-10-01T13:54:57.874Z",
      "references": [
        {
          "source_name": "CheckPoint_NimbusManticoreEurope_Sept2025",
          "url": "https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4ee9fd95-d2c8-4d34-87d2-bf1f5ef54061",
      "subject": "ATTACK:enterprise:S1013",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4ee9fd95-d2c8-4d34-87d2-bf1f5ef54061",
      "modified": "2026-04-29T14:23:06.033Z",
      "references": [
        {
          "source_name": "Cisco Talos Bitter Bangladesh May 2022",
          "url": "https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4f061157-0a1d-4c2d-9bd3-e5b0b932a39f",
      "subject": "ATTACK:enterprise:S1050",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4f061157-0a1d-4c2d-9bd3-e5b0b932a39f",
      "modified": "2026-04-29T14:23:06.033Z",
      "references": [
        {
          "source_name": "Bitdefender FunnyDream Campaign November 2020",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4f0d1910-3308-434d-b2df-6400e3e666de",
      "subject": "ATTACK:enterprise:S1111",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4f0d1910-3308-434d-b2df-6400e3e666de",
      "modified": "2026-04-29T14:23:06.033Z",
      "references": [
        {
          "source_name": "Ensilo Darkgate 2018",
          "url": "https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"
        },
        {
          "source_name": "Trellix Darkgate 2023",
          "url": "https://www.trellix.com/blogs/research/the-continued-evolution-of-the-darkgate-malware-as-a-service/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5077f774-95a4-459e-b88c-cb3a4dd5c8c6",
      "subject": "ATTACK:enterprise:S0172",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5077f774-95a4-459e-b88c-cb3a4dd5c8c6",
      "modified": "2026-04-29T14:23:06.035Z",
      "references": [
        {
          "source_name": "Palo Alto Reaver Nov 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--537fb955-d073-4ec1-a524-a0109ed18e85",
      "subject": "ATTACK:enterprise:S0415",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--537fb955-d073-4ec1-a524-a0109ed18e85",
      "modified": "2026-04-29T14:23:06.039Z",
      "references": [
        {
          "source_name": "FireEye FIN7 Oct 2019",
          "url": "https://www.fireeye.com/blog/threat-research/2019/10/mahalo-fin7-responding-to-new-tools-and-techniques.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--53d441a4-d6ba-46b2-aa56-91b3f232c67a",
      "subject": "ATTACK:enterprise:S0410",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--53d441a4-d6ba-46b2-aa56-91b3f232c67a",
      "modified": "2026-04-29T14:23:06.040Z",
      "references": [
        {
          "source_name": "Fysbis Dr Web Analysis",
          "url": "https://vms.drweb.com/virus/?i=4276269"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--53e89989-29a6-461f-854c-42eb96b221b3",
      "subject": "ATTACK:enterprise:G0092",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--53e89989-29a6-461f-854c-42eb96b221b3",
      "modified": "2026-07-31T18:48:05.473Z",
      "references": [
        {
          "source_name": "Proofpoint TA505 Sep 2017",
          "url": "https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--544b4f94-a1b6-49cd-adf8-c0b6499e8acd",
      "subject": "ATTACK:enterprise:S0603",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--544b4f94-a1b6-49cd-adf8-c0b6499e8acd",
      "modified": "2026-04-29T14:23:06.040Z",
      "references": [
        {
          "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
          "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--54784a8e-d827-4761-87ce-68ed55cc25f9",
      "subject": "ATTACK:enterprise:G0126",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--54784a8e-d827-4761-87ce-68ed55cc25f9",
      "modified": "2026-07-31T18:47:56.511Z",
      "references": [
        {
          "source_name": "Malwarebytes Higaisa 2020",
          "url": "https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"
        },
        {
          "source_name": "Zscaler Higaisa 2020",
          "url": "https://www.zscaler.com/blogs/security-research/return-higaisa-apt"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--54f9c8a5-0677-4be8-bd72-a6a096be00bd",
      "subject": "ATTACK:enterprise:S0570",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--54f9c8a5-0677-4be8-bd72-a6a096be00bd",
      "modified": "2026-04-29T14:23:06.041Z",
      "references": [
        {
          "source_name": "Crowdstrike Indrik November 2018",
          "url": "https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5550ef5e-a34c-4055-b7be-dd41d76ef7b1",
      "subject": "ATTACK:enterprise:S0236",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5550ef5e-a34c-4055-b7be-dd41d76ef7b1",
      "modified": "2026-04-29T14:23:06.042Z",
      "references": [
        {
          "source_name": "Symantec Security Center Trojan.Kwampirs",
          "url": "https://www.symantec.com/security-center/writeup/2016-081923-2700-99"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--555ae36b-6066-43e1-bea4-d891c1db5835",
      "subject": "ATTACK:enterprise:S0375",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--555ae36b-6066-43e1-bea4-d891c1db5835",
      "modified": "2026-04-29T14:23:06.042Z",
      "references": [
        {
          "source_name": "Securelist Remexi Jan 2019",
          "url": "https://securelist.com/chafer-used-remexi-malware/89538/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--568bd76b-1cf0-4f60-be6f-79c7e90d80a4",
      "subject": "ATTACK:enterprise:S9053",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--568bd76b-1cf0-4f60-be6f-79c7e90d80a4",
      "modified": "2026-09-24T22:26:46.713Z",
      "references": [
        {
          "source_name": "CheckPoint_NimbusManticoreEurope_Sept2025",
          "url": "https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--573e7f53-26e9-4eae-af0e-308d11192f57",
      "subject": "ATTACK:enterprise:S0263",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--573e7f53-26e9-4eae-af0e-308d11192f57",
      "modified": "2026-04-29T14:23:06.044Z",
      "references": [
        {
          "source_name": "US-CERT TYPEFRAME June 2018",
          "url": "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--58a1a546-8860-4bc7-bbce-21cccbb1bf03",
      "subject": "ATTACK:enterprise:S1169",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--58a1a546-8860-4bc7-bbce-21cccbb1bf03",
      "modified": "2026-04-29T14:23:06.046Z",
      "references": [
        {
          "source_name": "ESET OilRig Campaigns Sep 2023",
          "url": "https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--594a13ec-9187-4410-95a2-99684183200f",
      "subject": "ATTACK:enterprise:S0661",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--594a13ec-9187-4410-95a2-99684183200f",
      "modified": "2026-04-29T14:23:06.047Z",
      "references": [
        {
          "source_name": "MSTIC FoggyWeb September 2021",
          "url": "https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--59cccc5a-f6f9-4a2f-aa74-2b7235b1855c",
      "subject": "ATTACK:enterprise:G0073",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--59cccc5a-f6f9-4a2f-aa74-2b7235b1855c",
      "modified": "2026-07-31T18:48:31.036Z",
      "references": [
        {
          "source_name": "FireEye APT19",
          "url": "https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5b1b5089-7ef9-41d3-bb2a-25dff50a369c",
      "subject": "ATTACK:enterprise:S9050",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5b1b5089-7ef9-41d3-bb2a-25dff50a369c",
      "modified": "2026-09-25T17:02:19.186Z",
      "references": [
        {
          "source_name": "Cyfirma_Vidar_June2024",
          "url": "https://www.cyfirma.com/research/vidar-stealer-an-in-depth-analysis-of-an-information-stealing-malware/"
        },
        {
          "source_name": "Intrinsec_Vidar_April2026",
          "url": "https://www.intrinsec.com/wp-content/uploads/2026/04/TLP_CLEAR-20260424-New_Vidar.pdf"
        },
        {
          "source_name": "Unit42_Vidar_July2026",
          "url": "https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/"
        },
        {
          "source_name": "QuorumCyber_Vidar_March2023",
          "url": "https://www.quorumcyber.com/wp-content/uploads/2023/01/Malware-Analysis-Vidar.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5bddc9b3-eaa0-487b-9d62-25a2a5fbb11a",
      "subject": "ATTACK:enterprise:S0491",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5bddc9b3-eaa0-487b-9d62-25a2a5fbb11a",
      "modified": "2026-09-03T14:50:23.887Z",
      "references": [
        {
          "source_name": "Talos Promethium June 2020",
          "url": "https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"
        },
        {
          "source_name": "Bitdefender StrongPity June 2020",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5cbc2db4-fe47-4d6c-911a-d406cc06c519",
      "subject": "ATTACK:enterprise:S9010",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5cbc2db4-fe47-4d6c-911a-d406cc06c519",
      "modified": "2026-04-29T14:23:06.052Z",
      "references": [
        {
          "source_name": "Koi Glassworm New Tricks December 2025",
          "url": "https://www.koi.ai/blog/glassworm-goes-mac-fresh-infrastructure-new-tricks"
        },
        {
          "source_name": "Koi Glassworm InvisibleCode October 2025",
          "url": "https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace"
        },
        {
          "source_name": "Socket GlassWorm January 2026",
          "url": "https://socket.dev/blog/glassworm-loader-hits-open-vsx-via-suspected-developer-account-compromise"
        },
        {
          "source_name": "Koi GlassWorm Rust December 2025",
          "url": "https://www.koi.ai/blog/glassworm-goes-native-same-infrastructure-hardened-delivery"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5f3cac8e-55b8-4fb9-b0dd-e83939aa81ad",
      "subject": "ATTACK:enterprise:G0099",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5f3cac8e-55b8-4fb9-b0dd-e83939aa81ad",
      "modified": "2026-07-31T18:48:18.512Z",
      "references": [
        {
          "source_name": "Kaspersky BlindEagle AUG 2024",
          "url": "https://securelist.com/blindeagle-apt/113414/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5f8c7f7a-14e2-44d2-a2d8-d37b00134aa9",
      "subject": "ATTACK:enterprise:S1185",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5f8c7f7a-14e2-44d2-a2d8-d37b00134aa9",
      "modified": "2026-04-29T14:23:06.055Z",
      "references": [
        {
          "source_name": "Huntress LightSpy macOS 2024",
          "url": "https://www.huntress.com/blog/lightspy-malware-variant-targeting-macos"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5fa15bc3-e7ec-4617-bf30-b5258af8b2ec",
      "subject": "ATTACK:enterprise:G0117",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5fa15bc3-e7ec-4617-bf30-b5258af8b2ec",
      "modified": "2026-07-31T18:48:17.167Z",
      "references": [
        {
          "source_name": "CISA AA20-259A Iran-Based Actor September 2020",
          "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-259a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--600524be-d3c3-4f59-b257-0f3d868b9e1a",
      "subject": "ATTACK:enterprise:S1182",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--600524be-d3c3-4f59-b257-0f3d868b9e1a",
      "modified": "2026-04-29T14:23:06.056Z",
      "references": [
        {
          "source_name": "Cisco MagicRAT 2022",
          "url": "https://blog.talosintelligence.com/lazarus-magicrat/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--62890054-ce8d-479e-8331-eab58bed6ede",
      "subject": "ATTACK:enterprise:S9015",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--62890054-ce8d-479e-8331-eab58bed6ede",
      "modified": "2026-04-29T14:23:06.059Z",
      "references": [
        {
          "source_name": "CISA BRICKSTORM UNC5221 AR25-338A February 2026",
          "url": "https://www.cisa.gov/news-events/analysis-reports/ar25-338a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--62aae506-b42e-4e37-9ba4-1daa30255f77",
      "subject": "ATTACK:enterprise:S1154",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--62aae506-b42e-4e37-9ba4-1daa30255f77",
      "modified": "2026-04-29T14:23:06.059Z",
      "references": [
        {
          "source_name": "Lumen Versa 2024",
          "url": "https://blog.lumen.com/taking-the-crossroads-the-versa-director-zero-day-exploitation/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--62e35388-0f7d-4434-af87-6f6c09a1a12b",
      "subject": "ATTACK:enterprise:S0268",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--62e35388-0f7d-4434-af87-6f6c09a1a12b",
      "modified": "2026-04-29T14:23:06.059Z",
      "references": [
        {
          "source_name": "Unit 42 Bisonal July 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-bisonal-malware-used-attacks-russia-south-korea/"
        },
        {
          "source_name": "Talos Bisonal Mar 2020",
          "url": "https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--64b07cac-1aa5-4c86-ac63-7026ed1c855e",
      "subject": "ATTACK:enterprise:S1148",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--64b07cac-1aa5-4c86-ac63-7026ed1c855e",
      "modified": "2026-04-29T14:23:06.062Z",
      "references": [
        {
          "source_name": "Sekoia Raccoon2 2022",
          "url": "https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis/"
        },
        {
          "source_name": "Sekoia Raccoon1 2022",
          "url": "https://blog.sekoia.io/raccoon-stealer-v2-part-1-the-return-of-the-dead/"
        },
        {
          "source_name": "S2W Racoon 2022",
          "url": "https://medium.com/s2wblog/raccoon-stealer-is-back-with-a-new-version-5f436e04b20d"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--658fcd28-934d-4077-b93e-89af9512de5f",
      "subject": "ATTACK:enterprise:G0027",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--658fcd28-934d-4077-b93e-89af9512de5f",
      "modified": "2026-07-31T18:48:28.976Z",
      "references": [
        {
          "source_name": "Unit42 Emissary Panda May 2019",
          "url": "https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/"
        },
        {
          "source_name": "Securelist LuckyMouse June 2018",
          "url": "https://securelist.com/luckymouse-hits-national-data-center/86083/"
        },
        {
          "source_name": "Nccgroup Emissary Panda May 2018",
          "url": "https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--65c7d5b3-fc9c-4b34-a519-ac8b3eef159a",
      "subject": "ATTACK:enterprise:S9020",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--65c7d5b3-fc9c-4b34-a519-ac8b3eef159a",
      "modified": "2026-04-29T14:23:06.063Z",
      "references": [
        {
          "source_name": "Kaspersky LODEINFO OCT 2022",
          "url": "https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/"
        },
        {
          "source_name": "Kaspersky LODEINFO Part II OCT 2022",
          "url": "https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-ii/107745/"
        },
        {
          "source_name": "ITOCHU LODEINFO JAN 2024",
          "url": "https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6610332d-86a5-46dc-a0a1-31c2fe31f164",
      "subject": "ATTACK:enterprise:S0153",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6610332d-86a5-46dc-a0a1-31c2fe31f164",
      "modified": "2026-04-29T14:23:06.064Z",
      "references": [
        {
          "source_name": "PWC Cloud Hopper Technical Annex April 2017",
          "url": "https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--66ae8030-0539-4629-86ef-2b7de899365d",
      "subject": "ATTACK:enterprise:S9046",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--66ae8030-0539-4629-86ef-2b7de899365d",
      "modified": "2026-09-26T03:48:02.326Z",
      "references": [
        {
          "source_name": "Claroty-IOCONTROL",
          "url": "https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol"
        },
        {
          "source_name": "Dragos-2026-Year-In-Review",
          "url": "https://5943619.hs-sites.com/hubfs/312-Year-in-Review/2026/Dragos-2026-OT-Cybersecurity-Report-A-Year-in-Review.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--66bc82ff-8773-4ebb-97af-445fad41cd17",
      "subject": "ATTACK:enterprise:S9014",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--66bc82ff-8773-4ebb-97af-445fad41cd17",
      "modified": "2026-04-29T14:23:06.065Z",
      "references": [
        {
          "source_name": "Google UNC5221 Ivanti January 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--679cc96f-ac4f-46c9-8948-307b8f9f6110",
      "subject": "ATTACK:enterprise:S9031",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--679cc96f-ac4f-46c9-8948-307b8f9f6110",
      "modified": "2026-04-29T14:23:06.066Z",
      "references": [
        {
          "source_name": "Palo Alto Ashen Lepus DEC 2025",
          "url": "https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--67b69ca2-cf72-4a6c-b9e5-e0645922fb52",
      "subject": "ATTACK:enterprise:S1164",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--67b69ca2-cf72-4a6c-b9e5-e0645922fb52",
      "modified": "2026-04-29T14:23:06.066Z",
      "references": [
        {
          "source_name": "Palo Alto MidnightEclipse APR 2024",
          "url": "https://unit42.paloaltonetworks.com/cve-2024-3400/"
        },
        {
          "source_name": "Volexity UPSTYLE 2024",
          "url": "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--67dbfc12-982f-4d14-a3d7-efa45644ecf3",
      "subject": "ATTACK:enterprise:S0383",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--67dbfc12-982f-4d14-a3d7-efa45644ecf3",
      "modified": "2026-04-29T14:23:06.066Z",
      "references": [
        {
          "source_name": "Proofpoint TA505 Jan 2019",
          "url": "https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--68b067cc-813f-4205-9de7-a8d6e4c8dd20",
      "subject": "ATTACK:enterprise:S0284",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--68b067cc-813f-4205-9de7-a8d6e4c8dd20",
      "modified": "2026-04-29T14:23:06.067Z",
      "references": [
        {
          "source_name": "ESET EvilNum July 2020",
          "url": "https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--68bbad6c-1685-4275-bd36-b885a64caf6d",
      "subject": "ATTACK:enterprise:S0081",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--68bbad6c-1685-4275-bd36-b885a64caf6d",
      "modified": "2026-04-29T14:23:06.067Z",
      "references": [
        {
          "source_name": "Lotus Blossom Jun 2015",
          "url": "https://www.paloaltonetworks.com/resources/research/unit42-operation-lotus-blossom.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--699171c1-0d17-48d7-a741-0e4a0ed4ef62",
      "subject": "ATTACK:enterprise:S0473",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--699171c1-0d17-48d7-a741-0e4a0ed4ef62",
      "modified": "2026-04-29T14:23:06.069Z",
      "references": [
        {
          "source_name": "Trend Micro Tick November 2019",
          "url": "https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--699979b0-6a9a-4482-9656-82c8fb210676",
      "subject": "ATTACK:enterprise:S0634",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--699979b0-6a9a-4482-9656-82c8fb210676",
      "modified": "2026-04-29T14:23:06.069Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Toolset May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6aefb15c-c452-436d-b4db-07b8c9e2f416",
      "subject": "ATTACK:enterprise:S1232",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6aefb15c-c452-436d-b4db-07b8c9e2f416",
      "modified": "2026-04-29T14:23:06.071Z",
      "references": [
        {
          "source_name": "Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6bb9972b-cec8-4de0-966e-8fea90b4941c",
      "subject": "ATTACK:enterprise:S0448",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6bb9972b-cec8-4de0-966e-8fea90b4941c",
      "modified": "2026-04-29T14:23:06.072Z",
      "references": [
        {
          "source_name": "McAfee Sharpshooter December 2018",
          "url": "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6bf5bf94-f5d8-48ca-9805-9ffb2ccdd551",
      "subject": "ATTACK:enterprise:S9018",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6bf5bf94-f5d8-48ca-9805-9ffb2ccdd551",
      "modified": "2026-04-29T14:23:06.072Z",
      "references": [
        {
          "source_name": "Palo Alto HeartCrypt DEC 2024",
          "url": "https://unit42.paloaltonetworks.com/packer-as-a-service-heartcrypt-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6da98663-ac0c-4ba4-b1dc-4b6fc925d5f2",
      "subject": "ATTACK:enterprise:S1142",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6da98663-ac0c-4ba4-b1dc-4b6fc925d5f2",
      "modified": "2026-04-29T14:23:06.074Z",
      "references": [
        {
          "source_name": "ESET Turla Lunar toolset May 2024",
          "url": "https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6f8d8b9e-d41b-4e5d-9562-4e2c59aa7771",
      "subject": "ATTACK:enterprise:S9027",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6f8d8b9e-d41b-4e5d-9562-4e2c59aa7771",
      "modified": "2026-04-29T14:23:06.077Z",
      "references": [
        {
          "source_name": "Trend Micro Earth Kasha Anel NOV 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6fbd8e04-ce24-4969-9f3e-2df874eceb04",
      "subject": "ATTACK:enterprise:S1122",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6fbd8e04-ce24-4969-9f3e-2df874eceb04",
      "modified": "2026-04-29T14:23:06.078Z",
      "references": [
        {
          "source_name": "ESET Security Mispadu Facebook Ads 2019",
          "url": "https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/"
        },
        {
          "source_name": "SCILabs Malteiro 2021",
          "url": "https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"
        },
        {
          "source_name": "SCILabs Malteiro Threat Overlap 2023",
          "url": "https://blog.scilabs.mx/en/ursa-mispadu-overlap-analysis-with-other-threats/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--70f6f99e-d791-4af9-b9c2-23b58fc64546",
      "subject": "ATTACK:enterprise:S0497",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--70f6f99e-d791-4af9-b9c2-23b58fc64546",
      "modified": "2026-04-29T14:23:06.079Z",
      "references": [
        {
          "source_name": "TrendMicro macOS Dacls May 2020",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--728e67e8-b96b-4b60-92ba-542bf6990842",
      "subject": "ATTACK:enterprise:S9058",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--728e67e8-b96b-4b60-92ba-542bf6990842",
      "modified": "2026-09-28T16:48:03.575Z",
      "references": [
        {
          "source_name": "Mandiant_UNC1549_Nov2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--72a10804-bc08-47a8-92ec-8e173b30705e",
      "subject": "ATTACK:enterprise:S0385",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--72a10804-bc08-47a8-92ec-8e173b30705e",
      "modified": "2026-04-29T14:23:06.082Z",
      "references": [
        {
          "source_name": "Trend Micro njRAT 2018",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/autoit-compiled-worm-affecting-removable-media-delivers-fileless-version-of-bladabindi-njrat-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--72f0af8b-eb82-40d2-aa74-3ab60b72afb8",
      "subject": "ATTACK:enterprise:S0585",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--72f0af8b-eb82-40d2-aa74-3ab60b72afb8",
      "modified": "2026-04-29T14:23:06.082Z",
      "references": [
        {
          "source_name": "Unit 42 KerrDown February 2019",
          "url": "https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--73893282-77ad-4f34-bc87-ef7074dcc6fb",
      "subject": "ATTACK:enterprise:S1246",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--73893282-77ad-4f34-bc87-ef7074dcc6fb",
      "modified": "2026-04-29T14:23:06.083Z",
      "references": [
        {
          "source_name": "Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024",
          "url": "https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"
        },
        {
          "source_name": "ESET Contagious Interview BeaverTail InvisibleFerret February 2025",
          "url": "https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"
        },
        {
          "source_name": "Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024",
          "url": "https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"
        },
        {
          "source_name": "PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023",
          "url": "https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"
        },
        {
          "source_name": "PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024",
          "url": "https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--738fbccb-ecc9-40cb-8d51-4f558e39b01f",
      "subject": "ATTACK:enterprise:G1018",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--738fbccb-ecc9-40cb-8d51-4f558e39b01f",
      "modified": "2026-07-31T18:47:55.377Z",
      "references": [
        {
          "source_name": "Cisco Operation Layover September 2021",
          "url": "https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--75228d15-2264-439d-bd31-e8806d60f02a",
      "subject": "ATTACK:enterprise:S1235",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--75228d15-2264-439d-bd31-e8806d60f02a",
      "modified": "2026-04-29T14:23:06.085Z",
      "references": [
        {
          "source_name": "Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--768eb217-8d95-40aa-b697-15c426d2c99a",
      "subject": "ATTACK:enterprise:S1132",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--768eb217-8d95-40aa-b697-15c426d2c99a",
      "modified": "2026-04-29T14:23:06.087Z",
      "references": [
        {
          "source_name": "SentinelOne Agrius 2021",
          "url": "https://assets.sentinelone.com/sentinellabs/evol-agrius"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--76b38418-e979-4aa9-9aa7-80c838d4e486",
      "subject": "ATTACK:enterprise:S1200",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--76b38418-e979-4aa9-9aa7-80c838d4e486",
      "modified": "2026-04-29T14:23:06.087Z",
      "references": [
        {
          "source_name": "Cybereason StealBit Exfiltration Tool",
          "url": "https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--78b5c54c-3db4-4ac9-b0c3-78420b4e65d9",
      "subject": "ATTACK:enterprise:S1158",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--78b5c54c-3db4-4ac9-b0c3-78420b4e65d9",
      "modified": "2026-04-29T14:23:06.090Z",
      "references": [
        {
          "source_name": "Google Cloud APT41 2024",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"
        },
        {
          "source_name": "Google Cloud APT41 2022",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/apt41-us-state-governments"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--78f97a32-3e52-4929-8017-3503642d452c",
      "subject": "ATTACK:enterprise:S1249",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--78f97a32-3e52-4929-8017-3503642d452c",
      "modified": "2026-04-29T14:23:06.090Z",
      "references": [
        {
          "source_name": "Socket Contagious Interview NPM April 2025",
          "url": "https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket"
        },
        {
          "source_name": "Socket HexEval BeaverTail Contagious Interview June 2025",
          "url": "https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--798a3e14-1c98-4bac-af2d-137367f78912",
      "subject": "ATTACK:enterprise:S0613",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--798a3e14-1c98-4bac-af2d-137367f78912",
      "modified": "2026-04-29T14:23:06.091Z",
      "references": [
        {
          "source_name": "BlackBerry CostaRicto November 2020",
          "url": "https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7a9deb99-21d7-45e3-bebc-fbab668690f1",
      "subject": "ATTACK:enterprise:S0387",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7a9deb99-21d7-45e3-bebc-fbab668690f1",
      "modified": "2026-04-29T14:23:06.093Z",
      "references": [
        {
          "source_name": "CitizenLab KeyBoy Nov 2016",
          "url": "https://citizenlab.ca/2016/11/parliament-keyboy/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7ab8913b-25bc-41c7-9149-625ec14322f3",
      "subject": "ATTACK:enterprise:S0629",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7ab8913b-25bc-41c7-9149-625ec14322f3",
      "modified": "2026-04-29T14:23:06.093Z",
      "references": [
        {
          "source_name": "Bitdefender Naikon April 2021",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7ada6af2-f97d-4a64-8eca-9fffba657d46",
      "subject": "ATTACK:enterprise:S0633",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7ada6af2-f97d-4a64-8eca-9fffba657d46",
      "modified": "2026-04-29T14:23:06.093Z",
      "references": [
        {
          "source_name": "GitHub Sliver C2",
          "url": "https://github.com/BishopFox/sliver/"
        },
        {
          "source_name": "Bishop Fox Sliver Framework August 2019",
          "url": "https://labs.bishopfox.com/tech-blog/sliver"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7b6c1b21-67e7-4930-82e3-8b13d8aac0ce",
      "subject": "ATTACK:enterprise:S0579",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7b6c1b21-67e7-4930-82e3-8b13d8aac0ce",
      "modified": "2026-04-29T14:23:06.094Z",
      "references": [
        {
          "source_name": "Trend Micro Waterbear December 2019",
          "url": "https://www.trendmicro.com/en_us/research/19/l/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7c6646c0-25d9-4de6-9c13-b7d588f295f9",
      "subject": "ATTACK:enterprise:S1240",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7c6646c0-25d9-4de6-9c13-b7d588f295f9",
      "modified": "2026-04-29T14:23:06.096Z",
      "references": [
        {
          "source_name": "Splunk RedLine Stealer June 2023",
          "url": "https://www.splunk.com/en_us/blog/security/do-not-cross-the-redline-stealer-detections-and-analysis.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7c79a6d4-b1ef-4b43-bf34-c79fd9805d97",
      "subject": "ATTACK:enterprise:G1026",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7c79a6d4-b1ef-4b43-bf34-c79fd9805d97",
      "modified": "2026-07-31T18:48:16.069Z",
      "references": [
        {
          "source_name": "SCILabs Malteiro Threat Overlap 2023",
          "url": "https://blog.scilabs.mx/en/ursa-mispadu-overlap-analysis-with-other-threats/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7dfa8cdd-102c-4ea6-9fe0-d2e76b688221",
      "subject": "ATTACK:enterprise:S0430",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7dfa8cdd-102c-4ea6-9fe0-d2e76b688221",
      "modified": "2026-04-29T14:23:06.098Z",
      "references": [
        {
          "source_name": "Chronicle Winnti for Linux May 2019",
          "url": "https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8087d99b-cc05-4e2a-abce-687eb726a9e7",
      "subject": "ATTACK:enterprise:G0059",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8087d99b-cc05-4e2a-abce-687eb726a9e7",
      "modified": "2026-07-31T18:48:28.794Z",
      "references": [
        {
          "source_name": "Unit 42 Magic Hound Feb 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"
        },
        {
          "source_name": "Microsoft Iranian Threat Actor Trends November 2021",
          "url": "https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--81fe021e-6502-4a27-9f4d-59d0bb9efbe6",
      "subject": "ATTACK:enterprise:G1046",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--81fe021e-6502-4a27-9f4d-59d0bb9efbe6",
      "modified": "2026-07-31T18:47:47.992Z",
      "references": [
        {
          "source_name": "rapid7-email-bombing",
          "url": "https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--82168e77-bbd9-4da4-b163-7f813df06426",
      "subject": "ATTACK:enterprise:S0345",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--82168e77-bbd9-4da4-b163-7f813df06426",
      "modified": "2026-04-29T14:23:06.103Z",
      "references": [
        {
          "source_name": "Mandiant APT1 Appendix",
          "url": "https://www.mandiant.com/sites/default/files/2021-09/mandiant-apt1-report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--82abfdaa-06a4-4415-903d-1e77904aa4ff",
      "subject": "ATTACK:enterprise:S9065",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--82abfdaa-06a4-4415-903d-1e77904aa4ff",
      "modified": "2026-10-01T21:22:25.671Z",
      "references": [
        {
          "source_name": "Mandiant_UNC1549_Nov2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--839ce1cc-c749-4a29-8aed-3c44e93c5db4",
      "subject": "ATTACK:enterprise:S0380",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--839ce1cc-c749-4a29-8aed-3c44e93c5db4",
      "modified": "2026-04-29T14:23:06.105Z",
      "references": [
        {
          "source_name": "Kaspersky StoneDrill 2017",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--83e30b05-5658-4cc3-9bac-500ea852e655",
      "subject": "ATTACK:enterprise:S0483",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--83e30b05-5658-4cc3-9bac-500ea852e655",
      "modified": "2026-04-29T14:23:06.105Z",
      "references": [
        {
          "source_name": "Juniper IcedID June 2020",
          "url": "https://blogs.juniper.net/en-us/threat-research/covid-19-and-fmla-campaigns-used-to-install-new-icedid-banking-malware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--85aecc08-dda1-4203-9dec-376f1d9d3cad",
      "subject": "ATTACK:enterprise:G0108",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--85aecc08-dda1-4203-9dec-376f1d9d3cad",
      "modified": "2026-07-31T18:48:02.838Z",
      "references": [
        {
          "source_name": "RedCanary Mockingbird May 2020",
          "url": "https://redcanary.com/blog/blue-mockingbird-cryptominer/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--85c7f253-c343-4601-8e35-1923d3fdb1fe",
      "subject": "ATTACK:enterprise:S9034",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--85c7f253-c343-4601-8e35-1923d3fdb1fe",
      "modified": "2026-04-29T14:23:06.108Z",
      "references": [
        {
          "source_name": "CAL_MuddyWater_Mar2026",
          "url": "https://ctrlaltintel.com/research/MuddyWater/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--85f30e9c-08f6-48d6-a25d-47ef1c51ebab",
      "subject": "ATTACK:enterprise:M1049",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--85f30e9c-08f6-48d6-a25d-47ef1c51ebab",
      "modified": "2026-04-29T14:23:06.108Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--862e9ef0-a45f-4001-ad56-4432de517d80",
      "subject": "ATTACK:enterprise:S1134",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--862e9ef0-a45f-4001-ad56-4432de517d80",
      "modified": "2026-04-29T14:23:06.108Z",
      "references": [
        {
          "source_name": "SentinelOne Agrius 2021",
          "url": "https://assets.sentinelone.com/sentinellabs/evol-agrius"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--86333028-9eb1-44a3-9a5a-51fffe66f0e1",
      "subject": "ATTACK:enterprise:G0081",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--86333028-9eb1-44a3-9a5a-51fffe66f0e1",
      "modified": "2026-07-31T18:47:57.315Z",
      "references": [
        {
          "source_name": "TrendMicro Tropic Trooper May 2020",
          "url": "https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"
        },
        {
          "source_name": "TrendMicro Tropic Trooper Mar 2018",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8690ef38-ee7a-49ec-b723-0f7dceced233",
      "subject": "ATTACK:enterprise:S0663",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8690ef38-ee7a-49ec-b723-0f7dceced233",
      "modified": "2026-04-29T14:23:06.109Z",
      "references": [
        {
          "source_name": "Trend Micro Iron Tiger April 2021",
          "url": "https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--86c83427-c35b-46c2-9c55-90b1967bed49",
      "subject": "ATTACK:enterprise:S0667",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--86c83427-c35b-46c2-9c55-90b1967bed49",
      "modified": "2026-04-29T14:23:06.109Z",
      "references": [
        {
          "source_name": "ESET Gelsemium June 2021",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--87e617b5-0169-458a-835e-08f81bffc179",
      "subject": "ATTACK:enterprise:S1141",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--87e617b5-0169-458a-835e-08f81bffc179",
      "modified": "2026-04-29T14:23:06.111Z",
      "references": [
        {
          "source_name": "ESET Turla Lunar toolset May 2024",
          "url": "https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--895b238e-356f-4ad0-9a62-e6ae380dccd0",
      "subject": "ATTACK:enterprise:S0438",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--895b238e-356f-4ad0-9a62-e6ae380dccd0",
      "modified": "2026-04-29T14:23:06.113Z",
      "references": [
        {
          "source_name": "ESET Attor Oct 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8a19d65a-f438-4b12-8b8f-c696d7c44559",
      "subject": "ATTACK:enterprise:S9016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8a19d65a-f438-4b12-8b8f-c696d7c44559",
      "modified": "2026-04-29T14:23:06.114Z",
      "references": [
        {
          "source_name": "Zscaler BlindEagle DEC 2025",
          "url": "https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8b12a0c5-9e30-47ef-a786-5c5eeaf52240",
      "subject": "ATTACK:enterprise:S0496",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8b12a0c5-9e30-47ef-a786-5c5eeaf52240",
      "modified": "2026-04-29T14:23:06.115Z",
      "references": [
        {
          "source_name": "Secureworks REvil September 2019",
          "url": "https://www.secureworks.com/research/revil-sodinokibi-ransomware"
        },
        {
          "source_name": "Group IB Ransomware May 2020",
          "url": "https://www.group-ib.com/whitepapers/ransomware-uncovered.html"
        },
        {
          "source_name": "G Data Sodinokibi June 2019",
          "url": "https://www.gdatasoftware.com/blog/2019/06/31724-strange-bits-sodinokibi-spam-cinarat-and-fake-g-data"
        },
        {
          "source_name": "Intel 471 REvil March 2020",
          "url": "https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/"
        },
        {
          "source_name": "McAfee Sodinokibi October 2019",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"
        },
        {
          "source_name": "Picus Sodinokibi January 2020",
          "url": "https://www.picussecurity.com/blog/a-brief-history-and-further-technical-analysis-of-sodinokibi-ransomware"
        },
        {
          "source_name": "Secureworks GandCrab and REvil September 2019",
          "url": "https://www.secureworks.com/blog/revil-the-gandcrab-connection"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8ba71919-c776-4e1b-ad71-160649060d3e",
      "subject": "ATTACK:enterprise:G0103",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8ba71919-c776-4e1b-ad71-160649060d3e",
      "modified": "2026-07-31T18:48:06.622Z",
      "references": [
        {
          "source_name": "FOX-IT May 2016 Mofang",
          "url": "https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8c7631c4-bc83-4ee5-abb5-c039d63da619",
      "subject": "ATTACK:enterprise:S0232",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8c7631c4-bc83-4ee5-abb5-c039d63da619",
      "modified": "2026-04-29T14:23:06.117Z",
      "references": [
        {
          "source_name": "FireEye Periscope March 2018",
          "url": "https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8cde73bb-6287-4765-9b45-d8bfd6dfde4d",
      "subject": "ATTACK:enterprise:S9024",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8cde73bb-6287-4765-9b45-d8bfd6dfde4d",
      "modified": "2026-04-29T14:23:06.117Z",
      "references": [
        {
          "source_name": "Google UNC5221 Ivanti April 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-exploiting-critical-ivanti-vulnerability"
        },
        {
          "source_name": "Picus Security UNC5221 Ivanti May 2025",
          "url": "https://www.picussecurity.com/resource/blog/unc5221-cve-2025-22457-ivanti-connect-secure"
        },
        {
          "source_name": "JPCERT SPAWNCHIMERA Ivanti February 2025",
          "url": "https://blogs.jpcert.or.jp/en/2025/02/spawnchimera.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8d3987f5-3f65-4af1-bc5d-d7a1e7f6c964",
      "subject": "ATTACK:enterprise:S1247",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8d3987f5-3f65-4af1-bc5d-d7a1e7f6c964",
      "modified": "2026-04-29T14:23:06.118Z",
      "references": [
        {
          "source_name": "ESET Embargo Ransomware October 2024",
          "url": "https://www.welivesecurity.com/en/eset-research/embargo-ransomware-rocknrust/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8e809969-d903-4e58-b8a9-7344127da3cd",
      "subject": "ATTACK:enterprise:S0226",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8e809969-d903-4e58-b8a9-7344127da3cd",
      "modified": "2026-04-29T14:23:06.119Z",
      "references": [
        {
          "source_name": "Talos Smoke Loader July 2018",
          "url": "https://blog.talosintelligence.com/2018/07/smoking-guns-smoke-loader-learned-new.html#more"
        },
        {
          "source_name": "Malwarebytes SmokeLoader 2016",
          "url": "https://blog.malwarebytes.com/threat-analysis/2016/08/smoke-loader-downloader-with-a-smokescreen-still-alive/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8f041469-04c8-4416-a745-09147affe145",
      "subject": "ATTACK:enterprise:G1052",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8f041469-04c8-4416-a745-09147affe145",
      "modified": "2026-07-31T18:47:54.687Z",
      "references": [
        {
          "source_name": "Socket Contagious Interview NPM April 2025",
          "url": "https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8fc92d76-ac57-4d4e-bdbd-3e2f10142cb5",
      "subject": "ATTACK:enterprise:S0332",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8fc92d76-ac57-4d4e-bdbd-3e2f10142cb5",
      "modified": "2026-04-29T14:23:06.121Z",
      "references": [
        {
          "source_name": "Fortinet Remcos Campaign NOV 2024",
          "url": "https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--914406e6-9388-477d-ba6b-97e5ebec31f0",
      "subject": "ATTACK:enterprise:S0456",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--914406e6-9388-477d-ba6b-97e5ebec31f0",
      "modified": "2026-04-29T14:23:06.123Z",
      "references": [
        {
          "source_name": "CheckPoint Naikon May 2020",
          "url": "https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--91a362c7-a111-4a1e-8978-1afcc110e5cf",
      "subject": "ATTACK:enterprise:S0256",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--91a362c7-a111-4a1e-8978-1afcc110e5cf",
      "modified": "2026-04-29T14:23:06.123Z",
      "references": [
        {
          "source_name": "ESET Turla Mosquito Jan 2018",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--91d4c776-c259-46b0-b511-b344ca027009",
      "subject": "ATTACK:enterprise:S0046",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--91d4c776-c259-46b0-b511-b344ca027009",
      "modified": "2026-04-29T14:23:06.124Z",
      "references": [
        {
          "source_name": "F-Secure CozyDuke",
          "url": "https://www.f-secure.com/documents/996508/1030745/CozyDuke"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--93b3993d-0345-434e-9b0a-4dfd8efa6c99",
      "subject": "ATTACK:enterprise:S0388",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--93b3993d-0345-434e-9b0a-4dfd8efa6c99",
      "modified": "2026-04-29T14:23:06.126Z",
      "references": [
        {
          "source_name": "TrendMicro TropicTrooper 2015",
          "url": "https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--93be81ec-3e56-4257-b869-37bcec2c2625",
      "subject": "ATTACK:enterprise:S0665",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--93be81ec-3e56-4257-b869-37bcec2c2625",
      "modified": "2026-04-29T14:23:06.126Z",
      "references": [
        {
          "source_name": "Kaspersky ThreatNeedle Feb 2021",
          "url": "https://securelist.com/lazarus-threatneedle/100803/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--953f1fa1-82c5-4137-b9f1-257c33c1f803",
      "subject": "ATTACK:enterprise:C0040",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--953f1fa1-82c5-4137-b9f1-257c33c1f803",
      "modified": "2026-07-31T18:47:30.465Z",
      "references": [
        {
          "source_name": "Google Cloud APT41 2024",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--95c6eafc-4b3f-404b-86d9-13b4ae4845da",
      "subject": "ATTACK:enterprise:G0107",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--95c6eafc-4b3f-404b-86d9-13b4ae4845da",
      "modified": "2026-07-31T18:48:14.607Z",
      "references": [
        {
          "source_name": "Symantec Whitefly March 2019",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/whitefly-espionage-singapore"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--998650da-f301-46be-ab18-38d14359530b",
      "subject": "ATTACK:enterprise:G0045",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--998650da-f301-46be-ab18-38d14359530b",
      "modified": "2026-07-31T18:47:44.197Z",
      "references": [
        {
          "source_name": "Accenture Hogfish April 2018",
          "url": "http://web.archive.org/web/20220810112638/https:/www.accenture.com/t20180423T055005Z_w_/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"
        },
        {
          "source_name": "FireEye APT10 Sept 2018",
          "url": "https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"
        },
        {
          "source_name": "Symantec Cicada November 2020",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9a59b7cb-69ca-4123-a06b-320fb4f48a93",
      "subject": "ATTACK:enterprise:S1180",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9a59b7cb-69ca-4123-a06b-320fb4f48a93",
      "modified": "2026-04-29T14:23:06.136Z",
      "references": [
        {
          "source_name": "Trustwave BlackByte 2021",
          "url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9d0eda8b-7696-4b22-a31e-6761e42bc2ae",
      "subject": "ATTACK:enterprise:S0574",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9d0eda8b-7696-4b22-a31e-6761e42bc2ae",
      "modified": "2026-04-29T14:23:06.139Z",
      "references": [
        {
          "source_name": "Unit42 BendyBear Feb 2021",
          "url": "https://unit42.paloaltonetworks.com/bendybear-shellcode-blacktech/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9fe48106-c6e9-4b1a-a274-b35166e082da",
      "subject": "ATTACK:enterprise:S1032",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9fe48106-c6e9-4b1a-a274-b35166e082da",
      "modified": "2026-04-29T14:23:06.143Z",
      "references": [
        {
          "source_name": "Checkpoint MosesStaff Nov 2021",
          "url": "https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a0bf84db-5482-4bc2-a53f-46d988e4f688",
      "subject": "ATTACK:enterprise:S0257",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a0bf84db-5482-4bc2-a53f-46d988e4f688",
      "modified": "2026-04-29T14:23:06.144Z",
      "references": [
        {
          "source_name": "Unit 42 VERMIN Jan 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a265eb6a-d7a1-4013-b070-ab96fb6cae3c",
      "subject": "ATTACK:enterprise:C0047",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a265eb6a-d7a1-4013-b070-ab96fb6cae3c",
      "modified": "2026-07-31T18:47:19.586Z",
      "references": [
        {
          "source_name": "Recorded Future RedDelta 2025",
          "url": "https://go.recordedfuture.com/hubfs/reports/cta-cn-2025-0109.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a2c59195-f81a-4ed1-8d64-7137f961a835",
      "subject": "ATTACK:enterprise:S0339",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a2c59195-f81a-4ed1-8d64-7137f961a835",
      "modified": "2026-04-29T14:23:06.146Z",
      "references": [
        {
          "source_name": "Talos Micropsia June 2017",
          "url": "https://blog.talosintelligence.com/2017/06/palestine-delphi.html"
        },
        {
          "source_name": "Radware Micropsia July 2018",
          "url": "https://www.radware.com/blog/security/2018/07/micropsia-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a3b40306-fafa-47e6-9164-fbd75e04b645",
      "subject": "ATTACK:enterprise:C0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a3b40306-fafa-47e6-9164-fbd75e04b645",
      "modified": "2026-07-31T20:48:14.721Z",
      "references": [
        {
          "source_name": "Cylance Dust Storm",
          "url": "https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a4e96b11-6f07-422c-bf18-9866ee6fb6a9",
      "subject": "ATTACK:enterprise:S1020",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a4e96b11-6f07-422c-bf18-9866ee6fb6a9",
      "modified": "2026-04-29T14:23:06.149Z",
      "references": [
        {
          "source_name": "Kaspersky Lyceum October 2021",
          "url": "https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a56ece45-a76c-4b19-8999-6dde50b48409",
      "subject": "ATTACK:enterprise:G1009",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a56ece45-a76c-4b19-8999-6dde50b48409",
      "modified": "2026-07-31T18:47:55.682Z",
      "references": [
        {
          "source_name": "Checkpoint MosesStaff Nov 2021",
          "url": "https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a68a4d37-e2dd-4981-893d-20c43d056539",
      "subject": "ATTACK:enterprise:G0139",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a68a4d37-e2dd-4981-893d-20c43d056539",
      "modified": "2026-07-31T18:47:49.904Z",
      "references": [
        {
          "source_name": "Trend Micro TeamTNT",
          "url": "https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"
        },
        {
          "source_name": "Aqua TeamTNT August 2020",
          "url": "https://blog.aquasec.com/container-security-tnt-container-attack"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ac9da78c-a78e-408f-87a4-1096259f97dc",
      "subject": "ATTACK:enterprise:S9026",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ac9da78c-a78e-408f-87a4-1096259f97dc",
      "modified": "2026-04-29T14:23:06.160Z",
      "references": [
        {
          "source_name": "Trend Micro Earth Kasha Anel NOV 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ae1ee1dc-6017-4177-b34c-70db166a939e",
      "subject": "ATTACK:enterprise:S0044",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ae1ee1dc-6017-4177-b34c-70db166a939e",
      "modified": "2026-04-29T14:23:06.162Z",
      "references": [
        {
          "source_name": "ESET Sednit Part 1",
          "url": "http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part1.pdf"
        },
        {
          "source_name": "F-Secure Sofacy 2015",
          "url": "https://labsblog.f-secure.com/2015/09/08/sofacy-recycles-carberp-and-metasploit-code/"
        },
        {
          "source_name": "Talos Seduploader Oct 2017",
          "url": "https://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ae6af46e-ac3d-40dd-8733-0f5f8429b5ef",
      "subject": "ATTACK:enterprise:S9043",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ae6af46e-ac3d-40dd-8733-0f5f8429b5ef",
      "modified": "2026-07-29T21:10:31.516Z",
      "references": [
        {
          "source_name": "Flashpoint Mini Shai-Hulud MAY 2026",
          "url": "https://flashpoint.io/blog/mini-shai-hulud-worm-new-era-ci-cd-exploitation/"
        },
        {
          "source_name": "Trend Micro TeamPCP MAY 2026",
          "url": "https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ae7a51b0-da52-4793-b46b-0711ee85c086",
      "subject": "ATTACK:enterprise:C0042",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ae7a51b0-da52-4793-b46b-0711ee85c086",
      "modified": "2026-07-31T21:15:09.233Z",
      "references": [
        {
          "source_name": "ESET OilRig Campaigns Sep 2023",
          "url": "https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ae8e960c-3842-4dd5-abab-31d35c0fd1fd",
      "subject": "ATTACK:enterprise:S0588",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ae8e960c-3842-4dd5-abab-31d35c0fd1fd",
      "modified": "2026-04-29T14:23:06.163Z",
      "references": [
        {
          "source_name": "MSTIC NOBELIUM Mar 2021",
          "url": "https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"
        },
        {
          "source_name": "FireEye SUNSHUTTLE Mar 2021",
          "url": "https://www.fireeye.com/blog/threat-research/2021/03/sunshuttle-second-stage-backdoor-targeting-us-based-entity.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--af85b32a-7b5e-48ea-9777-50d4d625a122",
      "subject": "ATTACK:enterprise:S1041",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--af85b32a-7b5e-48ea-9777-50d4d625a122",
      "modified": "2026-04-29T14:23:06.164Z",
      "references": [
        {
          "source_name": "Bitdefender FunnyDream Campaign November 2020",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b09cad27-7b44-4a57-adf8-dcbcb3cdcb0a",
      "subject": "ATTACK:enterprise:S0213",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b09cad27-7b44-4a57-adf8-dcbcb3cdcb0a",
      "modified": "2026-04-29T14:23:06.166Z",
      "references": [
        {
          "source_name": "Unit 42 Nokki Oct 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/10/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b52fd457-405d-4cc3-b1f7-141ab6fbf04a",
      "subject": "ATTACK:enterprise:S1027",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b52fd457-405d-4cc3-b1f7-141ab6fbf04a",
      "modified": "2026-04-29T14:23:06.173Z",
      "references": [
        {
          "source_name": "SentinelOne Aoqin Dragon June 2022",
          "url": "https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b5d639f5-6bda-4014-898b-ce2c96725402",
      "subject": "ATTACK:enterprise:S1226",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b5d639f5-6bda-4014-898b-ce2c96725402",
      "modified": "2026-04-29T14:23:06.174Z",
      "references": [
        {
          "source_name": "Palo Alto Networks, Unit 42",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b693efc4-a3e5-4378-9aa0-fad7c653e63e",
      "subject": "ATTACK:enterprise:S9017",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b693efc4-a3e5-4378-9aa0-fad7c653e63e",
      "modified": "2026-04-29T14:23:06.174Z",
      "references": [
        {
          "source_name": "Zscaler BlindEagle DEC 2025",
          "url": "https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b6e5a51c-f730-4514-8ffd-b540d5b4cf23",
      "subject": "ATTACK:enterprise:G1013",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b6e5a51c-f730-4514-8ffd-b540d5b4cf23",
      "modified": "2026-07-31T18:48:15.944Z",
      "references": [
        {
          "source_name": "SentinelLabs Metador Sept 2022",
          "url": "https://assets.sentinelone.com/sentinellabs22/metador#page=1"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ba97fa9c-949b-4e86-b537-e828b602e39f",
      "subject": "ATTACK:enterprise:S0618",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ba97fa9c-949b-4e86-b537-e828b602e39f",
      "modified": "2026-04-29T14:23:06.179Z",
      "references": [
        {
          "source_name": "CISA AR21-126A FIVEHANDS May 2021",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"
        },
        {
          "source_name": "NCC Group Fivehands June 2021",
          "url": "https://research.nccgroup.com/2021/06/15/handy-guide-to-a-new-fivehands-ransomware-variant/"
        },
        {
          "source_name": "FireEye FiveHands April 2021",
          "url": "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bc1f1a9f-d90e-4c8f-b8fb-eca66f582669",
      "subject": "ATTACK:enterprise:S9013",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bc1f1a9f-d90e-4c8f-b8fb-eca66f582669",
      "modified": "2026-04-29T14:23:06.182Z",
      "references": [
        {
          "source_name": "Google UNC5221 Ivanti January 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day"
        },
        {
          "source_name": "Picus Security UNC5221 Ivanti May 2025",
          "url": "https://www.picussecurity.com/resource/blog/unc5221-cve-2025-22457-ivanti-connect-secure"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bc9a5286-98a6-4905-b4ce-8f4d958861b6",
      "subject": "ATTACK:enterprise:S0330",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bc9a5286-98a6-4905-b4ce-8f4d958861b6",
      "modified": "2026-04-29T14:23:06.183Z",
      "references": [
        {
          "source_name": "Talos Zeus Panda Nov 2017",
          "url": "https://blog.talosintelligence.com/2017/11/zeus-panda-campaign.html#More"
        },
        {
          "source_name": "GDATA Zeus Panda June 2017",
          "url": "https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bda0ff4f-ed93-4d84-bfa4-dd39abe9fd62",
      "subject": "ATTACK:enterprise:S1030",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bda0ff4f-ed93-4d84-bfa4-dd39abe9fd62",
      "modified": "2026-04-29T14:23:06.184Z",
      "references": [
        {
          "source_name": "ZScaler Squirrelwaffle Sep 2021",
          "url": "https://www.zscaler.com/blogs/security-research/squirrelwaffle-new-loader-delivering-cobalt-strike"
        },
        {
          "source_name": "Netskope Squirrelwaffle Oct 2021",
          "url": "https://www.netskope.com/blog/squirrelwaffle-new-malware-loader-delivering-cobalt-strike-and-qakbot"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bda95df4-bf1d-4a49-b847-cf4f3fd5f51c",
      "subject": "ATTACK:enterprise:S0398",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bda95df4-bf1d-4a49-b847-cf4f3fd5f51c",
      "modified": "2026-04-29T14:23:06.185Z",
      "references": [
        {
          "source_name": "Trend Micro DRBControl February 2020",
          "url": "https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--be48b079-418b-41c3-952b-cbf8a48f2002",
      "subject": "ATTACK:enterprise:S1037",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--be48b079-418b-41c3-952b-cbf8a48f2002",
      "modified": "2026-04-29T14:23:06.185Z",
      "references": [
        {
          "source_name": "DHS CISA AA22-055A MuddyWater February 2022",
          "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c12c331c-67dd-40be-b2ad-a198c0b92e78",
      "subject": "ATTACK:enterprise:S0431",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c12c331c-67dd-40be-b2ad-a198c0b92e78",
      "modified": "2026-04-29T14:23:06.189Z",
      "references": [
        {
          "source_name": "Carbon Black HotCroissant April 2020",
          "url": "https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c3a1969b-1edb-4a78-80ab-b122cc2822e4",
      "subject": "ATTACK:enterprise:G0043",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c3a1969b-1edb-4a78-80ab-b122cc2822e4",
      "modified": "2026-07-31T18:48:02.566Z",
      "references": [
        {
          "source_name": "Citizen Lab Group5",
          "url": "https://citizenlab.ca/2016/08/group5-syria/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c3d73dc3-06f6-422a-9be2-c4eb3ce36fbc",
      "subject": "ATTACK:enterprise:C0022",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c3d73dc3-06f6-422a-9be2-c4eb3ce36fbc",
      "modified": "2026-07-31T21:14:22.865Z",
      "references": [
        {
          "source_name": "McAfee Lazarus Nov 2020",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/"
        },
        {
          "source_name": "ESET Lazarus Jun 2020",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_Operation_Interception.pdf"
        },
        {
          "source_name": "McAfee Lazarus Jul 2020",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-a-job-offer-thats-too-good-to-be-true/?hilite=%27Operation%27%2C%27North%27%2C%27Star%27"
        },
        {
          "source_name": "ClearSky Lazarus Aug 2020",
          "url": "https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c5dbf061-d021-436b-b6e7-6bb6156584cc",
      "subject": "ATTACK:enterprise:S1213",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c5dbf061-d021-436b-b6e7-6bb6156584cc",
      "modified": "2026-04-29T14:23:06.196Z",
      "references": [
        {
          "source_name": "Qualys LummaStealer 2024",
          "url": "https://blog.qualys.com/vulnerabilities-threat-research/2024/10/20/unmasking-lumma-stealer-analyzing-deceptive-tactics-with-fake-captcha"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c6f05b16-bca5-421a-967c-711808f6fc8a",
      "subject": "ATTACK:enterprise:S9041",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c6f05b16-bca5-421a-967c-711808f6fc8a",
      "modified": "2026-07-15T20:02:40.524Z",
      "references": [
        {
          "source_name": "Aqua Security Trivy Compromise MAR 2026",
          "url": "https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23"
        },
        {
          "source_name": "Wiz Trivy Compromise MAR 2026",
          "url": "https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"
        },
        {
          "source_name": "Palo Alto TeamPCP MAR 2026",
          "url": "https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c71b5c0b-5ef4-4c6f-9ad1-d2d59e0a7548",
      "subject": "ATTACK:enterprise:S0526",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c71b5c0b-5ef4-4c6f-9ad1-d2d59e0a7548",
      "modified": "2026-04-29T14:23:06.197Z",
      "references": [
        {
          "source_name": "Cybereason Kimsuky November 2020",
          "url": "https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c73f0de0-1fbb-44e6-ac51-95bf21ea4018",
      "subject": "ATTACK:enterprise:S0578",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c73f0de0-1fbb-44e6-ac51-95bf21ea4018",
      "modified": "2026-04-29T14:23:06.197Z",
      "references": [
        {
          "source_name": "CISA Supernova Jan 2021",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-027a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c808ac7c-6da1-4be8-9233-0020fbc3e8ac",
      "subject": "ATTACK:enterprise:S0484",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c808ac7c-6da1-4be8-9233-0020fbc3e8ac",
      "modified": "2026-04-29T14:23:06.199Z",
      "references": [
        {
          "source_name": "Prevx Carberp March 2011",
          "url": "https://web.archive.org/web/20231227000328/http://pxnow.prevx.com/content/blog/carberp-a_modular_information_stealing_trojan.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c952f284-e529-481f-97fb-7a6e14c25ccf",
      "subject": "ATTACK:enterprise:G0024",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c952f284-e529-481f-97fb-7a6e14c25ccf",
      "modified": "2026-07-31T18:47:58.452Z",
      "references": [
        {
          "source_name": "CrowdStrike Putter Panda",
          "url": "http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c995160b-04cd-42b8-bb1a-106f24c9b28c",
      "subject": "ATTACK:enterprise:S0367",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c995160b-04cd-42b8-bb1a-106f24c9b28c",
      "modified": "2026-04-29T14:23:06.201Z",
      "references": [
        {
          "source_name": "emotet_trendmicro_mar2023",
          "url": "https://www.trendmicro.com/en_us/research/23/c/emotet-returns-now-adopts-binary-padding-for-evasion.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ca84dad1-9cc3-428c-b561-856560a50cbb",
      "subject": "ATTACK:enterprise:C0064",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ca84dad1-9cc3-428c-b561-856560a50cbb",
      "modified": "2026-10-01T14:41:18.600Z",
      "references": [
        {
          "source_name": "AI-Mexico-Govt-Breach",
          "url": "https://cdn.prod.website-files.com/69944dd945f20ca4a27a7c47/69d8bb5aea59e31efb3b8a7f_Tech_Report_ai_breach_mex_gov.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ca8af6f0-da6b-40c8-81cb-764e1df0fd0a",
      "subject": "ATTACK:enterprise:S0374",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ca8af6f0-da6b-40c8-81cb-764e1df0fd0a",
      "modified": "2026-04-29T14:23:06.202Z",
      "references": [
        {
          "source_name": "CheckPoint SpeakUp Feb 2019",
          "url": "https://research.checkpoint.com/speakup-a-new-undetected-backdoor-linux-trojan/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cacb6b4d-a69b-437b-b7cc-5d115bf0b30a",
      "subject": "ATTACK:enterprise:C0057",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cacb6b4d-a69b-437b-b7cc-5d115bf0b30a",
      "modified": "2026-07-31T18:47:22.733Z",
      "references": [
        {
          "source_name": "Unit42 3cx supply chain 2023",
          "url": "https://unit42.paloaltonetworks.com/3cxdesktopapp-supply-chain-attack/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cc7777a5-c717-4d3b-8fb2-337da4b6403a",
      "subject": "ATTACK:enterprise:C0056",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cc7777a5-c717-4d3b-8fb2-337da4b6403a",
      "modified": "2026-07-31T18:47:20.289Z",
      "references": [
        {
          "source_name": "Juniper RedPenguin MAR 2025",
          "url": "https://supportportal.juniper.net/sfc/servlet.shepherd/document/download/069Dp00000FzdmIIAR?operationContext=S1"
        },
        {
          "source_name": "Mandiant UNC3886 Juniper Routers MAR 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cd0cc9b2-516b-4674-8b4d-798204ffe49e",
      "subject": "ATTACK:enterprise:S1248",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cd0cc9b2-516b-4674-8b4d-798204ffe49e",
      "modified": "2026-04-29T14:23:06.206Z",
      "references": [
        {
          "source_name": "Socket BeaverTail XORIndex HexEval Contagious Interview July 2025",
          "url": "https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cdbfa147-52be-411d-bcbd-f6dcbf91d7b5",
      "subject": "ATTACK:enterprise:G0049",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cdbfa147-52be-411d-bcbd-f6dcbf91d7b5",
      "modified": "2026-07-31T20:48:35.852Z",
      "references": [
        {
          "source_name": "Unit42 OilRig Nov 2018",
          "url": "https://unit42.paloaltonetworks.com/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery/"
        },
        {
          "source_name": "Unit 42 QUADAGENT July 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"
        },
        {
          "source_name": "Crowdstrike Helix Kitten Nov 2018",
          "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/"
        },
        {
          "source_name": "FireEye APT34 Dec 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
        },
        {
          "source_name": "Unit42 OilRig Playbook 2023",
          "url": "https://web.archive.org/web/20230610050742/https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ce788d40-df7d-488d-b864-81d7525c6262",
      "subject": "ATTACK:enterprise:S9028",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ce788d40-df7d-488d-b864-81d7525c6262",
      "modified": "2026-04-29T14:23:06.207Z",
      "references": [
        {
          "source_name": "sentinelone operationDigitalEye Dec 2024",
          "url": "https://www.sentinelone.com/labs/operation-digital-eye-chinese-apt-compromises-critical-digital-infrastructure-via-visual-studio-code-tunnels/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cfc3d427-79bb-41d1-8336-aa1365555d0f",
      "subject": "ATTACK:enterprise:S1060",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cfc3d427-79bb-41d1-8336-aa1365555d0f",
      "modified": "2026-04-29T14:23:06.209Z",
      "references": [
        {
          "source_name": "SentinelLabs Metador Sept 2022",
          "url": "https://assets.sentinelone.com/sentinellabs22/metador#page=1"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d0d74930-6b1d-4d1d-ba7f-60b93c114fd9",
      "subject": "ATTACK:enterprise:S0087",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d0d74930-6b1d-4d1d-ba7f-60b93c114fd9",
      "modified": "2026-04-29T14:23:06.211Z",
      "references": [
        {
          "source_name": "Fidelis INOCNATION",
          "url": "https://fidelissecurity.com/resource/report/fidelis-threat-advisory-1020-dissecting-the-malware-involved-in-the-inocnation-campaign/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d13ea010-1b69-40d4-8d86-6fe2053f59d2",
      "subject": "ATTACK:enterprise:S0394",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d13ea010-1b69-40d4-8d86-6fe2053f59d2",
      "modified": "2026-04-29T14:23:06.212Z",
      "references": [
        {
          "source_name": "Intezer HiddenWasp Map 2019",
          "url": "https://www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d2aa6fd1-d530-4fbf-ada7-8b3ddb149d7e",
      "subject": "ATTACK:enterprise:S1160",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d2aa6fd1-d530-4fbf-ada7-8b3ddb149d7e",
      "modified": "2026-04-29T14:23:06.213Z",
      "references": [
        {
          "source_name": "Bitsight Latrodectus June 2024",
          "url": "https://www.bitsight.com/blog/latrodectus-are-you-coming-back"
        },
        {
          "source_name": "Latrodectus APR 2024",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"
        },
        {
          "source_name": "Elastic Latrodectus May 2024",
          "url": "https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d4962990-8bb3-46b9-9ca3-c946fd6ce07e",
      "subject": "ATTACK:enterprise:S0493",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d4962990-8bb3-46b9-9ca3-c946fd6ce07e",
      "modified": "2026-04-29T14:23:06.216Z",
      "references": [
        {
          "source_name": "Trustwave GoldenSpy2 June 2020",
          "url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/goldenspy-chapter-two-the-uninstaller/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d4d74097-2e4a-44c7-bda0-8c0dee2b5813",
      "subject": "ATTACK:enterprise:S0011",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d4d74097-2e4a-44c7-bda0-8c0dee2b5813",
      "modified": "2026-04-29T14:23:06.216Z",
      "references": [
        {
          "source_name": "CISA MAR-10292089-1.v2 TAIDOOR August 2021",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d67e450d-8b3c-4b6b-8213-c29223a7f4d6",
      "subject": "ATTACK:enterprise:S0612",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d67e450d-8b3c-4b6b-8213-c29223a7f4d6",
      "modified": "2026-04-29T14:23:06.218Z",
      "references": [
        {
          "source_name": "NCC Group WastedLocker June 2020",
          "url": "https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d6de484e-a1f6-43cb-a506-ec4888e69bdd",
      "subject": "ATTACK:enterprise:C0005",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d6de484e-a1f6-43cb-a506-ec4888e69bdd",
      "modified": "2026-07-31T18:47:22.732Z",
      "references": [
        {
          "source_name": "ESET Operation Spalax Jan 2021",
          "url": "https://www.welivesecurity.com/2021/01/12/operation-spalax-targeted-malware-attacks-colombia/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d7f5c7fe-5d4a-4f1e-a5a3-adf02f8699ec",
      "subject": "ATTACK:enterprise:S0141",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d7f5c7fe-5d4a-4f1e-a5a3-adf02f8699ec",
      "modified": "2026-04-29T14:23:06.220Z",
      "references": [
        {
          "source_name": "Novetta Winnti April 2015",
          "url": "https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--dac0cbc1-227d-41d7-aabf-6c54a009d3c9",
      "subject": "ATTACK:enterprise:S0658",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--dac0cbc1-227d-41d7-aabf-6c54a009d3c9",
      "modified": "2026-04-29T14:23:06.224Z",
      "references": [
        {
          "source_name": "Microsoft March 2025 XCSSET",
          "url": "https://www.microsoft.com/en-us/security/blog/2025/03/11/new-xcsset-malware-adds-new-obfuscation-persistence-techniques-to-infect-xcode-projects/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--db1b7307-a473-40eb-be9c-25d95c0e2054",
      "subject": "ATTACK:enterprise:S0401",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--db1b7307-a473-40eb-be9c-25d95c0e2054",
      "modified": "2026-04-29T14:23:06.224Z",
      "references": [
        {
          "source_name": "ANSSI Sandworm January 2021",
          "url": "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
        },
        {
          "source_name": "ESET TeleBots Oct 2018",
          "url": "https://www.welivesecurity.com/2018/10/11/new-telebots-backdoor-linking-industroyer-notpetya/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--db91e39d-daa4-4f9c-a7a6-be67eba712d2",
      "subject": "ATTACK:enterprise:G0050",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--db91e39d-daa4-4f9c-a7a6-be67eba712d2",
      "modified": "2026-07-31T18:47:45.613Z",
      "references": [
        {
          "source_name": "GitHub Invoke-Obfuscation",
          "url": "https://github.com/danielbohannon/Invoke-Obfuscation"
        },
        {
          "source_name": "FireEye APT32 May 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"
        },
        {
          "source_name": "Cybereason Oceanlotus May 2017",
          "url": "https://www.cybereason.com/blog/operation-cobalt-kitty-apt"
        },
        {
          "source_name": "Cybereason Cobalt Kitty 2017",
          "url": "https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"
        },
        {
          "source_name": "ESET OceanLotus Mar 2019",
          "url": "https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"
        },
        {
          "source_name": "ESET OceanLotus macOS April 2019",
          "url": "https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/"
        },
        {
          "source_name": "ESET OceanLotus",
          "url": "https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--dc6fcf08-c160-412e-be5e-3b669d43762a",
      "subject": "ATTACK:enterprise:S0698",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--dc6fcf08-c160-412e-be5e-3b669d43762a",
      "modified": "2026-04-29T14:23:06.226Z",
      "references": [
        {
          "source_name": "ESET Hermetic Wizard March 2022",
          "url": "https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--deb7df24-689e-4e4e-909f-a270241ab65a",
      "subject": "ATTACK:enterprise:S0168",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--deb7df24-689e-4e4e-909f-a270241ab65a",
      "modified": "2026-04-29T14:23:06.229Z",
      "references": [
        {
          "source_name": "Securelist WhiteBear Aug 2017",
          "url": "https://securelist.com/introducing-whitebear/81638/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--df5db6d7-a072-4d04-a638-843ac66234ef",
      "subject": "ATTACK:enterprise:C0029",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--df5db6d7-a072-4d04-a638-843ac66234ef",
      "modified": "2026-07-31T18:47:23.503Z",
      "references": [
        {
          "source_name": "Mandiant Cutting Edge Part 2 January 2024",
          "url": "https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e09fd624-7298-4bd0-8a38-90ba0eec6fbd",
      "subject": "ATTACK:enterprise:S0601",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e09fd624-7298-4bd0-8a38-90ba0eec6fbd",
      "modified": "2026-04-29T14:23:06.231Z",
      "references": [
        {
          "source_name": "Unit 42 Hildegard Malware",
          "url": "https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e35811f1-59ae-4baa-978d-e1a9b8029bbc",
      "subject": "ATTACK:enterprise:G1054",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e35811f1-59ae-4baa-978d-e1a9b8029bbc",
      "modified": "2026-07-31T18:48:09.243Z",
      "references": [
        {
          "source_name": "ITOCHU LODEINFO JAN 2024",
          "url": "https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e5d5ca1f-1e8e-4870-a9ef-33a963ee6148",
      "subject": "ATTACK:enterprise:S0180",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e5d5ca1f-1e8e-4870-a9ef-33a963ee6148",
      "modified": "2026-04-29T14:23:06.238Z",
      "references": [
        {
          "source_name": "US-CERT Volgmer 2 Nov 2017",
          "url": "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-D_WHITE_S508C.PDF"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e6139bbe-ef7e-4f51-9add-a6c61f9936ee",
      "subject": "ATTACK:enterprise:S1190",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e6139bbe-ef7e-4f51-9add-a6c61f9936ee",
      "modified": "2026-04-29T14:23:06.238Z",
      "references": [
        {
          "source_name": "WithSecure Kapeka 2024",
          "url": "https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Research-Kapeka.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e842c832-8e3a-487c-bdde-e1614fec6c7e",
      "subject": "ATTACK:enterprise:S0581",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e842c832-8e3a-487c-bdde-e1614fec6c7e",
      "modified": "2026-04-29T14:23:06.241Z",
      "references": [
        {
          "source_name": "Unit 42 IronNetInjector February 2021 ",
          "url": "https://unit42.paloaltonetworks.com/ironnetinjector/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e884b379-a4bb-409f-b1cd-cb4438bd23de",
      "subject": "ATTACK:enterprise:S1245",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e884b379-a4bb-409f-b1cd-cb4438bd23de",
      "modified": "2026-04-29T14:23:06.242Z",
      "references": [
        {
          "source_name": "Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024",
          "url": "https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"
        },
        {
          "source_name": "ESET Contagious Interview BeaverTail InvisibleFerret February 2025",
          "url": "https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"
        },
        {
          "source_name": "PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023",
          "url": "https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e922f65f-67ea-4df9-8b88-463d89b9120b",
      "subject": "ATTACK:enterprise:S0266",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e922f65f-67ea-4df9-8b88-463d89b9120b",
      "modified": "2026-04-29T14:23:06.242Z",
      "references": [
        {
          "source_name": "S2 Grupo TrickBot June 2017",
          "url": "https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e95155fd-7532-4848-881b-c4f1000c3675",
      "subject": "ATTACK:enterprise:S1113",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e95155fd-7532-4848-881b-c4f1000c3675",
      "modified": "2026-04-29T14:23:06.243Z",
      "references": [
        {
          "source_name": "Mandiant Pulse Secure Update May 2021",
          "url": "https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ed824ba0-c929-4766-942b-8c2307007cbe",
      "subject": "ATTACK:enterprise:S9036",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ed824ba0-c929-4766-942b-8c2307007cbe",
      "modified": "2026-04-29T14:23:06.248Z",
      "references": [
        {
          "source_name": "ESET_MuddyWater_Dec2025",
          "url": "https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ee7a5648-6263-4f1c-a975-e0d36740944a",
      "subject": "ATTACK:enterprise:S0022",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ee7a5648-6263-4f1c-a975-e0d36740944a",
      "modified": "2026-04-29T14:23:06.250Z",
      "references": [
        {
          "source_name": "Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023",
          "url": "https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f0df2494-6465-4bd1-9a57-7d93666bba4c",
      "subject": "ATTACK:enterprise:M1040",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f0df2494-6465-4bd1-9a57-7d93666bba4c",
      "modified": "2026-04-29T14:23:06.253Z",
      "references": [
        {
          "source_name": "Obfuscated scripts",
          "url": "https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#block-execution-of-potentially-obfuscated-scripts"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f106c0c2-b83c-44b2-ab93-161e325f6a42",
      "subject": "ATTACK:enterprise:S1044",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f106c0c2-b83c-44b2-ab93-161e325f6a42",
      "modified": "2026-04-29T14:23:06.253Z",
      "references": [
        {
          "source_name": "Bitdefender FunnyDream Campaign November 2020",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f85073cb-7f45-4145-8923-58450af3451f",
      "subject": "ATTACK:enterprise:S0013",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f85073cb-7f45-4145-8923-58450af3451f",
      "modified": "2026-04-29T14:23:06.262Z",
      "references": [
        {
          "source_name": "Eset PlugX Korplug Mustang Panda March 2022",
          "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f9a34eaa-c17c-400a-b4e0-063445e430af",
      "subject": "ATTACK:enterprise:S0347",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f9a34eaa-c17c-400a-b4e0-063445e430af",
      "modified": "2026-04-29T14:23:06.264Z",
      "references": [
        {
          "source_name": "TrendMicro Lazarus Nov 2018",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-continues-heists-mounts-attacks-on-financial-organizations-in-latin-america/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fa211b49-7df8-4283-8a70-78b4b81bbba9",
      "subject": "ATTACK:enterprise:S0587",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fa211b49-7df8-4283-8a70-78b4b81bbba9",
      "modified": "2026-04-29T14:23:06.265Z",
      "references": [
        {
          "source_name": "Leonardo Turla Penquin May 2020",
          "url": "https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fa83b0ea-65b1-44da-9229-542efc06a3ae",
      "subject": "ATTACK:enterprise:S9019",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fa83b0ea-65b1-44da-9229-542efc06a3ae",
      "modified": "2026-04-29T14:23:06.265Z",
      "references": [
        {
          "source_name": "Check Point Blind Eagle MAR 2025",
          "url": "https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"
        },
        {
          "source_name": "Zscaler PureCrypter JUN 2022",
          "url": "https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--faa996f9-3d60-455f-ab31-50687113f24e",
      "subject": "ATTACK:enterprise:G1036",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--faa996f9-3d60-455f-ab31-50687113f24e",
      "modified": "2026-07-31T18:48:25.138Z",
      "references": [
        {
          "source_name": "Microsoft Moonstone Sleet 2024",
          "url": "https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fba908dc-4478-4626-ab73-72c43eca5279",
      "subject": "ATTACK:enterprise:S0342",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fba908dc-4478-4626-ab73-72c43eca5279",
      "modified": "2026-04-29T14:23:06.266Z",
      "references": [
        {
          "source_name": "ESET GreyEnergy Oct 2018",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fd37b358-d005-4662-a200-771f89d491f4",
      "subject": "ATTACK:enterprise:S0462",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fd37b358-d005-4662-a200-771f89d491f4",
      "modified": "2026-04-29T14:23:06.269Z",
      "references": [
        {
          "source_name": "Unit 42 CARROTBAT November 2018",
          "url": "https://unit42.paloaltonetworks.com/unit42-the-fractured-block-campaign-carrotbat-malware-used-to-deliver-malware-targeting-southeast-asia/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fee82671-3bba-48c7-bef8-63b2b2bb0fa7",
      "subject": "ATTACK:enterprise:S0230",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fee82671-3bba-48c7-bef8-63b2b2bb0fa7",
      "modified": "2026-04-29T14:23:06.271Z",
      "references": [
        {
          "source_name": "Proofpoint ZeroT Feb 2017",
          "url": "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ff950ea2-2982-4bfd-8361-7755e83778fd",
      "subject": "ATTACK:enterprise:S0348",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ff950ea2-2982-4bfd-8361-7755e83778fd",
      "modified": "2026-04-29T14:23:06.272Z",
      "references": [
        {
          "source_name": "PaloAlto CardinalRat Apr 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    }
  ],
  "source_snapshot": {
    "file": "enterprise-attack-20.0.json",
    "url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
    "sha256": "81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352",
    "bytes": 55271014,
    "checked_at": "2026-10-16T03:31:39Z"
  },
  "notices_url": "https://aol.pm/source-notices.txt",
  "notices": "License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"
}

License
-------
The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,
development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce
MITRE's copyright designation and this license in any such copy.

"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation."

Disclaimers
-----------
MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part
of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover
full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or
variations on existing techniques not documented by ATT&CK.

ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE
ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,
AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT
THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR
FITNESS FOR A PARTICULAR PURPOSE.