Source assertions are not new attribution claims. No sole inventor or transitive actor-CVE inference.
{
  "record": {
    "id": "ATTACK:enterprise:T1033",
    "title": "System Owner/User Discovery",
    "type": "Technique",
    "source_url": "https://attack.mitre.org/techniques/T1033",
    "snapshot": "enterprise-attack-20.0.json",
    "status": "active",
    "rights": "Source metadata only; source notices retained; no operational prose or payloads",
    "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
    "stix_id": "attack-pattern--03d7999c-1f4c-42cc-8373-e7690d318104",
    "external_id": "T1033",
    "domain": "enterprise",
    "created": "2017-05-31T21:30:35.733Z",
    "modified": "2026-05-12T15:12:00.620Z",
    "version": "1.6",
    "aliases": [

    ],
    "tactics": [
      "discovery"
    ],
    "source_references": [
      {
        "source_name": "show_ssh_users_cmd_cisco",
        "url": "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/sec-s1-cr-book/sec-cr-s5.html"
      },
      {
        "source_name": "US-CERT TA18-106A Network Infrastructure Devices 2018",
        "url": "https://us-cert.cisa.gov/ncas/alerts/TA18-106A"
      }
    ]
  },
  "assertions": [
    {
      "id": "enterprise:relationship--00ce5c68-cb85-46d1-a6ba-7b2b767b0f09",
      "subject": "ATTACK:enterprise:S0094",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--00ce5c68-cb85-46d1-a6ba-7b2b767b0f09",
      "modified": "2026-04-29T14:23:05.904Z",
      "references": [
        {
          "source_name": "Secureworks Karagany July 2019",
          "url": "https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--00e25bca-7df1-464e-94a4-cc13124e1d0c",
      "subject": "ATTACK:enterprise:S0428",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--00e25bca-7df1-464e-94a4-cc13124e1d0c",
      "modified": "2026-04-29T14:23:05.904Z",
      "references": [
        {
          "source_name": "Talos PoetRAT April 2020",
          "url": "https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--01c6d850-03c2-4ed0-ba1d-cf2cc9062106",
      "subject": "ATTACK:enterprise:S0379",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--01c6d850-03c2-4ed0-ba1d-cf2cc9062106",
      "modified": "2026-04-29T14:23:05.905Z",
      "references": [
        {
          "source_name": "Cylance Shaheen Nov 2018",
          "url": "https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--022ba33a-16f4-40de-b0b2-4961870aa0c9",
      "subject": "ATTACK:enterprise:S0694",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--022ba33a-16f4-40de-b0b2-4961870aa0c9",
      "modified": "2026-04-29T14:23:05.906Z",
      "references": [
        {
          "source_name": "ClearSky Lazarus Aug 2020",
          "url": "https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--03251067-ee3a-49e4-addc-86daaa8a3203",
      "subject": "ATTACK:enterprise:S0266",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--03251067-ee3a-49e4-addc-86daaa8a3203",
      "modified": "2026-04-29T14:23:05.907Z",
      "references": [
        {
          "source_name": "Cyberreason Anchor December 2019",
          "url": "https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--042001af-58f0-43c9-8747-5a0d0f7906f5",
      "subject": "ATTACK:enterprise:S0596",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--042001af-58f0-43c9-8747-5a0d0f7906f5",
      "modified": "2026-04-29T14:23:05.909Z",
      "references": [
        {
          "source_name": "Kaspersky ShadowPad Aug 2017",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--044576aa-2ec0-4f88-9cb9-ec6817dda514",
      "subject": "ATTACK:enterprise:S1030",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--044576aa-2ec0-4f88-9cb9-ec6817dda514",
      "modified": "2026-04-29T14:23:05.909Z",
      "references": [
        {
          "source_name": "ZScaler Squirrelwaffle Sep 2021",
          "url": "https://www.zscaler.com/blogs/security-research/squirrelwaffle-new-loader-delivering-cobalt-strike"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--05e02170-dc4f-4112-a54c-fde4d05632d7",
      "subject": "ATTACK:enterprise:S0367",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--05e02170-dc4f-4112-a54c-fde4d05632d7",
      "modified": "2026-04-29T14:23:05.911Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0624c9a4-4c9f-448c-99f0-c22a99480158",
      "subject": "ATTACK:enterprise:S9053",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0624c9a4-4c9f-448c-99f0-c22a99480158",
      "modified": "2026-09-24T22:24:20.421Z",
      "references": [
        {
          "source_name": "CheckPoint_NimbusManticoreEurope_Sept2025",
          "url": "https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--064cfeb5-9ddb-4dd2-ada4-cf9e65601dc5",
      "subject": "ATTACK:enterprise:G0082",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--064cfeb5-9ddb-4dd2-ada4-cf9e65601dc5",
      "modified": "2026-09-30T20:05:01.133Z",
      "references": [
        {
          "source_name": "CISA AA20-239A BeagleBoyz August 2020",
          "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-239a"
        },
        {
          "source_name": "Microsoft Sapphire Sleet APR 2026",
          "url": "https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"
        },
        {
          "source_name": "MIcrosoft Mastra npm Compromise JUN 2026",
          "url": "https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--06711c3f-230b-4d44-9c88-4861c48d2716",
      "subject": "ATTACK:enterprise:S0590",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--06711c3f-230b-4d44-9c88-4861c48d2716",
      "modified": "2026-04-29T14:23:05.912Z",
      "references": [
        {
          "source_name": "Debian nbtscan Nov 2019",
          "url": "https://manpages.debian.org/testing/nbtscan/nbtscan.1.en.html"
        },
        {
          "source_name": "SecTools nbtscan June 2003",
          "url": "https://sectools.org/tool/nbtscan/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--06ef19c1-8490-42cc-b345-45f3aa29fc5f",
      "subject": "ATTACK:enterprise:S0272",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--06ef19c1-8490-42cc-b345-45f3aa29fc5f",
      "modified": "2026-04-29T14:23:05.913Z",
      "references": [
        {
          "source_name": "TrendMicro Patchwork Dec 2017",
          "url": "https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--09b8bc73-f318-4ff8-a7f1-2c1649df1186",
      "subject": "ATTACK:enterprise:S1226",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--09b8bc73-f318-4ff8-a7f1-2c1649df1186",
      "modified": "2026-04-29T14:23:05.917Z",
      "references": [
        {
          "source_name": "Unit42 Bookworm Nov2015",
          "url": "https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--09fbfb74-459a-441b-9e07-96c146a26be3",
      "subject": "ATTACK:enterprise:S0414",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--09fbfb74-459a-441b-9e07-96c146a26be3",
      "modified": "2026-04-29T14:23:05.917Z",
      "references": [
        {
          "source_name": "Unit42 BabyShark Feb 2019",
          "url": "https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0b126adc-3173-4751-978f-96b72913a346",
      "subject": "ATTACK:enterprise:S0514",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0b126adc-3173-4751-978f-96b72913a346",
      "modified": "2026-04-29T14:23:05.918Z",
      "references": [
        {
          "source_name": "CISA WellMess July 2020",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198b"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0b5338ac-c1ca-4296-b06c-44d3730c8557",
      "subject": "ATTACK:enterprise:G1036",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0b5338ac-c1ca-4296-b06c-44d3730c8557",
      "modified": "2026-07-31T18:48:24.735Z",
      "references": [
        {
          "source_name": "Microsoft Moonstone Sleet 2024",
          "url": "https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0bf4ebc1-e4e4-4d56-8380-cb9601de353f",
      "subject": "ATTACK:enterprise:S1016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0bf4ebc1-e4e4-4d56-8380-cb9601de353f",
      "modified": "2026-04-29T14:23:05.919Z",
      "references": [
        {
          "source_name": "ESET DazzleSpy Jan 2022",
          "url": "https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0daaaf08-6db8-4b57-8ba7-ff1cc32127b3",
      "subject": "ATTACK:enterprise:S9037",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0daaaf08-6db8-4b57-8ba7-ff1cc32127b3",
      "modified": "2026-04-29T14:23:05.922Z",
      "references": [
        {
          "source_name": "CloudSEK_RustyWater_Jan2026",
          "url": "https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0df8e968-716a-4de9-9669-862af62d6eb6",
      "subject": "ATTACK:enterprise:S0058",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0df8e968-716a-4de9-9669-862af62d6eb6",
      "modified": "2026-04-29T14:23:05.922Z",
      "references": [
        {
          "source_name": "Baumgartner Naikon 2015",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0e6418d5-a827-4a88-adb2-af4f26b4502b",
      "subject": "ATTACK:enterprise:S9063",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0e6418d5-a827-4a88-adb2-af4f26b4502b",
      "modified": "2026-10-01T18:22:11.464Z",
      "references": [
        {
          "source_name": "Mandiant_UNC1549_Nov2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0efb0490-9935-4d51-8b2f-974e090bbc10",
      "subject": "ATTACK:enterprise:S0657",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0efb0490-9935-4d51-8b2f-974e090bbc10",
      "modified": "2026-04-29T14:23:05.924Z",
      "references": [
        {
          "source_name": "Volexity InkySquid BLUELIGHT August 2021",
          "url": "https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--118542b5-248a-475d-9eae-78efa872b399",
      "subject": "ATTACK:enterprise:S1146",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--118542b5-248a-475d-9eae-78efa872b399",
      "modified": "2026-04-29T14:23:05.928Z",
      "references": [
        {
          "source_name": "Symantec Daggerfly 2023",
          "url": "https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1218d239-d7ee-44ba-a88d-6b76cb16324e",
      "subject": "ATTACK:enterprise:S1034",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1218d239-d7ee-44ba-a88d-6b76cb16324e",
      "modified": "2026-04-29T14:23:05.929Z",
      "references": [
        {
          "source_name": "Cybereason StrifeWater Feb 2022",
          "url": "https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--128eeb8d-c492-4dbf-a423-0b68a4b53443",
      "subject": "ATTACK:enterprise:S1039",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--128eeb8d-c492-4dbf-a423-0b68a4b53443",
      "modified": "2026-04-29T14:23:05.929Z",
      "references": [
        {
          "source_name": "Google EXOTIC LILY March 2022",
          "url": "https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--12e8b4b1-e6b4-4ced-b171-e9e2fb881e7b",
      "subject": "ATTACK:enterprise:C0058",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--12e8b4b1-e6b4-4ced-b171-e9e2fb881e7b",
      "modified": "2026-07-31T18:47:17.937Z",
      "references": [
        {
          "source_name": "SentinelOne ToolShell JUL 2025",
          "url": "https://www.sentinelone.com/blog/sharepoint-toolshell-zero-day-exploited-in-the-wild-targets-enterprise-servers/"
        },
        {
          "source_name": "Microsoft SharePoint Exploit JUL 2025",
          "url": "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/#storm-2603"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1336d5a0-f7b3-4d5c-a89b-afdbf1b5e3a8",
      "subject": "ATTACK:enterprise:S1153",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1336d5a0-f7b3-4d5c-a89b-afdbf1b5e3a8",
      "modified": "2026-04-29T14:23:05.930Z",
      "references": [
        {
          "source_name": "Kandji Cuckoo April 2024",
          "url": "https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--143dbc8a-0b00-4510-aacf-96437d87ea2b",
      "subject": "ATTACK:enterprise:S0024",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--143dbc8a-0b00-4510-aacf-96437d87ea2b",
      "modified": "2026-04-29T14:23:05.931Z",
      "references": [
        {
          "source_name": "Malwarebytes Dyreza November 2015",
          "url": "https://blog.malwarebytes.com/threat-analysis/2015/11/a-technical-look-at-dyreza/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--147cd553-fd25-46ea-83ed-594cdb82c440",
      "subject": "ATTACK:enterprise:S1065",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--147cd553-fd25-46ea-83ed-594cdb82c440",
      "modified": "2026-04-29T14:23:05.932Z",
      "references": [
        {
          "source_name": "MalwareBytes WoodyRAT Aug 2022",
          "url": "https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--14e02371-ba11-459d-9662-188e85d3cf7c",
      "subject": "ATTACK:enterprise:S0659",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--14e02371-ba11-459d-9662-188e85d3cf7c",
      "modified": "2026-04-29T14:23:05.933Z",
      "references": [
        {
          "source_name": "Fortinet Diavol July 2021",
          "url": "https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1547f28f-d6b7-43cc-8b89-0eaa524648b8",
      "subject": "ATTACK:enterprise:S0091",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1547f28f-d6b7-43cc-8b89-0eaa524648b8",
      "modified": "2026-04-29T14:23:05.933Z",
      "references": [
        {
          "source_name": "Kaspersky Turla Aug 2014",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08080105/KL_Epic_Turla_Technical_Appendix_20140806.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1567eaca-2b2e-44df-b447-87769738e00a",
      "subject": "ATTACK:enterprise:S0223",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1567eaca-2b2e-44df-b447-87769738e00a",
      "modified": "2026-04-29T14:23:05.933Z",
      "references": [
        {
          "source_name": "TrendMicro POWERSTATS V3 June 2019",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--17bace22-3930-4b7e-9fd1-1473da5496ff",
      "subject": "ATTACK:enterprise:G0061",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--17bace22-3930-4b7e-9fd1-1473da5496ff",
      "modified": "2026-07-31T18:48:29.342Z",
      "references": [
        {
          "source_name": "Symantec FIN8 Jul 2023",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--17bc166c-7598-4297-9cc1-1ee9ef4182a2",
      "subject": "ATTACK:enterprise:S0085",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--17bc166c-7598-4297-9cc1-1ee9ef4182a2",
      "modified": "2026-04-29T14:23:05.937Z",
      "references": [
        {
          "source_name": "Cylance Dust Storm",
          "url": "https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--17c50546-6ffb-462e-b4ec-2d7cd0b00f55",
      "subject": "ATTACK:enterprise:S0652",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--17c50546-6ffb-462e-b4ec-2d7cd0b00f55",
      "modified": "2026-04-29T14:23:05.937Z",
      "references": [
        {
          "source_name": "Kaspersky Ferocious Kitten Jun 2021",
          "url": "https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--199c92d9-dd54-4cb1-beef-3b6a97d12e82",
      "subject": "ATTACK:enterprise:G0004",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--199c92d9-dd54-4cb1-beef-3b6a97d12e82",
      "modified": "2026-07-31T18:48:00.457Z",
      "references": [
        {
          "source_name": "Microsoft NICKEL December 2021",
          "url": "https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--19ff1c1a-cd11-454f-b905-16657eb866d6",
      "subject": "ATTACK:enterprise:S1229",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--19ff1c1a-cd11-454f-b905-16657eb866d6",
      "modified": "2026-04-29T14:23:05.940Z",
      "references": [
        {
          "source_name": "Zscaler Havoc FEB 2023",
          "url": "https://www.zscaler.com/blogs/security-research/havoc-across-cyberspace"
        },
        {
          "source_name": "Fortinet Havoc MAR 2025",
          "url": "https://www.fortinet.com/blog/threat-research/havoc-sharepoint-with-microsoft-graph-api-turns-into-fud-c2"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1c360b2c-8004-4978-ba70-b0bb2257a791",
      "subject": "ATTACK:enterprise:S0256",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1c360b2c-8004-4978-ba70-b0bb2257a791",
      "modified": "2026-04-29T14:23:05.943Z",
      "references": [
        {
          "source_name": "ESET Turla Mosquito Jan 2018",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1d3296a5-9a15-4bd9-a294-ee014348136c",
      "subject": "ATTACK:enterprise:S0130",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1d3296a5-9a15-4bd9-a294-ee014348136c",
      "modified": "2026-04-29T14:23:05.944Z",
      "references": [
        {
          "source_name": "Forcepoint Monsoon",
          "url": "https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1d82c2f3-0bca-49a0-b731-296a436eb003",
      "subject": "ATTACK:enterprise:S0344",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1d82c2f3-0bca-49a0-b731-296a436eb003",
      "modified": "2026-04-29T14:23:05.945Z",
      "references": [
        {
          "source_name": "Unit42 Azorult Nov 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/11/unit42-new-wine-old-bottle-new-azorult-variant-found-findmyname-campaign-using-fallout-exploit-kit/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1deaad9b-3a33-421b-b13b-6dcad02707cf",
      "subject": "ATTACK:enterprise:S1148",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1deaad9b-3a33-421b-b13b-6dcad02707cf",
      "modified": "2026-04-29T14:23:05.945Z",
      "references": [
        {
          "source_name": "Sekoia Raccoon2 2022",
          "url": "https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis/"
        },
        {
          "source_name": "Sekoia Raccoon1 2022",
          "url": "https://blog.sekoia.io/raccoon-stealer-v2-part-1-the-return-of-the-dead/"
        },
        {
          "source_name": "S2W Racoon 2022",
          "url": "https://medium.com/s2wblog/raccoon-stealer-is-back-with-a-new-version-5f436e04b20d"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1dfbbbe3-c04d-4ad6-98bf-15a9cd84ab06",
      "subject": "ATTACK:enterprise:S1059",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1dfbbbe3-c04d-4ad6-98bf-15a9cd84ab06",
      "modified": "2026-04-29T14:23:05.945Z",
      "references": [
        {
          "source_name": "SentinelLabs Metador Technical Appendix Sept 2022",
          "url": "https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1f548074-df9e-4029-842b-7d774e2f1093",
      "subject": "ATTACK:enterprise:G0046",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1f548074-df9e-4029-842b-7d774e2f1093",
      "modified": "2026-07-31T20:48:31.743Z",
      "references": [
        {
          "source_name": "Mandiant FIN7 Apr 2022",
          "url": "https://www.mandiant.com/resources/evolution-of-fin7"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1f5efc33-a643-4f9b-aae9-6c59208ff790",
      "subject": "ATTACK:enterprise:S1029",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1f5efc33-a643-4f9b-aae9-6c59208ff790",
      "modified": "2026-04-29T14:23:05.947Z",
      "references": [
        {
          "source_name": "MalwareBytes SideCopy Dec 2021",
          "url": "https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1ffb7c73-5c51-48a3-85a0-b64111cccdd1",
      "subject": "ATTACK:enterprise:G0125",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1ffb7c73-5c51-48a3-85a0-b64111cccdd1",
      "modified": "2026-07-31T18:47:44.164Z",
      "references": [
        {
          "source_name": "Rapid7 HAFNIUM Mar 2021",
          "url": "https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--208b9e1d-3de9-4de8-b8d4-e3a7ff3c72ec",
      "subject": "ATTACK:enterprise:C0017",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--208b9e1d-3de9-4de8-b8d4-e3a7ff3c72ec",
      "modified": "2026-07-31T21:12:30.968Z",
      "references": [
        {
          "source_name": "Mandiant APT41",
          "url": "https://www.mandiant.com/resources/apt41-us-state-governments"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--20b43c4b-c97d-4f5f-a004-07f38a9851e1",
      "subject": "ATTACK:enterprise:S9062",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--20b43c4b-c97d-4f5f-a004-07f38a9851e1",
      "modified": "2026-10-01T13:47:57.348Z",
      "references": [
        {
          "source_name": "CheckPoint_NimbusManticoreEurope_Sept2025",
          "url": "https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--22e70d45-8ca7-4a05-a22a-ffd5ffdd5f61",
      "subject": "ATTACK:enterprise:S1228",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--22e70d45-8ca7-4a05-a22a-ffd5ffdd5f61",
      "modified": "2026-04-29T14:23:05.952Z",
      "references": [
        {
          "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
          "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
        },
        {
          "source_name": "CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024",
          "url": "https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"
        },
        {
          "source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA",
          "url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"
        },
        {
          "source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload",
          "url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--23f656c7-600f-46a7-8185-0edf45299bac",
      "subject": "ATTACK:enterprise:S0401",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--23f656c7-600f-46a7-8185-0edf45299bac",
      "modified": "2026-04-29T14:23:05.954Z",
      "references": [
        {
          "source_name": "ANSSI Sandworm January 2021",
          "url": "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--242af6ac-a8f9-44fd-ae3f-edd975b37b4c",
      "subject": "ATTACK:enterprise:S1240",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--242af6ac-a8f9-44fd-ae3f-edd975b37b4c",
      "modified": "2026-04-29T14:23:05.955Z",
      "references": [
        {
          "source_name": "Proofpoint RedLine Stealer March 2020",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/new-redline-stealer-distributed-using-coronavirus-themed-email-campaign"
        },
        {
          "source_name": "Splunk RedLine Stealer June 2023",
          "url": "https://www.splunk.com/en_us/blog/security/do-not-cross-the-redline-stealer-detections-and-analysis.html"
        },
        {
          "source_name": "Veriti RedLine Stealer MAAS April 2023",
          "url": "https://veriti.ai/blog/veriti-research/from-chatgpt-to-redline-stealer-the-dark-side-of-openai-and-google-bard/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--24e3810a-7d05-4ccc-9326-80a5ac72cd55",
      "subject": "ATTACK:enterprise:S9035",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--24e3810a-7d05-4ccc-9326-80a5ac72cd55",
      "modified": "2026-04-29T14:23:05.956Z",
      "references": [
        {
          "source_name": "Splunk LAMEHUG SEP 2025",
          "url": "https://www.splunk.com/en_us/blog/security/lamehug-ai-driven-malware-llm-cyber-intrusion-analysis.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--25b8811b-3e73-40c7-b1fc-132eeb5a6f5e",
      "subject": "ATTACK:enterprise:S0663",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--25b8811b-3e73-40c7-b1fc-132eeb5a6f5e",
      "modified": "2026-04-29T14:23:05.956Z",
      "references": [
        {
          "source_name": "Lunghi Iron Tiger Linux",
          "url": "https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--284843c3-18d0-4ddb-aab5-4588a6ec400e",
      "subject": "ATTACK:enterprise:G1035",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--284843c3-18d0-4ddb-aab5-4588a6ec400e",
      "modified": "2026-07-31T18:48:03.072Z",
      "references": [
        {
          "source_name": "SentinelOne WinterVivern 2023",
          "url": "https://www.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espionage/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--28ffc627-936b-4572-93f6-0c46cb361dda",
      "subject": "ATTACK:enterprise:S0241",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--28ffc627-936b-4572-93f6-0c46cb361dda",
      "modified": "2026-04-29T14:23:05.961Z",
      "references": [
        {
          "source_name": "RATANKBA",
          "url": "https://www.trendmicro.com/en_us/research/17/b/ratankba-watering-holes-against-enterprises.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2b8418de-6474-49e2-84f0-01ffe6c07a42",
      "subject": "ATTACK:enterprise:S0381",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2b8418de-6474-49e2-84f0-01ffe6c07a42",
      "modified": "2026-04-29T14:23:05.964Z",
      "references": [
        {
          "source_name": "Korean FSI TA505 2020",
          "url": "https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="
        },
        {
          "source_name": "Proofpoint TA505 Mar 2018",
          "url": "https://www.proofpoint.com/us/threat-insight/post/leaked-ammyy-admin-source-code-turned-malware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2d5c711d-dcd6-4d50-b91f-1fda5311eef5",
      "subject": "ATTACK:enterprise:S0448",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2d5c711d-dcd6-4d50-b91f-1fda5311eef5",
      "modified": "2026-04-29T14:23:05.966Z",
      "references": [
        {
          "source_name": "McAfee Sharpshooter December 2018",
          "url": "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2ed969c0-be8f-43d1-8226-1009faefaa20",
      "subject": "ATTACK:enterprise:S0275",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2ed969c0-be8f-43d1-8226-1009faefaa20",
      "modified": "2026-04-29T14:23:05.968Z",
      "references": [
        {
          "source_name": "FireEye APT10 Sept 2018",
          "url": "https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2f8d5603-0876-41dd-9fdb-ca9dc0ad6253",
      "subject": "ATTACK:enterprise:S0219",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2f8d5603-0876-41dd-9fdb-ca9dc0ad6253",
      "modified": "2026-04-29T14:23:05.972Z",
      "references": [
        {
          "source_name": "FireEye APT37 Feb 2018",
          "url": "https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2fd0ebb0-6086-441d-b83c-e73e3f8ed69a",
      "subject": "ATTACK:enterprise:S1160",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2fd0ebb0-6086-441d-b83c-e73e3f8ed69a",
      "modified": "2026-04-29T14:23:05.975Z",
      "references": [
        {
          "source_name": "Elastic Latrodectus May 2024",
          "url": "https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2fededb7-e713-495c-a317-919c037434a8",
      "subject": "ATTACK:enterprise:S0242",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2fededb7-e713-495c-a317-919c037434a8",
      "modified": "2026-04-29T14:23:05.975Z",
      "references": [
        {
          "source_name": "SecureList SynAck Doppelgänging May 2018",
          "url": "https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--31cd4eb1-f7b3-4030-b087-388d55faba03",
      "subject": "ATTACK:enterprise:S0161",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--31cd4eb1-f7b3-4030-b087-388d55faba03",
      "modified": "2026-04-29T14:23:05.982Z",
      "references": [
        {
          "source_name": "XAgentOSX 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--32218bd0-d598-4560-9a70-ab7d5c92f986",
      "subject": "ATTACK:enterprise:S0155",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--32218bd0-d598-4560-9a70-ab7d5c92f986",
      "modified": "2026-04-29T14:23:05.983Z",
      "references": [
        {
          "source_name": "FireEye APT32 May 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3298bf92-55a2-49eb-aa5e-0530e8a51eeb",
      "subject": "ATTACK:enterprise:S0250",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3298bf92-55a2-49eb-aa5e-0530e8a51eeb",
      "modified": "2026-04-29T14:23:05.985Z",
      "references": [
        {
          "source_name": "MalwareBytes LazyScripter Feb 2021",
          "url": "https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"
        },
        {
          "source_name": "Github Koadic",
          "url": "https://github.com/offsecginger/koadic"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--32a62862-3dc9-4082-8570-d01abe25e00b",
      "subject": "ATTACK:enterprise:S0680",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--32a62862-3dc9-4082-8570-d01abe25e00b",
      "modified": "2026-04-29T14:23:05.985Z",
      "references": [
        {
          "source_name": "Kaspersky WIRTE November 2021",
          "url": "https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--331ebf73-af72-4121-815a-d10392ac75ab",
      "subject": "ATTACK:enterprise:G0073",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--331ebf73-af72-4121-815a-d10392ac75ab",
      "modified": "2026-07-31T18:48:30.756Z",
      "references": [
        {
          "source_name": "Unit 42 C0d0so0 Jan 2016",
          "url": "https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--348f9f2e-c959-4485-9a0b-e95f6d4ceb72",
      "subject": "ATTACK:enterprise:S0340",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--348f9f2e-c959-4485-9a0b-e95f6d4ceb72",
      "modified": "2026-04-29T14:23:05.989Z",
      "references": [
        {
          "source_name": "Securelist Octopus Oct 2018",
          "url": "https://securelist.com/octopus-infested-seas-of-central-asia/88200/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--36c4252b-fc24-467e-b56b-56ba29bb4026",
      "subject": "ATTACK:enterprise:S0610",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--36c4252b-fc24-467e-b56b-56ba29bb4026",
      "modified": "2026-04-29T14:23:05.995Z",
      "references": [
        {
          "source_name": "Check Point APT34 April 2021",
          "url": "https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--375f92a4-13b2-4640-b192-c34eb2b91c9c",
      "subject": "ATTACK:enterprise:S0374",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--375f92a4-13b2-4640-b192-c34eb2b91c9c",
      "modified": "2026-04-29T14:23:05.995Z",
      "references": [
        {
          "source_name": "CheckPoint SpeakUp Feb 2019",
          "url": "https://research.checkpoint.com/speakup-a-new-undetected-backdoor-linux-trojan/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--38f5765d-0e42-4e63-9411-185983c6ca21",
      "subject": "ATTACK:enterprise:S0632",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--38f5765d-0e42-4e63-9411-185983c6ca21",
      "modified": "2026-04-29T14:23:05.998Z",
      "references": [
        {
          "source_name": "Group IB GrimAgent July 2021",
          "url": "https://www.group-ib.com/blog/grimagent/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--395fbd2c-7827-49b3-8121-72d54181f0b1",
      "subject": "ATTACK:enterprise:S0348",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--395fbd2c-7827-49b3-8121-72d54181f0b1",
      "modified": "2026-04-29T14:23:05.999Z",
      "references": [
        {
          "source_name": "PaloAlto CardinalRat Apr 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--39e6a7c0-5eb8-49fe-aec7-9ae9fe70723a",
      "subject": "ATTACK:enterprise:S0192",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--39e6a7c0-5eb8-49fe-aec7-9ae9fe70723a",
      "modified": "2026-04-29T14:23:05.999Z",
      "references": [
        {
          "source_name": "GitHub Pupy",
          "url": "https://github.com/n1nj4sec/pupy"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3ccef052-7ac9-47b1-9be6-8c140f279941",
      "subject": "ATTACK:enterprise:S0447",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3ccef052-7ac9-47b1-9be6-8c140f279941",
      "modified": "2026-04-29T14:23:06.008Z",
      "references": [
        {
          "source_name": "FSecure Lokibot November 2019",
          "url": "https://www.f-secure.com/v-descs/trojan_w32_lokibot.shtml"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3cef14da-0d49-4ee4-920b-ce3a0ddeccc7",
      "subject": "ATTACK:enterprise:S9029",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3cef14da-0d49-4ee4-920b-ce3a0ddeccc7",
      "modified": "2026-04-29T14:23:06.008Z",
      "references": [
        {
          "source_name": "Check Point Wirte NOV 2024",
          "url": "https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3d602fec-cf94-4aa4-a4d9-cad286e6881f",
      "subject": "ATTACK:enterprise:G0051",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3d602fec-cf94-4aa4-a4d9-cad286e6881f",
      "modified": "2026-07-31T18:48:28.702Z",
      "references": [
        {
          "source_name": "FireEye FIN10 June 2017",
          "url": "https://services.google.com/fh/files/misc/rpt-fin-10-anatomy-of-a-cyber-en.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3e370a6e-2a3c-4e56-aa57-fecab8d09709",
      "subject": "ATTACK:enterprise:S0331",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3e370a6e-2a3c-4e56-aa57-fecab8d09709",
      "modified": "2026-04-29T14:23:06.010Z",
      "references": [
        {
          "source_name": "DigiTrust Agent Tesla Jan 2017",
          "url": "https://www.digitrustgroup.com/agent-tesla-keylogger/"
        },
        {
          "source_name": "Fortinet Agent Tesla April 2018",
          "url": "https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html"
        },
        {
          "source_name": "Malwarebytes Agent Tesla April 2020",
          "url": "https://blog.malwarebytes.com/threat-analysis/2020/04/new-agenttesla-variant-steals-wifi-credentials/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3ef224b5-2edf-41c1-916f-1d80a7dc4ada",
      "subject": "ATTACK:enterprise:S0459",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3ef224b5-2edf-41c1-916f-1d80a7dc4ada",
      "modified": "2026-04-29T14:23:06.011Z",
      "references": [
        {
          "source_name": "Unit 42 MechaFlounder March 2019",
          "url": "https://unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--40032198-f003-4171-92a0-faf038f62a0b",
      "subject": "ATTACK:enterprise:G0050",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--40032198-f003-4171-92a0-faf038f62a0b",
      "modified": "2026-07-31T18:47:44.211Z",
      "references": [
        {
          "source_name": "FireEye APT32 April 2020",
          "url": "https://www.fireeye.com/blog/threat-research/2020/04/apt32-targeting-chinese-government-in-covid-19-related-espionage.html"
        },
        {
          "source_name": "ESET OceanLotus",
          "url": "https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/"
        },
        {
          "source_name": "Cybereason Cobalt Kitty 2017",
          "url": "https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--412c7c8b-4821-4f08-a3d2-2da034f8343f",
      "subject": "ATTACK:enterprise:S0356",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--412c7c8b-4821-4f08-a3d2-2da034f8343f",
      "modified": "2026-04-29T14:23:06.014Z",
      "references": [
        {
          "source_name": "Talos Konni May 2017",
          "url": "https://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--415d2462-fe5c-44b1-9ffb-62b51c51b8e0",
      "subject": "ATTACK:enterprise:S9046",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--415d2462-fe5c-44b1-9ffb-62b51c51b8e0",
      "modified": "2026-10-08T22:18:38.340Z",
      "references": [
        {
          "source_name": "Claroty-IOCONTROL",
          "url": "https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol"
        },
        {
          "source_name": "Armis-IOCONTROL",
          "url": "https://www.armis.com/blog/iocontrol-malware-whats-new-whats-not/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--41634cea-6236-4013-bda3-345bcba4f40f",
      "subject": "ATTACK:enterprise:S0249",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--41634cea-6236-4013-bda3-345bcba4f40f",
      "modified": "2026-04-29T14:23:06.014Z",
      "references": [
        {
          "source_name": "McAfee Gold Dragon",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--41c81917-ca17-4d7f-abdd-dcd408ad230d",
      "subject": "ATTACK:enterprise:C0014",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--41c81917-ca17-4d7f-abdd-dcd408ad230d",
      "modified": "2026-07-31T18:47:31.533Z",
      "references": [
        {
          "source_name": "FoxIT Wocao December 2019",
          "url": "https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--42205acc-2d23-4ea9-ac29-980b6517d908",
      "subject": "ATTACK:enterprise:S0532",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--42205acc-2d23-4ea9-ac29-980b6517d908",
      "modified": "2026-04-29T14:23:06.015Z",
      "references": [
        {
          "source_name": "Unit 42 Lucifer June 2020",
          "url": "https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--427a9eb9-659d-433c-9e2c-9a66d115a9a3",
      "subject": "ATTACK:enterprise:S0171",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--427a9eb9-659d-433c-9e2c-9a66d115a9a3",
      "modified": "2026-04-29T14:23:06.016Z",
      "references": [
        {
          "source_name": "Forcepoint Felismus Mar 2017",
          "url": "https://blogs.forcepoint.com/security-labs/playing-cat-mouse-introducing-felismus-malware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--439344c5-67e0-4d38-9b91-866392e5e232",
      "subject": "ATTACK:enterprise:G0087",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--439344c5-67e0-4d38-9b91-866392e5e232",
      "modified": "2026-07-31T18:47:53.422Z",
      "references": [
        {
          "source_name": "Symantec Chafer Dec 2015",
          "url": "https://www.symantec.com/connect/blogs/iran-based-attackers-use-back-door-threats-spy-middle-eastern-targets"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4579695f-22c6-4391-a508-da942c2e0570",
      "subject": "ATTACK:enterprise:S1015",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4579695f-22c6-4391-a508-da942c2e0570",
      "modified": "2026-04-29T14:23:06.020Z",
      "references": [
        {
          "source_name": "ClearSky Siamesekitten August 2021",
          "url": "https://www.clearskysec.com/siamesekitten/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--46452566-0f0f-4fe9-9cef-ef7e3d6eee36",
      "subject": "ATTACK:enterprise:S0251",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--46452566-0f0f-4fe9-9cef-ef7e3d6eee36",
      "modified": "2026-04-29T14:23:06.021Z",
      "references": [
        {
          "source_name": "ESET Zebrocy Nov 2018",
          "url": "https://www.welivesecurity.com/2018/11/20/sednit-whats-going-zebrocy/"
        },
        {
          "source_name": "CISA Zebrocy Oct 2020",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303b"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--474912e8-0f81-439c-a613-51cbb9c0baa9",
      "subject": "ATTACK:enterprise:S0650",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--474912e8-0f81-439c-a613-51cbb9c0baa9",
      "modified": "2026-04-29T14:23:06.022Z",
      "references": [
        {
          "source_name": "Trend Micro Black Basta October 2022",
          "url": "https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html"
        },
        {
          "source_name": "Kaspersky QakBot September 2021",
          "url": "https://securelist.com/qakbot-technical-analysis/103931/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--47a31ea1-4b4d-4141-9d41-07d3b229913c",
      "subject": "ATTACK:enterprise:S0351",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--47a31ea1-4b4d-4141-9d41-07d3b229913c",
      "modified": "2026-04-29T14:23:06.023Z",
      "references": [
        {
          "source_name": "Unit42 Cannon Nov 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4a7a38c4-fb6d-420e-ac37-0c774c7b3a9f",
      "subject": "ATTACK:enterprise:S0533",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4a7a38c4-fb6d-420e-ac37-0c774c7b3a9f",
      "modified": "2026-04-29T14:23:06.027Z",
      "references": [
        {
          "source_name": "CISA MAR SLOTHFULMEDIA October 2020",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4abb6550-b362-4f8a-80e4-1d6f094a1e37",
      "subject": "ATTACK:enterprise:S0647",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4abb6550-b362-4f8a-80e4-1d6f094a1e37",
      "modified": "2026-04-29T14:23:06.027Z",
      "references": [
        {
          "source_name": "ESET BackdoorDiplomacy Jun 2021",
          "url": "https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4acb6288-8de5-4a5c-b7a4-68911ab148f9",
      "subject": "ATTACK:enterprise:S0627",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4acb6288-8de5-4a5c-b7a4-68911ab148f9",
      "modified": "2026-04-29T14:23:06.027Z",
      "references": [
        {
          "source_name": "Securelist APT10 March 2021",
          "url": "https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4b253464-5a8b-4129-ab1b-ab888314f900",
      "subject": "ATTACK:enterprise:G0067",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4b253464-5a8b-4129-ab1b-ab888314f900",
      "modified": "2026-07-31T18:47:55.322Z",
      "references": [
        {
          "source_name": "Talos Group123",
          "url": "https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4dfbd868-5ab0-47c9-822e-a20db55dced5",
      "subject": "ATTACK:enterprise:S1130",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4dfbd868-5ab0-47c9-822e-a20db55dced5",
      "modified": "2026-04-29T14:23:06.031Z",
      "references": [
        {
          "source_name": "TrendMicro RaspberryRobin 2022",
          "url": "https://www.trendmicro.com/en_us/research/22/l/raspberry-robin-malware-targets-telecom-governments.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--500130c0-d049-4e67-9bcc-d60a5f6dfd4c",
      "subject": "ATTACK:enterprise:G0032",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--500130c0-d049-4e67-9bcc-d60a5f6dfd4c",
      "modified": "2026-07-31T20:48:46.690Z",
      "references": [
        {
          "source_name": "Novetta Blockbuster Destructive Malware",
          "url": "https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"
        },
        {
          "source_name": "Novetta Blockbuster Loaders",
          "url": "https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"
        },
        {
          "source_name": "Novetta Blockbuster RATs",
          "url": "https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"
        },
        {
          "source_name": "Novetta Blockbuster",
          "url": "https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"
        },
        {
          "source_name": "Lazarus APT January 2022",
          "url": "https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"
        },
        {
          "source_name": "McAfee Lazarus Resurfaces Feb 2018",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"
        },
        {
          "source_name": "SentinelOne Lazarus macOS July 2020",
          "url": "https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5014ae85-9335-40df-b03b-bc08964d4ff7",
      "subject": "ATTACK:enterprise:C0002",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5014ae85-9335-40df-b03b-bc08964d4ff7",
      "modified": "2026-07-31T18:47:30.886Z",
      "references": [
        {
          "source_name": "McAfee Night Dragon",
          "url": "https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--50189f72-7432-4af7-a600-50a95c8c641f",
      "subject": "ATTACK:enterprise:S9019",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--50189f72-7432-4af7-a600-50a95c8c641f",
      "modified": "2026-04-29T14:23:06.035Z",
      "references": [
        {
          "source_name": "Check Point Blind Eagle MAR 2025",
          "url": "https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5183147b-4563-4a01-a360-a419691e35f8",
      "subject": "ATTACK:enterprise:S0184",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5183147b-4563-4a01-a360-a419691e35f8",
      "modified": "2026-04-29T14:23:06.037Z",
      "references": [
        {
          "source_name": "FireEye APT34 Dec 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--524261f3-8b87-4c99-b99b-1e78032f072c",
      "subject": "ATTACK:enterprise:S0260",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--524261f3-8b87-4c99-b99b-1e78032f072c",
      "modified": "2026-04-29T14:23:06.038Z",
      "references": [
        {
          "source_name": "ESET InvisiMole June 2018",
          "url": "https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--549c2737-1097-4a16-8d4b-01ad0e3e689f",
      "subject": "ATTACK:enterprise:S0456",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--549c2737-1097-4a16-8d4b-01ad0e3e689f",
      "modified": "2026-04-29T14:23:06.041Z",
      "references": [
        {
          "source_name": "CheckPoint Naikon May 2020",
          "url": "https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--57851829-665d-4871-9327-1734547f7d9d",
      "subject": "ATTACK:enterprise:S1087",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--57851829-665d-4871-9327-1734547f7d9d",
      "modified": "2026-04-29T14:23:06.045Z",
      "references": [
        {
          "source_name": "Telefonica Snip3 December 2021",
          "url": "https://telefonicatech.com/blog/snip3-investigacion-malware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--57de7812-f3b0-44d1-9548-856a26278568",
      "subject": "ATTACK:enterprise:S0531",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--57de7812-f3b0-44d1-9548-856a26278568",
      "modified": "2026-04-29T14:23:06.045Z",
      "references": [
        {
          "source_name": "ESET Grandoreiro April 2020",
          "url": "https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--58a7f0d9-7c20-4808-b8be-bd6240267030",
      "subject": "ATTACK:enterprise:G0081",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--58a7f0d9-7c20-4808-b8be-bd6240267030",
      "modified": "2026-07-31T18:47:57.092Z",
      "references": [
        {
          "source_name": "TrendMicro TropicTrooper 2015",
          "url": "https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--590756ce-b948-4d62-9608-4fadf58681f4",
      "subject": "ATTACK:enterprise:G0027",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--590756ce-b948-4d62-9608-4fadf58681f4",
      "modified": "2026-07-31T18:48:28.838Z",
      "references": [
        {
          "source_name": "Trend Micro DRBControl February 2020",
          "url": "https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--59f27a62-6748-44d0-b9aa-ef976dd97502",
      "subject": "ATTACK:enterprise:S9023",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--59f27a62-6748-44d0-b9aa-ef976dd97502",
      "modified": "2026-04-29T14:23:06.048Z",
      "references": [
        {
          "source_name": "ESET HiddenFace 2024",
          "url": "https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_2_8_Breitenbacher_en.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5bef7ca6-0d66-4d7c-9972-56781548222a",
      "subject": "ATTACK:enterprise:S0631",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5bef7ca6-0d66-4d7c-9972-56781548222a",
      "modified": "2026-04-29T14:23:06.051Z",
      "references": [
        {
          "source_name": "Cybereason Chaes Nov 2020",
          "url": "https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5c46f9a0-fb83-473d-af9a-c1c98cfdd85b",
      "subject": "ATTACK:enterprise:S0476",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5c46f9a0-fb83-473d-af9a-c1c98cfdd85b",
      "modified": "2026-04-29T14:23:06.051Z",
      "references": [
        {
          "source_name": "Cybereason Valak May 2020",
          "url": "https://www.cybereason.com/blog/valak-more-than-meets-the-eye"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5cab522f-3469-4f57-97c5-f333c63691c0",
      "subject": "ATTACK:enterprise:C0018",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5cab522f-3469-4f57-97c5-f333c63691c0",
      "modified": "2026-07-31T18:47:23.028Z",
      "references": [
        {
          "source_name": "Costa AvosLocker May 2022",
          "url": "https://www.linkedin.com/pulse/raas-avoslocker-incident-response-analysis-fl%C3%A1vio-costa?trk=articles_directory"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5ea72071-0251-4826-8a7b-7677ec52eadb",
      "subject": "ATTACK:enterprise:S1081",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5ea72071-0251-4826-8a7b-7677ec52eadb",
      "modified": "2026-04-29T14:23:06.054Z",
      "references": [
        {
          "source_name": "BitDefender BADHATCH Mar 2021",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5efe685d-66a6-4f1f-8779-4aae5db859d0",
      "subject": "ATTACK:enterprise:S0139",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5efe685d-66a6-4f1f-8779-4aae5db859d0",
      "modified": "2026-04-29T14:23:06.054Z",
      "references": [
        {
          "source_name": "Volexity PowerDuke November 2016",
          "url": "https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5fc9189b-7c9b-43f7-8d60-96a1f497e395",
      "subject": "ATTACK:enterprise:G1006",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5fc9189b-7c9b-43f7-8d60-96a1f497e395",
      "modified": "2026-07-31T20:48:48.208Z",
      "references": [
        {
          "source_name": "TrendMicro EarthLusca 2022",
          "url": "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--605478eb-c1c2-4029-bf36-9cc8981f2bee",
      "subject": "ATTACK:enterprise:S0262",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--605478eb-c1c2-4029-bf36-9cc8981f2bee",
      "modified": "2026-04-29T14:23:06.056Z",
      "references": [
        {
          "source_name": "CISA AR18-352A Quasar RAT December 2018",
          "url": "https://www.cisa.gov/uscert/ncas/analysis-reports/AR18-352A"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--616cbad8-87d2-4264-ab07-130ad3871299",
      "subject": "ATTACK:enterprise:S9042",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--616cbad8-87d2-4264-ab07-130ad3871299",
      "modified": "2026-07-27T19:46:38.479Z",
      "references": [
        {
          "source_name": "Aikido CanisterWorm MAR 2026",
          "url": "https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--62bd74e2-ca03-4564-ae9b-75637c4c6acf",
      "subject": "ATTACK:enterprise:S0270",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--62bd74e2-ca03-4564-ae9b-75637c4c6acf",
      "modified": "2026-04-29T14:23:06.059Z",
      "references": [
        {
          "source_name": "Unit 42 DarkHydrus July 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6337062d-04c1-43df-a72b-8719a31102a0",
      "subject": "ATTACK:enterprise:S0391",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6337062d-04c1-43df-a72b-8719a31102a0",
      "modified": "2026-04-29T14:23:06.060Z",
      "references": [
        {
          "source_name": "FireEye HAWKBALL Jun 2019",
          "url": "https://www.fireeye.com/blog/threat-research/2019/06/government-in-central-asia-targeted-with-hawkball-backdoor.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--64006d31-51ea-4908-8b09-2650fdc6b4f8",
      "subject": "ATTACK:enterprise:S0236",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--64006d31-51ea-4908-8b09-2650fdc6b4f8",
      "modified": "2026-04-29T14:23:06.061Z",
      "references": [
        {
          "source_name": "Symantec Orangeworm April 2018",
          "url": "https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6635f23e-99e9-4978-9924-ccf6c199f84f",
      "subject": "ATTACK:enterprise:S0412",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6635f23e-99e9-4978-9924-ccf6c199f84f",
      "modified": "2026-04-29T14:23:06.064Z",
      "references": [
        {
          "source_name": "Talos ZxShell Oct 2014",
          "url": "https://blogs.cisco.com/security/talos/opening-zxshell"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--693372c1-418e-45c3-9b0e-0c21d705d1d2",
      "subject": "ATTACK:enterprise:S0339",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--693372c1-418e-45c3-9b0e-0c21d705d1d2",
      "modified": "2026-04-29T14:23:06.068Z",
      "references": [
        {
          "source_name": "Talos Micropsia June 2017",
          "url": "https://blog.talosintelligence.com/2017/06/palestine-delphi.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6b1fd87c-b8d1-4ea1-9cc3-bc4fb1cd2fbd",
      "subject": "ATTACK:enterprise:S0569",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6b1fd87c-b8d1-4ea1-9cc3-bc4fb1cd2fbd",
      "modified": "2026-04-29T14:23:06.071Z",
      "references": [
        {
          "source_name": "CheckPoint Volatile Cedar March 2015",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6c71a59f-05e6-44cc-ace5-33200e1f0846",
      "subject": "ATTACK:enterprise:S0092",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6c71a59f-05e6-44cc-ace5-33200e1f0846",
      "modified": "2026-04-29T14:23:06.073Z",
      "references": [
        {
          "source_name": "ThreatExpert Agent.btz",
          "url": "http://blog.threatexpert.com/2008/11/agentbtz-threat-that-hit-pentagon.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6cd6dc77-210e-41d7-b534-88d5c21e6a9b",
      "subject": "ATTACK:enterprise:S1064",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6cd6dc77-210e-41d7-b534-88d5c21e6a9b",
      "modified": "2026-04-29T14:23:06.073Z",
      "references": [
        {
          "source_name": "HP SVCReady Jun 2022",
          "url": "https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6cdada54-681f-47ac-834b-4d4e2c86ec75",
      "subject": "ATTACK:enterprise:S0115",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6cdada54-681f-47ac-834b-4d4e2c86ec75",
      "modified": "2026-04-29T14:23:06.073Z",
      "references": [
        {
          "source_name": "Kaspersky Transparent Tribe August 2020",
          "url": "https://securelist.com/transparent-tribe-part-1/98127/"
        },
        {
          "source_name": "Proofpoint Operation Transparent Tribe March 2016",
          "url": "https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"
        },
        {
          "source_name": "Cisco Talos Transparent Tribe Education Campaign July 2022",
          "url": "https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6cf42ee6-a064-4d8a-99d4-8aa0f878ae2a",
      "subject": "ATTACK:enterprise:S0186",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6cf42ee6-a064-4d8a-99d4-8aa0f878ae2a",
      "modified": "2026-04-29T14:23:06.073Z",
      "references": [
        {
          "source_name": "ClearSky Charming Kitten Dec 2017",
          "url": "http://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6d8147e4-fca3-4348-9376-dd96cc7b9e30",
      "subject": "ATTACK:enterprise:S0439",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6d8147e4-fca3-4348-9376-dd96cc7b9e30",
      "modified": "2026-04-29T14:23:06.074Z",
      "references": [
        {
          "source_name": "ESET Okrum July 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6eb55cc5-1c90-44ce-ab80-0c938521f1cf",
      "subject": "ATTACK:enterprise:S0214",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6eb55cc5-1c90-44ce-ab80-0c938521f1cf",
      "modified": "2026-04-29T14:23:06.076Z",
      "references": [
        {
          "source_name": "FireEye APT37 Feb 2018",
          "url": "https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6f037ffb-3e85-41d0-8c48-ae36d0996d57",
      "subject": "ATTACK:enterprise:S0681",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6f037ffb-3e85-41d0-8c48-ae36d0996d57",
      "modified": "2026-04-29T14:23:06.076Z",
      "references": [
        {
          "source_name": "BiZone Lizar May 2021",
          "url": "https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"
        },
        {
          "source_name": "SekoiaBourhis_DiceLoader_Feb2024",
          "url": "https://blog.sekoia.io/unveiling-the-intricacies-of-diceloader/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--707d131d-39ff-4ea0-a8ef-63dd7ca2a854",
      "subject": "ATTACK:enterprise:S0162",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--707d131d-39ff-4ea0-a8ef-63dd7ca2a854",
      "modified": "2026-04-29T14:23:06.079Z",
      "references": [
        {
          "source_name": "Sofacy Komplex Trojan",
          "url": "https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--70bed654-4c16-456a-8691-4f2bf1c916cc",
      "subject": "ATTACK:enterprise:S0615",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--70bed654-4c16-456a-8691-4f2bf1c916cc",
      "modified": "2026-04-29T14:23:06.079Z",
      "references": [
        {
          "source_name": "BlackBerry CostaRicto November 2020",
          "url": "https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"
        },
        {
          "source_name": "CISA AR21-126A FIVEHANDS May 2021",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--719f0c42-8eb8-461b-8f35-cf5dfc42e47b",
      "subject": "ATTACK:enterprise:S0265",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--719f0c42-8eb8-461b-8f35-cf5dfc42e47b",
      "modified": "2026-04-29T14:23:06.080Z",
      "references": [
        {
          "source_name": "Unit 42 Kazuar May 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--71f80d4d-daf5-4da2-811b-0ebd3365b79c",
      "subject": "ATTACK:enterprise:C0012",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--71f80d4d-daf5-4da2-811b-0ebd3365b79c",
      "modified": "2026-07-31T18:47:28.334Z",
      "references": [
        {
          "source_name": "Cybereason OperationCuckooBees May 2022",
          "url": "https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-winnti-techniques"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--731c3fa1-2af3-4b6e-ad0d-7942e8e966fb",
      "subject": "ATTACK:enterprise:S0515",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--731c3fa1-2af3-4b6e-ad0d-7942e8e966fb",
      "modified": "2026-04-29T14:23:06.083Z",
      "references": [
        {
          "source_name": "CISA WellMail July 2020",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198c"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--73717937-3d8f-402d-a222-b40d15a49cea",
      "subject": "ATTACK:enterprise:S0521",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--73717937-3d8f-402d-a222-b40d15a49cea",
      "modified": "2026-04-29T14:23:06.083Z",
      "references": [
        {
          "source_name": "CrowdStrike BloodHound April 2018",
          "url": "https://www.crowdstrike.com/blog/hidden-administrative-accounts-bloodhound-to-the-rescue/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7a181608-6005-4d42-b4a2-0e2de8b8ff95",
      "subject": "ATTACK:enterprise:S0201",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7a181608-6005-4d42-b4a2-0e2de8b8ff95",
      "modified": "2026-04-29T14:23:06.092Z",
      "references": [
        {
          "source_name": "Microsoft PLATINUM April 2016",
          "url": "https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7ac10827-9bf6-4d60-aa16-9f2d2930b373",
      "subject": "ATTACK:enterprise:G0059",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7ac10827-9bf6-4d60-aa16-9f2d2930b373",
      "modified": "2026-07-31T18:48:28.700Z",
      "references": [
        {
          "source_name": "DFIR Phosphorus November 2021",
          "url": "https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"
        },
        {
          "source_name": "DFIR Report APT35 ProxyShell March 2022",
          "url": "https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"
        },
        {
          "source_name": "Unit 42 Magic Hound Feb 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7b143b11-1fe5-4dc1-9790-3cd05659adc4",
      "subject": "ATTACK:enterprise:G0128",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7b143b11-1fe5-4dc1-9790-3cd05659adc4",
      "modified": "2026-07-31T18:47:52.340Z",
      "references": [
        {
          "source_name": "Zscaler APT31 Covid-19 October 2020",
          "url": "https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7b7233f3-33a0-4d82-8333-7f89e051653e",
      "subject": "ATTACK:enterprise:S9052",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7b7233f3-33a0-4d82-8333-7f89e051653e",
      "modified": "2026-10-01T20:45:41.572Z",
      "references": [
        {
          "source_name": "CheckPoint_NimbusManticore_May2026",
          "url": "https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7ed13f1b-fa49-4b4e-9bc8-935012710d5f",
      "subject": "ATTACK:enterprise:S1037",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7ed13f1b-fa49-4b4e-9bc8-935012710d5f",
      "modified": "2026-04-29T14:23:06.099Z",
      "references": [
        {
          "source_name": "DHS CISA AA22-055A MuddyWater February 2022",
          "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"
        },
        {
          "source_name": "Mandiant UNC3313 Feb 2022",
          "url": "https://www.mandiant.com/resources/telegram-malware-iranian-espionage"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8087182b-73c3-4efa-aad6-36498531f728",
      "subject": "ATTACK:enterprise:S0433",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8087182b-73c3-4efa-aad6-36498531f728",
      "modified": "2026-04-29T14:23:06.101Z",
      "references": [
        {
          "source_name": "Carbon Black HotCroissant April 2020",
          "url": "https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--80a8ee57-3169-4928-aa94-56d356b72931",
      "subject": "ATTACK:enterprise:S0691",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--80a8ee57-3169-4928-aa94-56d356b72931",
      "modified": "2026-04-29T14:23:06.101Z",
      "references": [
        {
          "source_name": "Microsoft NICKEL December 2021",
          "url": "https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--80e484a4-e5b5-4de1-81c7-2bd1a927d156",
      "subject": "ATTACK:enterprise:S0477",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--80e484a4-e5b5-4de1-81c7-2bd1a927d156",
      "modified": "2026-04-29T14:23:06.102Z",
      "references": [
        {
          "source_name": "Cybereason Cobalt Kitty 2017",
          "url": "https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--818a401d-dd4d-426a-b89c-d33625380b8b",
      "subject": "ATTACK:enterprise:S0149",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--818a401d-dd4d-426a-b89c-d33625380b8b",
      "modified": "2026-04-29T14:23:06.103Z",
      "references": [
        {
          "source_name": "Palo Alto MoonWind March 2017",
          "url": "http://researchcenter.paloaltonetworks.com/2017/03/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--81cb331d-a24d-4100-a26a-447b0dc73260",
      "subject": "ATTACK:enterprise:S1149",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--81cb331d-a24d-4100-a26a-447b0dc73260",
      "modified": "2026-04-29T14:23:06.103Z",
      "references": [
        {
          "source_name": "Mandiant ROADSWEEP August 2022",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--82404260-b720-4f23-a162-81a9d6735c1e",
      "subject": "ATTACK:enterprise:S1044",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--82404260-b720-4f23-a162-81a9d6735c1e",
      "modified": "2026-04-29T14:23:06.103Z",
      "references": [
        {
          "source_name": "Bitdefender FunnyDream Campaign November 2020",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--82927a23-3e5e-4892-b788-c35cc6e649a5",
      "subject": "ATTACK:enterprise:S1035",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--82927a23-3e5e-4892-b788-c35cc6e649a5",
      "modified": "2026-04-29T14:23:06.104Z",
      "references": [
        {
          "source_name": "NCSC GCHQ Small Sieve Jan 2022",
          "url": "https://www.ncsc.gov.uk/files/NCSC-Malware-Analysis-Report-Small-Sieve.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--830b40b0-ffc8-4847-8849-27b62c9e84b6",
      "subject": "ATTACK:enterprise:S0554",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--830b40b0-ffc8-4847-8849-27b62c9e84b6",
      "modified": "2026-04-29T14:23:06.104Z",
      "references": [
        {
          "source_name": "Intrinsec Egregor Nov 2020",
          "url": "https://www.intrinsec.com/egregor-prolock/?cn-reloaded=1"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8519b4c1-55c5-46be-8bdb-aa2a6ee2cb1a",
      "subject": "ATTACK:enterprise:S0385",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8519b4c1-55c5-46be-8bdb-aa2a6ee2cb1a",
      "modified": "2026-04-29T14:23:06.107Z",
      "references": [
        {
          "source_name": "Fidelis njRAT June 2013",
          "url": "https://www.threatminer.org/_reports/2013/fta-1009---njrat-uncovered-1.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--85278437-ae97-477e-b7cf-d2bad3fd1c6e",
      "subject": "ATTACK:enterprise:G0114",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--85278437-ae97-477e-b7cf-d2bad3fd1c6e",
      "modified": "2026-07-31T20:48:41.411Z",
      "references": [
        {
          "source_name": "NCC Group Chimera January 2021",
          "url": "https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8607f9cc-dd15-49a8-8e6a-55e1338591e9",
      "subject": "ATTACK:enterprise:S0649",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8607f9cc-dd15-49a8-8e6a-55e1338591e9",
      "modified": "2026-04-29T14:23:06.108Z",
      "references": [
        {
          "source_name": "FireEye SMOKEDHAM June 2021",
          "url": "https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8732cda7-068e-439d-a25a-1b056363d1f7",
      "subject": "ATTACK:enterprise:S0248",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8732cda7-068e-439d-a25a-1b056363d1f7",
      "modified": "2026-04-29T14:23:06.110Z",
      "references": [
        {
          "source_name": "ASERT Donot March 2018",
          "url": "https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--89baa1ed-a6f9-4da6-9448-c74d8f8a638b",
      "subject": "ATTACK:enterprise:S0662",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--89baa1ed-a6f9-4da6-9448-c74d8f8a638b",
      "modified": "2026-04-29T14:23:06.113Z",
      "references": [
        {
          "source_name": "Profero APT27 December 2020",
          "url": "https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8a0ac9c9-e8e2-44a2-b2b0-87b4b4fa90fb",
      "subject": "ATTACK:enterprise:S1106",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8a0ac9c9-e8e2-44a2-b2b0-87b4b4fa90fb",
      "modified": "2026-04-29T14:23:06.113Z",
      "references": [
        {
          "source_name": "NGLite Trojan",
          "url": "https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8bb44b86-379d-49ba-9b28-2451e69db30d",
      "subject": "ATTACK:enterprise:G0040",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8bb44b86-379d-49ba-9b28-2451e69db30d",
      "modified": "2026-07-31T20:48:26.355Z",
      "references": [
        {
          "source_name": "Cymmetria Patchwork",
          "url": "https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"
        },
        {
          "source_name": "TrendMicro Patchwork Dec 2017",
          "url": "https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8c5c3632-2327-4ff2-ada8-25036a19b85a",
      "subject": "ATTACK:enterprise:S1124",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8c5c3632-2327-4ff2-ada8-25036a19b85a",
      "modified": "2026-04-29T14:23:06.117Z",
      "references": [
        {
          "source_name": "SocGholish-update",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"
        },
        {
          "source_name": "Red Canary SocGholish March 2024",
          "url": "https://redcanary.com/threat-detection-report/threats/socgholish/"
        },
        {
          "source_name": "Secureworks Gold Prelude Profile",
          "url": "https://www.secureworks.com/research/threat-profiles/gold-prelude"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8ebab956-4440-4fd7-96ff-8da29e0f0b46",
      "subject": "ATTACK:enterprise:G0038",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8ebab956-4440-4fd7-96ff-8da29e0f0b46",
      "modified": "2026-07-31T18:48:07.336Z",
      "references": [
        {
          "source_name": "Citizen Lab Stealth Falcon May 2016",
          "url": "https://citizenlab.org/2016/05/stealth-falcon/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8f9cee62-46ce-4ede-a478-6002962528a7",
      "subject": "ATTACK:enterprise:S1021",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8f9cee62-46ce-4ede-a478-6002962528a7",
      "modified": "2026-04-29T14:23:06.121Z",
      "references": [
        {
          "source_name": "Zscaler Lyceum DnsSystem June 2022",
          "url": "https://www.zscaler.com/blogs/security-research/lyceum-net-dns-backdoor"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--93965fb7-e50d-45c8-a0db-354ce8ee05b8",
      "subject": "ATTACK:enterprise:G1017",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--93965fb7-e50d-45c8-a0db-354ce8ee05b8",
      "modified": "2026-07-31T18:47:40.807Z",
      "references": [
        {
          "source_name": "CISA AA24-038A PRC Critical Infrastructure February 2024",
          "url": "https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"
        },
        {
          "source_name": "Secureworks BRONZE SILHOUETTE May 2023",
          "url": "https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"
        },
        {
          "source_name": "Joint Cybersecurity Advisory Volt Typhoon June 2023",
          "url": "https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9613ad57-7f24-4dff-bea3-2626d8b2c335",
      "subject": "ATTACK:enterprise:S0362",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9613ad57-7f24-4dff-bea3-2626d8b2c335",
      "modified": "2026-04-29T14:23:06.130Z",
      "references": [
        {
          "source_name": "Anomali Linux Rabbit 2018",
          "url": "https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--96d62019-3515-4410-b27e-fe58642f06fd",
      "subject": "ATTACK:enterprise:C0064",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--96d62019-3515-4410-b27e-fe58642f06fd",
      "modified": "2026-09-25T15:31:22.785Z",
      "references": [
        {
          "source_name": "AI-Mexico-Govt-Breach",
          "url": "https://cdn.prod.website-files.com/69944dd945f20ca4a27a7c47/69d8bb5aea59e31efb3b8a7f_Tech_Report_ai_breach_mex_gov.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9718f2c1-99f3-4fa2-8293-44f2b30bba70",
      "subject": "ATTACK:enterprise:S0666",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9718f2c1-99f3-4fa2-8293-44f2b30bba70",
      "modified": "2026-04-29T14:23:06.131Z",
      "references": [
        {
          "source_name": "ESET Gelsemium June 2021",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--986f3f81-7872-4c99-a704-4e53f2936e26",
      "subject": "ATTACK:enterprise:G1014",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--986f3f81-7872-4c99-a704-4e53f2936e26",
      "modified": "2026-07-31T18:48:14.924Z",
      "references": [
        {
          "source_name": "Bitdefender LuminousMoth July 2021",
          "url": "https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--98a50c7b-353d-4bbd-bd66-799d79b389a0",
      "subject": "ATTACK:enterprise:G0143",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--98a50c7b-353d-4bbd-bd66-799d79b389a0",
      "modified": "2026-07-31T18:47:59.416Z",
      "references": [
        {
          "source_name": "Crowdstrike HuntReport 2022",
          "url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--98f55ec9-3170-41ad-9bac-c921fa4a29ea",
      "subject": "ATTACK:enterprise:S0543",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--98f55ec9-3170-41ad-9bac-c921fa4a29ea",
      "modified": "2026-04-29T14:23:06.134Z",
      "references": [
        {
          "source_name": "Unit42 Molerat Mar 2020",
          "url": "https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9bcb35a2-ac15-4a8f-a9cf-0978e44d5d17",
      "subject": "ATTACK:enterprise:S1245",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9bcb35a2-ac15-4a8f-a9cf-0978e44d5d17",
      "modified": "2026-04-29T14:23:06.137Z",
      "references": [
        {
          "source_name": "Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024",
          "url": "https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"
        },
        {
          "source_name": "ESET Contagious Interview BeaverTail InvisibleFerret February 2025",
          "url": "https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"
        },
        {
          "source_name": "PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023",
          "url": "https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9e1daa60-db2d-4671-b96f-3ebebe1977cc",
      "subject": "ATTACK:enterprise:S0353",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9e1daa60-db2d-4671-b96f-3ebebe1977cc",
      "modified": "2026-04-29T14:23:06.141Z",
      "references": [
        {
          "source_name": "Unit 42 NOKKI Sept 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9ee385ef-7e78-47bf-be25-8ba112f9280e",
      "subject": "ATTACK:enterprise:S0461",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9ee385ef-7e78-47bf-be25-8ba112f9280e",
      "modified": "2026-04-29T14:23:06.142Z",
      "references": [
        {
          "source_name": "Proofpoint TA505 October 2019",
          "url": "https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a0b16d25-48f0-42e5-be32-8b831e18c869",
      "subject": "ATTACK:enterprise:S0696",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a0b16d25-48f0-42e5-be32-8b831e18c869",
      "modified": "2026-04-29T14:23:06.144Z",
      "references": [
        {
          "source_name": "NTT Security Flagpro new December 2021",
          "url": "https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a1e9769e-5172-4959-84d3-5a28796f86e1",
      "subject": "ATTACK:enterprise:S0084",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a1e9769e-5172-4959-84d3-5a28796f86e1",
      "modified": "2026-04-29T14:23:06.145Z",
      "references": [
        {
          "source_name": "Cylance Dust Storm",
          "url": "https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a3849766-140d-4dc0-86ca-1e3ad38c15b5",
      "subject": "ATTACK:enterprise:S1060",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a3849766-140d-4dc0-86ca-1e3ad38c15b5",
      "modified": "2026-04-29T14:23:06.147Z",
      "references": [
        {
          "source_name": "SentinelLabs Metador Technical Appendix Sept 2022",
          "url": "https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a5ffea60-7694-48cd-92e9-b755669b2fdb",
      "subject": "ATTACK:enterprise:G0047",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a5ffea60-7694-48cd-92e9-b755669b2fdb",
      "modified": "2026-07-31T18:47:47.881Z",
      "references": [
        {
          "source_name": "Palo Alto Gamaredon Feb 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a6150e37-2411-409f-82a0-e259d55d1166",
      "subject": "ATTACK:enterprise:S0098",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a6150e37-2411-409f-82a0-e259d55d1166",
      "modified": "2026-04-29T14:23:06.151Z",
      "references": [
        {
          "source_name": "Palo Alto T9000 Feb 2016",
          "url": "http://researchcenter.paloaltonetworks.com/2016/02/t9000-advanced-modular-backdoor-uses-complex-anti-analysis-techniques/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--aa64ee12-ae96-40fe-ba37-a8893cd321ec",
      "subject": "ATTACK:enterprise:G0093",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--aa64ee12-ae96-40fe-ba37-a8893cd321ec",
      "modified": "2026-07-31T18:47:37.501Z",
      "references": [
        {
          "source_name": "Cybereason Soft Cell June 2019",
          "url": "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--aad1cfa0-0df0-4768-87c2-5e59da2c5e44",
      "subject": "ATTACK:enterprise:S0148",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--aad1cfa0-0df0-4768-87c2-5e59da2c5e44",
      "modified": "2026-04-29T14:23:06.157Z",
      "references": [
        {
          "source_name": "ESET RTM Feb 2017",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ab51438e-c79f-4fc5-b331-a85dc892b604",
      "subject": "ATTACK:enterprise:S0382",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ab51438e-c79f-4fc5-b331-a85dc892b604",
      "modified": "2026-04-29T14:23:06.158Z",
      "references": [
        {
          "source_name": "Proofpoint TA505 Jan 2019",
          "url": "https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--aca710ff-23a3-4c78-b75a-dfe6cad337a9",
      "subject": "ATTACK:enterprise:G0102",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--aca710ff-23a3-4c78-b75a-dfe6cad337a9",
      "modified": "2026-07-31T20:48:50.439Z",
      "references": [
        {
          "source_name": "Sophos New Ryuk Attack October 2020",
          "url": "https://news.sophos.com/en-us/2020/10/14/inside-a-new-ryuk-ransomware-attack/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ada55a0e-2f38-4da1-9ebd-8dd2f2461dfc",
      "subject": "ATTACK:enterprise:S0258",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ada55a0e-2f38-4da1-9ebd-8dd2f2461dfc",
      "modified": "2026-04-29T14:23:06.161Z",
      "references": [
        {
          "source_name": "Unit 42 RGDoor Jan 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--adba082d-7e17-44a4-82fb-c2d35997724b",
      "subject": "ATTACK:enterprise:S1249",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--adba082d-7e17-44a4-82fb-c2d35997724b",
      "modified": "2026-04-29T14:23:06.161Z",
      "references": [
        {
          "source_name": "Socket HexEval BeaverTail Contagious Interview June 2025",
          "url": "https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ae12b657-a640-40c6-99b7-931ed10705de",
      "subject": "ATTACK:enterprise:G0096",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ae12b657-a640-40c6-99b7-931ed10705de",
      "modified": "2026-07-31T20:48:27.456Z",
      "references": [
        {
          "source_name": "FireEye APT41 Aug 2019",
          "url": "https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"
        },
        {
          "source_name": "Rostovcev APT41 2021",
          "url": "https://www.group-ib.com/blog/apt41-world-tour-2021/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--aec8c69a-43f1-45e3-a7de-d2fa2ca7550e",
      "subject": "ATTACK:enterprise:S1169",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--aec8c69a-43f1-45e3-a7de-d2fa2ca7550e",
      "modified": "2026-04-29T14:23:06.163Z",
      "references": [
        {
          "source_name": "ESET OilRig Campaigns Sep 2023",
          "url": "https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--af66e48f-3232-4f78-ad3e-5a404f7ae3a1",
      "subject": "ATTACK:enterprise:S0021",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--af66e48f-3232-4f78-ad3e-5a404f7ae3a1",
      "modified": "2026-04-29T14:23:06.164Z",
      "references": [
        {
          "source_name": "Fidelis Turbo",
          "url": "https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2016/2016.02.29.Turbo_Campaign_Derusbi/TA_Fidelis_Turbo_1602_0.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--af6e3f9e-7c71-484d-ab8e-5adaaaedea36",
      "subject": "ATTACK:enterprise:S0059",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--af6e3f9e-7c71-484d-ab8e-5adaaaedea36",
      "modified": "2026-04-29T14:23:06.164Z",
      "references": [
        {
          "source_name": "Baumgartner Naikon 2015",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b22cebe6-129a-41a2-8a9e-70c222c88af6",
      "subject": "ATTACK:enterprise:G0049",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b22cebe6-129a-41a2-8a9e-70c222c88af6",
      "modified": "2026-07-31T20:48:35.773Z",
      "references": [
        {
          "source_name": "Palo Alto OilRig May 2016",
          "url": "http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"
        },
        {
          "source_name": "Palo Alto OilRig Oct 2016",
          "url": "http://researchcenter.paloaltonetworks.com/2016/10/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/"
        },
        {
          "source_name": "Check Point APT34 April 2021",
          "url": "https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b47d8f5e-7c09-4f40-a5a8-ccce10a8363b",
      "subject": "ATTACK:enterprise:S0354",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b47d8f5e-7c09-4f40-a5a8-ccce10a8363b",
      "modified": "2026-04-29T14:23:06.172Z",
      "references": [
        {
          "source_name": "Securelist Denis April 2017",
          "url": "https://securelist.com/use-of-dns-tunneling-for-cc-communications/78203/"
        },
        {
          "source_name": "Cybereason Cobalt Kitty 2017",
          "url": "https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b609347d-0089-4021-86a6-706ef1abc95e",
      "subject": "ATTACK:enterprise:S0534",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b609347d-0089-4021-86a6-706ef1abc95e",
      "modified": "2026-04-29T14:23:06.174Z",
      "references": [
        {
          "source_name": "NCC Group Team9 June 2020",
          "url": "https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b92d20d6-f6c3-4e5d-9f05-a06d45603617",
      "subject": "ATTACK:enterprise:S0568",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b92d20d6-f6c3-4e5d-9f05-a06d45603617",
      "modified": "2026-04-29T14:23:06.178Z",
      "references": [
        {
          "source_name": "Prevailion EvilNum May 2020",
          "url": "https://web.archive.org/web/20221209052853/https://www.prevailion.com/phantom-in-the-command-shell-2/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ba2c0c39-5b92-45d1-827f-5f2b454d3981",
      "subject": "ATTACK:enterprise:G1001",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ba2c0c39-5b92-45d1-827f-5f2b454d3981",
      "modified": "2026-07-31T20:48:51.875Z",
      "references": [
        {
          "source_name": "Kaspersky Lyceum October 2021",
          "url": "https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--baaa0717-b809-476b-93ee-60c87d900193",
      "subject": "ATTACK:enterprise:S9067",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--baaa0717-b809-476b-93ee-60c87d900193",
      "modified": "2026-10-01T21:52:48.256Z",
      "references": [
        {
          "source_name": "Mandiant_UNC1549_Nov2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bd62c9fa-b1d4-4fb9-a892-99703e1f794d",
      "subject": "ATTACK:enterprise:S0350",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bd62c9fa-b1d4-4fb9-a892-99703e1f794d",
      "modified": "2026-04-29T14:23:06.184Z",
      "references": [
        {
          "source_name": "McAfee Night Dragon",
          "url": "https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bd8aaa70-710d-45a7-bb43-6b2e37f7c797",
      "subject": "ATTACK:enterprise:S0153",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bd8aaa70-710d-45a7-bb43-6b2e37f7c797",
      "modified": "2026-04-29T14:23:06.184Z",
      "references": [
        {
          "source_name": "PWC Cloud Hopper Technical Annex April 2017",
          "url": "https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bfb687f5-0c7d-4ac3-a295-26f1b96dc360",
      "subject": "ATTACK:enterprise:S0237",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bfb687f5-0c7d-4ac3-a295-26f1b96dc360",
      "modified": "2026-04-29T14:23:06.187Z",
      "references": [
        {
          "source_name": "Talos GravityRAT",
          "url": "https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c0f13745-074b-46ba-ae7a-03385ef79d31",
      "subject": "ATTACK:enterprise:S0431",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c0f13745-074b-46ba-ae7a-03385ef79d31",
      "modified": "2026-04-29T14:23:06.189Z",
      "references": [
        {
          "source_name": "Carbon Black HotCroissant April 2020",
          "url": "https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c22f5416-2726-491e-ae10-35ec32ff9173",
      "subject": "ATTACK:enterprise:S0572",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c22f5416-2726-491e-ae10-35ec32ff9173",
      "modified": "2026-04-29T14:23:06.191Z",
      "references": [
        {
          "source_name": "ClearSky Lebanese Cedar Jan 2021",
          "url": "https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c5540ad5-b651-498f-abd4-fe521f1288f9",
      "subject": "ATTACK:enterprise:S1032",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c5540ad5-b651-498f-abd4-fe521f1288f9",
      "modified": "2026-04-29T14:23:06.195Z",
      "references": [
        {
          "source_name": "Checkpoint MosesStaff Nov 2021",
          "url": "https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c737cde1-271e-4f00-9692-3784e075c24d",
      "subject": "ATTACK:enterprise:S0441",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c737cde1-271e-4f00-9692-3784e075c24d",
      "modified": "2026-04-29T14:23:06.197Z",
      "references": [
        {
          "source_name": "Kaspersky Cloud Atlas August 2019",
          "url": "https://securelist.com/recent-cloud-atlas-activity/92016/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c78a0329-8160-40d2-83f4-f5076671e786",
      "subject": "ATTACK:enterprise:S0240",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c78a0329-8160-40d2-83f4-f5076671e786",
      "modified": "2026-04-29T14:23:06.198Z",
      "references": [
        {
          "source_name": "Malwarebytes RokRAT VBA January 2021",
          "url": "https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c7c2e904-7797-4d67-a0bf-dae4abf53689",
      "subject": "ATTACK:enterprise:S0644",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c7c2e904-7797-4d67-a0bf-dae4abf53689",
      "modified": "2026-04-29T14:23:06.198Z",
      "references": [
        {
          "source_name": "Talos Oblique RAT March 2021",
          "url": "https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--caf951a5-6952-4966-941d-71d9cd598b28",
      "subject": "ATTACK:enterprise:G0112",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--caf951a5-6952-4966-941d-71d9cd598b28",
      "modified": "2026-09-02T18:52:47.165Z",
      "references": [
        {
          "source_name": "BlackBerry Bahamut",
          "url": "https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cb68541e-3ca7-4e2d-892d-c30b50107b39",
      "subject": "ATTACK:enterprise:S0280",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cb68541e-3ca7-4e2d-892d-c30b50107b39",
      "modified": "2026-04-29T14:23:06.203Z",
      "references": [
        {
          "source_name": "APT15 Intezer June 2018",
          "url": "https://web.archive.org/web/20180615122133/https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cc2fed0b-69f2-4328-9236-02d4213dbbe7",
      "subject": "ATTACK:enterprise:S1207",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cc2fed0b-69f2-4328-9236-02d4213dbbe7",
      "modified": "2026-04-29T14:23:06.204Z",
      "references": [
        {
          "source_name": "Acronis XLoader 2021",
          "url": "https://www.acronis.com/en-us/cyber-protection-center/posts/trojan-as-a-service-from-formbook-to-xloader/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cea7b276-d2be-4af4-adaf-28eb26079098",
      "subject": "ATTACK:enterprise:S0455",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cea7b276-d2be-4af4-adaf-28eb26079098",
      "modified": "2026-04-29T14:23:06.208Z",
      "references": [
        {
          "source_name": "ESET Casbaneiro Oct 2019",
          "url": "https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cf5301fc-fc68-42ff-828f-280c8d0ed19f",
      "subject": "ATTACK:enterprise:S9020",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cf5301fc-fc68-42ff-828f-280c8d0ed19f",
      "modified": "2026-04-29T14:23:06.209Z",
      "references": [
        {
          "source_name": "ITOCHU LODEINFO JAN 2024",
          "url": "https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d08adc0f-5bf5-40cd-80ab-3c6ce1b46749",
      "subject": "ATTACK:enterprise:S9041",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d08adc0f-5bf5-40cd-80ab-3c6ce1b46749",
      "modified": "2026-07-08T19:13:30.816Z",
      "references": [
        {
          "source_name": "Aqua Security Blog Trivy Compromise APR 2026",
          "url": "https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d1222ff7-b93c-40a7-99bd-217d795d8d58",
      "subject": "ATTACK:enterprise:S0125",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d1222ff7-b93c-40a7-99bd-217d795d8d58",
      "modified": "2026-04-29T14:23:06.211Z",
      "references": [
        {
          "source_name": "Kaspersky ProjectSauron Technical Analysis",
          "url": "https://securelist.com/files/2016/07/The-ProjectSauron-APT_Technical_Analysis_KL.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d16e6d0b-b602-49dc-ac14-72b0355b6d5c",
      "subject": "ATTACK:enterprise:S9043",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d16e6d0b-b602-49dc-ac14-72b0355b6d5c",
      "modified": "2026-07-29T19:20:07.840Z",
      "references": [
        {
          "source_name": "Trend Micro TeamPCP MAY 2026",
          "url": "https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d1d496f1-fa91-404e-a93a-97670817717a",
      "subject": "ATTACK:enterprise:G0069",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d1d496f1-fa91-404e-a93a-97670817717a",
      "modified": "2026-07-31T20:48:30.203Z",
      "references": [
        {
          "source_name": "Securelist MuddyWater Oct 2018",
          "url": "https://securelist.com/muddywater/88059/"
        },
        {
          "source_name": "Trend Micro Muddy Water March 2021",
          "url": "https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d1f2ae2f-66e2-4dff-a806-75097d6c9c19",
      "subject": "ATTACK:enterprise:S0635",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d1f2ae2f-66e2-4dff-a806-75097d6c9c19",
      "modified": "2026-04-29T14:23:06.212Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Toolset May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d219ed2b-2877-450f-9a69-a30f36497d14",
      "subject": "ATTACK:enterprise:S0168",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d219ed2b-2877-450f-9a69-a30f36497d14",
      "modified": "2026-04-29T14:23:06.213Z",
      "references": [
        {
          "source_name": "Securelist WhiteBear Aug 2017",
          "url": "https://securelist.com/introducing-whitebear/81638/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d2d9a619-4379-4e15-9115-40ca9209f316",
      "subject": "ATTACK:enterprise:S0093",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d2d9a619-4379-4e15-9115-40ca9209f316",
      "modified": "2026-04-29T14:23:06.214Z",
      "references": [
        {
          "source_name": "Symantec Dragonfly",
          "url": "https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d3272553-9c28-47af-b2ae-9f675a5eaade",
      "subject": "ATTACK:enterprise:S1239",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d3272553-9c28-47af-b2ae-9f675a5eaade",
      "modified": "2026-04-29T14:23:06.214Z",
      "references": [
        {
          "source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload",
          "url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d54e7a92-0601-4b77-8675-46e33b577b4d",
      "subject": "ATTACK:enterprise:S0513",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d54e7a92-0601-4b77-8675-46e33b577b4d",
      "modified": "2026-04-29T14:23:06.217Z",
      "references": [
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d56e3076-7221-4e3b-8628-d8c50982892d",
      "subject": "ATTACK:enterprise:S0460",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d56e3076-7221-4e3b-8628-d8c50982892d",
      "modified": "2026-04-29T14:23:06.217Z",
      "references": [
        {
          "source_name": "Proofpoint TA505 October 2019",
          "url": "https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d5f4de59-e743-4330-98a5-7240b8103f44",
      "subject": "ATTACK:enterprise:S1172",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d5f4de59-e743-4330-98a5-7240b8103f44",
      "modified": "2026-04-29T14:23:06.218Z",
      "references": [
        {
          "source_name": "ESET OilRig Downloaders DEC 2023",
          "url": "https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d9089fda-0f17-43d2-bd5b-b9cd441bb4e2",
      "subject": "ATTACK:enterprise:S0559",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d9089fda-0f17-43d2-bd5b-b9cd441bb4e2",
      "modified": "2026-04-29T14:23:06.221Z",
      "references": [
        {
          "source_name": "FireEye SUNBURST Backdoor December 2020",
          "url": "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
        },
        {
          "source_name": "Microsoft Analyzing Solorigate Dec 2020",
          "url": "https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d979c181-32f5-4977-8ca9-30a1edc595c0",
      "subject": "ATTACK:enterprise:S1013",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d979c181-32f5-4977-8ca9-30a1edc595c0",
      "modified": "2026-04-29T14:23:06.222Z",
      "references": [
        {
          "source_name": "Cisco Talos Bitter Bangladesh May 2022",
          "url": "https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d9a670e7-9076-4a4f-8861-981bb04b946f",
      "subject": "ATTACK:enterprise:S1025",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d9a670e7-9076-4a4f-8861-981bb04b946f",
      "modified": "2026-04-29T14:23:06.222Z",
      "references": [
        {
          "source_name": "BlackBerry Amadey 2020",
          "url": "https://blogs.blackberry.com/en/2020/01/threat-spotlight-amadey-bot"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d9d7d861-66c9-469e-8baa-d72c7844a40f",
      "subject": "ATTACK:enterprise:S0267",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d9d7d861-66c9-469e-8baa-d72c7844a40f",
      "modified": "2026-04-29T14:23:06.223Z",
      "references": [
        {
          "source_name": "ESET GreyEnergy Oct 2018",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf"
        },
        {
          "source_name": "FireEye FELIXROOT July 2018",
          "url": "https://web.archive.org/web/20200607025424/https://www.fireeye.com/blog/threat-research/2018/07/microsoft-office-vulnerabilities-used-to-distribute-felixroot-backdoor.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--db5506f9-9451-471f-bb68-845c281be09c",
      "subject": "ATTACK:enterprise:S0486",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--db5506f9-9451-471f-bb68-845c281be09c",
      "modified": "2026-04-29T14:23:06.225Z",
      "references": [
        {
          "source_name": "ESET ForSSHe December 2018",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--db67d1d5-5412-486f-9f86-446dd5b2521d",
      "subject": "ATTACK:enterprise:G0094",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--db67d1d5-5412-486f-9f86-446dd5b2521d",
      "modified": "2026-07-31T20:48:25.535Z",
      "references": [
        {
          "source_name": "Aryaka Kimsuky July 2025",
          "url": "https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--dd06865b-d8fa-4626-8ebd-e75289377c4c",
      "subject": "ATTACK:enterprise:S0660",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--dd06865b-d8fa-4626-8ebd-e75289377c4c",
      "modified": "2026-04-29T14:23:06.227Z",
      "references": [
        {
          "source_name": "Trend Micro DRBControl February 2020",
          "url": "https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"
        },
        {
          "source_name": "Talent-Jump Clambling February 2020",
          "url": "https://www.talent-jump.com/article/2020/02/17/CLAMBLING-A-New-Backdoor-Base-On-Dropbox-en/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ddd70255-e5c4-4812-93e5-a20cdf993330",
      "subject": "ATTACK:enterprise:S1147",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ddd70255-e5c4-4812-93e5-a20cdf993330",
      "modified": "2026-04-29T14:23:06.228Z",
      "references": [
        {
          "source_name": "ESET EvasivePanda 2024",
          "url": "https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--dfa0d5cd-0e3d-4e21-ad3f-3653134cfa8b",
      "subject": "ATTACK:enterprise:S0015",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--dfa0d5cd-0e3d-4e21-ad3f-3653134cfa8b",
      "modified": "2026-04-29T14:23:06.230Z",
      "references": [
        {
          "source_name": "Trend Micro IXESHE 2012",
          "url": "https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e0566454-eca2-4623-9366-87827c0d3f1b",
      "subject": "ATTACK:enterprise:S1018",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e0566454-eca2-4623-9366-87827c0d3f1b",
      "modified": "2026-04-29T14:23:06.231Z",
      "references": [
        {
          "source_name": "Malwarebytes Saint Bot April 2021",
          "url": "https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e0a0966c-7a2f-41b3-962f-3a6b22a5a8a9",
      "subject": "ATTACK:enterprise:S0172",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e0a0966c-7a2f-41b3-962f-3a6b22a5a8a9",
      "modified": "2026-04-29T14:23:06.231Z",
      "references": [
        {
          "source_name": "Palo Alto Reaver Nov 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e0bb9da4-4cf5-4fcc-89c9-2cf174a34cae",
      "subject": "ATTACK:enterprise:S0257",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e0bb9da4-4cf5-4fcc-89c9-2cf174a34cae",
      "modified": "2026-04-29T14:23:06.231Z",
      "references": [
        {
          "source_name": "Unit 42 VERMIN Jan 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e13ba463-59c5-4e50-9aeb-420ab5e677db",
      "subject": "ATTACK:enterprise:G0035",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e13ba463-59c5-4e50-9aeb-420ab5e677db",
      "modified": "2026-07-31T20:48:28.754Z",
      "references": [
        {
          "source_name": "US-CERT TA18-074A",
          "url": "https://www.us-cert.gov/ncas/alerts/TA18-074A"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e3fe5089-90fc-47e6-afc7-fb0c41ba7c0c",
      "subject": "ATTACK:enterprise:S0498",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e3fe5089-90fc-47e6-afc7-fb0c41ba7c0c",
      "modified": "2026-04-29T14:23:06.236Z",
      "references": [
        {
          "source_name": "SentinelOne Lazarus macOS July 2020",
          "url": "https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e4960a7a-c280-4356-8b03-b848c68acd05",
      "subject": "ATTACK:enterprise:S1028",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e4960a7a-c280-4356-8b03-b848c68acd05",
      "modified": "2026-04-29T14:23:06.236Z",
      "references": [
        {
          "source_name": "MalwareBytes SideCopy Dec 2021",
          "url": "https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e6e95c9e-0f7d-4611-a40a-95fd7ee9f206",
      "subject": "ATTACK:enterprise:S0667",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e6e95c9e-0f7d-4611-a40a-95fd7ee9f206",
      "modified": "2026-04-29T14:23:06.239Z",
      "references": [
        {
          "source_name": "ESET Gelsemium June 2021",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e96e17e7-4349-4393-b875-5bab4e8ffa5a",
      "subject": "ATTACK:enterprise:S0334",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e96e17e7-4349-4393-b875-5bab4e8ffa5a",
      "modified": "2026-04-29T14:23:06.243Z",
      "references": [
        {
          "source_name": "TrendMicro DarkComet Sept 2014",
          "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/DARKCOMET"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e9bdf74e-3f6c-4097-9465-ec0b255326e4",
      "subject": "ATTACK:enterprise:S1141",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e9bdf74e-3f6c-4097-9465-ec0b255326e4",
      "modified": "2026-04-29T14:23:06.243Z",
      "references": [
        {
          "source_name": "ESET Turla Lunar toolset May 2024",
          "url": "https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ec037573-058a-43d5-a76e-bd76e99953dd",
      "subject": "ATTACK:enterprise:S0017",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ec037573-058a-43d5-a76e-bd76e99953dd",
      "modified": "2026-04-29T14:23:06.246Z",
      "references": [
        {
          "source_name": "Mandiant APT1 Appendix",
          "url": "https://www.mandiant.com/sites/default/files/2021-09/mandiant-apt1-report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ec6dc634-8214-4817-aabb-30ffb19ad4cc",
      "subject": "ATTACK:enterprise:S0692",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ec6dc634-8214-4817-aabb-30ffb19ad4cc",
      "modified": "2026-04-29T14:23:06.247Z",
      "references": [
        {
          "source_name": "GitHub SILENTTRINITY Modules July 2019",
          "url": "https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ed531ef0-02be-478d-811a-7c0e5643ac06",
      "subject": "ATTACK:enterprise:S1248",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ed531ef0-02be-478d-811a-7c0e5643ac06",
      "modified": "2026-04-29T14:23:06.248Z",
      "references": [
        {
          "source_name": "Socket BeaverTail XORIndex HexEval Contagious Interview July 2025",
          "url": "https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ee3c7d3c-f7c9-4165-af4b-ebc45a7aae3f",
      "subject": "ATTACK:enterprise:G1054",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ee3c7d3c-f7c9-4165-af4b-ebc45a7aae3f",
      "modified": "2026-07-31T18:48:09.286Z",
      "references": [
        {
          "source_name": "Trend Micro Earth Kasha NOV 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--eea81537-0c40-4b50-963d-d4f61ccf0554",
      "subject": "ATTACK:enterprise:G1051",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--eea81537-0c40-4b50-963d-d4f61ccf0554",
      "modified": "2026-07-31T18:48:11.172Z",
      "references": [
        {
          "source_name": "Broadcom Medusa Ransomware Medusa Group March 2025",
          "url": "https://www.security.com/threat-intelligence/medusa-ransomware-attacks"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ef041776-abd8-4e6f-8737-07e724e68cd1",
      "subject": "ATTACK:enterprise:G0034",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ef041776-abd8-4e6f-8737-07e724e68cd1",
      "modified": "2026-07-31T20:48:33.386Z",
      "references": [
        {
          "source_name": "US District Court Indictment GRU Unit 74455 October 2020",
          "url": "https://www.justice.gov/opa/press-release/file/1328521/download"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ef8e36e1-24ce-4d32-9c78-40388e1f07b9",
      "subject": "ATTACK:enterprise:G1046",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ef8e36e1-24ce-4d32-9c78-40388e1f07b9",
      "modified": "2026-07-31T18:47:48.127Z",
      "references": [
        {
          "source_name": "rapid7-email-bombing",
          "url": "https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f0c6191b-baa5-4a81-b8f6-7c26207d9db3",
      "subject": "ATTACK:enterprise:C0061",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f0c6191b-baa5-4a81-b8f6-7c26207d9db3",
      "modified": "2026-07-31T18:47:24.885Z",
      "references": [
        {
          "source_name": "sentinelone operationDigitalEye Dec 2024",
          "url": "https://www.sentinelone.com/labs/operation-digital-eye-chinese-apt-compromises-critical-digital-infrastructure-via-visual-studio-code-tunnels/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f130830a-f796-43a0-8415-58ad2b3aae63",
      "subject": "ATTACK:enterprise:S1024",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f130830a-f796-43a0-8415-58ad2b3aae63",
      "modified": "2026-04-29T14:23:06.253Z",
      "references": [
        {
          "source_name": "Microsoft POLONIUM June 2022",
          "url": "https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f2da9aaa-de4a-4825-b82d-d07ecc34e35c",
      "subject": "ATTACK:enterprise:S0284",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f2da9aaa-de4a-4825-b82d-d07ecc34e35c",
      "modified": "2026-04-29T14:23:06.255Z",
      "references": [
        {
          "source_name": "Talos Cobalt Group July 2018",
          "url": "https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"
        },
        {
          "source_name": "Security Intelligence More Eggs Aug 2019",
          "url": "https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f3d2f8a8-da3a-4635-90e5-95f6fee86a9c",
      "subject": "ATTACK:enterprise:S0673",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f3d2f8a8-da3a-4635-90e5-95f6fee86a9c",
      "modified": "2026-04-29T14:23:06.256Z",
      "references": [
        {
          "source_name": "Prevailion DarkWatchman 2021",
          "url": "https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f3faf032-132b-421b-adea-2e95f214807f",
      "subject": "ATTACK:enterprise:C0001",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f3faf032-132b-421b-adea-2e95f214807f",
      "modified": "2026-07-31T18:47:19.589Z",
      "references": [
        {
          "source_name": "Talos Frankenstein June 2019",
          "url": "https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f470eced-1e1c-49a8-b3b2-5ded410dc2e2",
      "subject": "ATTACK:enterprise:S0332",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f470eced-1e1c-49a8-b3b2-5ded410dc2e2",
      "modified": "2026-04-29T14:23:06.257Z",
      "references": [
        {
          "source_name": "Fortinet Remcos Campaign NOV 2024",
          "url": "https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f52cb753-6f2f-4f23-834a-75510e8fb47a",
      "subject": "ATTACK:enterprise:S0450",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f52cb753-6f2f-4f23-834a-75510e8fb47a",
      "modified": "2026-04-29T14:23:06.258Z",
      "references": [
        {
          "source_name": "TrendMicro POWERSTATS V3 June 2019",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f5bbb96e-40b9-4a8c-a53d-bcd843daeac2",
      "subject": "ATTACK:enterprise:S0228",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f5bbb96e-40b9-4a8c-a53d-bcd843daeac2",
      "modified": "2026-04-29T14:23:06.259Z",
      "references": [
        {
          "source_name": "fsecure NanHaiShu July 2016",
          "url": "https://www.f-secure.com/documents/996508/1030745/nanhaishu_whitepaper.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f62b29cb-b483-41b3-9724-ab7a376dd2c6",
      "subject": "ATTACK:enterprise:S0363",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f62b29cb-b483-41b3-9724-ab7a376dd2c6",
      "modified": "2026-04-29T14:23:06.260Z",
      "references": [
        {
          "source_name": "Talos Frankenstein June 2019",
          "url": "https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f6353949-0c13-4254-b7a0-a7ebc7a80f99",
      "subject": "ATTACK:enterprise:S0013",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f6353949-0c13-4254-b7a0-a7ebc7a80f99",
      "modified": "2026-04-29T14:23:06.260Z",
      "references": [
        {
          "source_name": "Eset PlugX Korplug Mustang Panda March 2022",
          "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f778e7e2-6119-4417-9f30-dfce65f6afe9",
      "subject": "ATTACK:enterprise:S1075",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f778e7e2-6119-4417-9f30-dfce65f6afe9",
      "modified": "2026-04-29T14:23:06.261Z",
      "references": [
        {
          "source_name": "Mandiant Suspected Turla Campaign February 2023",
          "url": "https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f8c2b8e1-7439-48df-a8c3-6796fd4bb142",
      "subject": "ATTACK:enterprise:S1068",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f8c2b8e1-7439-48df-a8c3-6796fd4bb142",
      "modified": "2026-04-29T14:23:06.263Z",
      "references": [
        {
          "source_name": "Microsoft BlackCat Jun 2022",
          "url": "https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fc43ba07-ffa2-4617-95ac-7ff6462eccd0",
      "subject": "ATTACK:enterprise:G0121",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fc43ba07-ffa2-4617-95ac-7ff6462eccd0",
      "modified": "2026-07-31T18:47:52.221Z",
      "references": [
        {
          "source_name": "ATT Sidewinder January 2021",
          "url": "https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fc52b3a9-96b2-4595-bedf-54289a42117a",
      "subject": "ATTACK:enterprise:S0269",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fc52b3a9-96b2-4595-bedf-54289a42117a",
      "modified": "2026-04-29T14:23:06.267Z",
      "references": [
        {
          "source_name": "Unit 42 QUADAGENT July 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fce2d07b-7bc7-497a-b21a-75a23fbccf50",
      "subject": "ATTACK:enterprise:S0113",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fce2d07b-7bc7-497a-b21a-75a23fbccf50",
      "modified": "2026-04-29T14:23:06.269Z",
      "references": [
        {
          "source_name": "ESET Operation Groundbait",
          "url": "http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fcfb3ce0-01a0-4f92-8e18-b323202d095d",
      "subject": "ATTACK:enterprise:G0022",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fcfb3ce0-01a0-4f92-8e18-b323202d095d",
      "modified": "2026-07-31T18:47:38.358Z",
      "references": [
        {
          "source_name": "FireEye Operation Double Tap",
          "url": "https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fea6e347-95f5-4d97-8781-4cc15d6b5b0c",
      "subject": "ATTACK:enterprise:S0060",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1033",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fea6e347-95f5-4d97-8781-4cc15d6b5b0c",
      "modified": "2026-04-29T14:23:06.271Z",
      "references": [
        {
          "source_name": "Baumgartner Naikon 2015",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    }
  ],
  "source_snapshot": {
    "file": "enterprise-attack-20.0.json",
    "url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
    "sha256": "81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352",
    "bytes": 55271014,
    "checked_at": "2026-10-16T03:31:39Z"
  },
  "notices_url": "https://aol.pm/source-notices.txt",
  "notices": "License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"
}

License
-------
The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,
development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce
MITRE's copyright designation and this license in any such copy.

"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation."

Disclaimers
-----------
MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part
of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover
full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or
variations on existing techniques not documented by ATT&CK.

ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE
ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,
AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT
THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR
FITNESS FOR A PARTICULAR PURPOSE.