{"record":{"id":"ATTACK:enterprise:T1036.005","title":"Match Legitimate Resource Name or Location","type":"Subtechnique","source_url":"https://attack.mitre.org/techniques/T1036/005","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2","external_id":"T1036.005","domain":"enterprise","created":"2020-02-10T20:43:10.239Z","modified":"2026-09-11T19:59:49.678Z","version":"3.0","aliases":[],"tactics":["stealth"],"source_references":[{"source_name":"Aquasec Kubernetes Backdoor 2023","url":"https://www.aquasec.com/blog/leveraging-kubernetes-rbac-to-backdoor-clusters/"}]},"assertions":[{"id":"enterprise:relationship--01ab8fee-5204-40c1-ac7a-b11a5683a87d","subject":"ATTACK:enterprise:S0083","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--01ab8fee-5204-40c1-ac7a-b11a5683a87d","modified":"2026-04-29T14:23:05.905Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"},{"source_name":"Microsoft DTC","url":"https://technet.microsoft.com/en-us/library/cc759136(v=ws.10).aspx"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--01e2c7fd-2fca-4ba0-81cb-ad0a3db779a9","subject":"ATTACK:enterprise:S9065","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--01e2c7fd-2fca-4ba0-81cb-ad0a3db779a9","modified":"2026-10-01T21:24:05.114Z","references":[{"source_name":"Mandiant_UNC1549_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--026e7bb0-2037-4bfc-b9ae-98e70530f22a","subject":"ATTACK:enterprise:M1022","predicate":"mitigates","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--026e7bb0-2037-4bfc-b9ae-98e70530f22a","modified":"2026-04-29T14:23:05.906Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0529ea16-1644-455d-a682-27e1f04b8cd1","subject":"ATTACK:enterprise:S0629","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0529ea16-1644-455d-a682-27e1f04b8cd1","modified":"2026-04-29T14:23:05.910Z","references":[{"source_name":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--069f77c1-aafd-4883-aecd-707802442427","subject":"ATTACK:enterprise:G0139","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--069f77c1-aafd-4883-aecd-707802442427","modified":"2026-07-31T18:47:48.970Z","references":[{"source_name":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--08057442-4b2c-4841-b351-8813431704e9","subject":"ATTACK:enterprise:S0459","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--08057442-4b2c-4841-b351-8813431704e9","modified":"2026-04-29T14:23:05.914Z","references":[{"source_name":"Unit 42 MechaFlounder March 2019","url":"https://unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--095d33b5-523d-40ae-aad9-448910d527d3","subject":"ATTACK:enterprise:S1050","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--095d33b5-523d-40ae-aad9-448910d527d3","modified":"2026-04-29T14:23:05.916Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--095e5f7b-288c-4995-8045-b691602d38c9","subject":"ATTACK:enterprise:M1038","predicate":"mitigates","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--095e5f7b-288c-4995-8045-b691602d38c9","modified":"2026-04-29T14:23:05.916Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0d50119b-b045-4d30-8ba7-ec1ce2d4be40","subject":"ATTACK:enterprise:G1056","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0d50119b-b045-4d30-8ba7-ec1ce2d4be40","modified":"2026-09-02T17:31:48.642Z","references":[{"source_name":"Aqua Security Blog Trivy Compromise APR 2026","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"},{"source_name":"Aikido TeamPCP Telnyx MAR 2026","url":"https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm"},{"source_name":"Palo Alto TeamPCP MAR 2026","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0d6bcabd-39bd-458b-8efc-5d409d9c2339","subject":"ATTACK:enterprise:G0082","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0d6bcabd-39bd-458b-8efc-5d409d9c2339","modified":"2026-09-30T19:28:25.021Z","references":[{"source_name":"Microsoft Axios Compromise APR 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/"},{"source_name":"Microsoft Sapphire Sleet APR 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"},{"source_name":"MIcrosoft Mastra npm Compromise JUN 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0def160c-4c74-477c-91b4-005603097cf2","subject":"ATTACK:enterprise:S1239","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0def160c-4c74-477c-91b4-005603097cf2","modified":"2026-04-29T14:23:05.922Z","references":[{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source_name":"Zscaler","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0f174d38-f30b-4037-a1bc-ecc099809966","subject":"ATTACK:enterprise:S0533","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0f174d38-f30b-4037-a1bc-ecc099809966","modified":"2026-04-29T14:23:05.924Z","references":[{"source_name":"CISA MAR SLOTHFULMEDIA October 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0fd5d3bc-d736-43c0-b9ec-f1dcd95411a7","subject":"ATTACK:enterprise:S0081","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0fd5d3bc-d736-43c0-b9ec-f1dcd95411a7","modified":"2026-04-29T14:23:05.925Z","references":[{"source_name":"Lotus Blossom Jun 2015","url":"https://www.paloaltonetworks.com/resources/research/unit42-operation-lotus-blossom.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1088fc27-2de5-4b73-83fd-6741ab3ff4d6","subject":"ATTACK:enterprise:S0072","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1088fc27-2de5-4b73-83fd-6741ab3ff4d6","modified":"2026-04-29T14:23:05.926Z","references":[{"source_name":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--10976d43-afcf-44d5-bcbf-122f39e0cbff","subject":"ATTACK:enterprise:C0025","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--10976d43-afcf-44d5-bcbf-122f39e0cbff","modified":"2026-07-31T21:05:25.538Z","references":[{"source_name":"Dragos Crashoverride 2017","url":"https://dragos.com/blog/crashoverride/CrashOverride-01.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--10c609ce-f256-436c-8288-3441cb123fc5","subject":"ATTACK:enterprise:S0482","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--10c609ce-f256-436c-8288-3441cb123fc5","modified":"2026-04-29T14:23:05.927Z","references":[{"source_name":"MacKeeper Bundlore Apr 2019","url":"https://mackeeper.com/blog/post/610-macos-bundlore-adware-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--11874e26-e692-43da-bb54-760e51a4714f","subject":"ATTACK:enterprise:S0085","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--11874e26-e692-43da-bb54-760e51a4714f","modified":"2026-04-29T14:23:05.928Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"},{"source_name":"Microsoft DTC","url":"https://technet.microsoft.com/en-us/library/cc759136(v=ws.10).aspx"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1617d3d7-77c9-4a6b-bdd6-8914e0890495","subject":"ATTACK:enterprise:S1014","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1617d3d7-77c9-4a6b-bdd6-8914e0890495","modified":"2026-04-29T14:23:05.934Z","references":[{"source_name":"ClearSky Siamesekitten August 2021","url":"https://www.clearskysec.com/siamesekitten/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1ad60707-d84f-4768-9013-6b499de49c40","subject":"ATTACK:enterprise:S0687","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1ad60707-d84f-4768-9013-6b499de49c40","modified":"2026-04-29T14:23:05.941Z","references":[{"source_name":"NCSC Cyclops Blink February 2022","url":"https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1e049e66-14ce-46d5-8af1-d93ea35f4aec","subject":"ATTACK:enterprise:G0047","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1e049e66-14ce-46d5-8af1-d93ea35f4aec","modified":"2026-07-31T18:47:47.406Z","references":[{"source_name":"Unit 42 Gamaredon February 2022","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"},{"source_name":"VenereCiscoTalos_Gamaredon_Mar2025","url":"https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1e1045dd-0ae7-427e-a205-d41c88b0a5d9","subject":"ATTACK:enterprise:S0668","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1e1045dd-0ae7-427e-a205-d41c88b0a5d9","modified":"2026-04-29T14:23:05.946Z","references":[{"source_name":"Talos TinyTurla September 2021","url":"https://blog.talosintelligence.com/2021/09/tinyturla.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1e15679d-de1c-47a8-a993-8d70fbffd6e4","subject":"ATTACK:enterprise:S1203","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1e15679d-de1c-47a8-a993-8d70fbffd6e4","modified":"2026-04-29T14:23:05.946Z","references":[{"source_name":"Lumen J-Magic JAN 2025","url":"https://blog.lumen.com/the-j-magic-show-magic-packets-and-where-to-find-them/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--201502c6-d208-408b-b6f3-50e39dab14ca","subject":"ATTACK:enterprise:S0484","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--201502c6-d208-408b-b6f3-50e39dab14ca","modified":"2026-04-29T14:23:05.948Z","references":[{"source_name":"Prevx Carberp March 2011","url":"https://web.archive.org/web/20231227000328/http://pxnow.prevx.com/content/blog/carberp-a_modular_information_stealing_trojan.pdf"},{"source_name":"Trusteer Carberp October 2010","url":"https://web.archive.org/web/20111004014029/http://www.trusteer.com/sites/default/files/Carberp_Analysis.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--20384b7e-e720-44ed-9aea-7f6857ce18c1","subject":"ATTACK:enterprise:G1017","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--20384b7e-e720-44ed-9aea-7f6857ce18c1","modified":"2026-07-31T18:47:39.841Z","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source_name":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source_name":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2174c465-8855-4c92-a683-97eb0eba9f7c","subject":"ATTACK:enterprise:G0060","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2174c465-8855-4c92-a683-97eb0eba9f7c","modified":"2026-07-31T18:48:10.159Z","references":[{"source_name":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2443296f-a8fc-431d-9865-d68dd6142b37","subject":"ATTACK:enterprise:S1090","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2443296f-a8fc-431d-9865-d68dd6142b37","modified":"2026-04-29T14:23:05.955Z","references":[{"source_name":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2463fa2a-0264-4287-a87b-3d4ada527ac5","subject":"ATTACK:enterprise:G1018","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2463fa2a-0264-4287-a87b-3d4ada527ac5","modified":"2026-07-31T18:47:55.035Z","references":[{"source_name":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--25398304-d7db-4180-864c-e123cd2ba041","subject":"ATTACK:enterprise:S1022","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--25398304-d7db-4180-864c-e123cd2ba041","modified":"2026-04-29T14:23:05.956Z","references":[{"source_name":"CrowdStrike IceApple May 2022","url":"https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--25fe3382-4792-4fa7-b439-2249bf572e72","subject":"ATTACK:enterprise:S9015","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--25fe3382-4792-4fa7-b439-2249bf572e72","modified":"2026-04-29T14:23:05.957Z","references":[{"source_name":"CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025","url":"https://www.crowdstrike.com/en-us/blog/warp-panda-cloud-threats/"},{"source_name":"CISA BRICKSTORM UNC5221 AR25-338A February 2026","url":"https://www.cisa.gov/news-events/analysis-reports/ar25-338a"},{"source_name":"Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement"},{"source_name":"Google BRICKSTORM September 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2843ccc2-4869-48a0-8967-b9856a778a2c","subject":"ATTACK:enterprise:S0171","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2843ccc2-4869-48a0-8967-b9856a778a2c","modified":"2026-04-29T14:23:05.960Z","references":[{"source_name":"ATT Felismus","url":"https://levelblue.com/blogs/security-essentials/the-felismus-rat-powerful-threat-mysterious-purpose"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--285baef5-e948-4e56-a078-5e7f5e7404fd","subject":"ATTACK:enterprise:G0096","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--285baef5-e948-4e56-a078-5e7f5e7404fd","modified":"2026-07-31T20:48:26.878Z","references":[{"source_name":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"},{"source_name":"Group IB APT 41 June 2021","url":"https://www.group-ib.com/blog/colunmtk-apt41/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--28aabd70-0158-42e3-8d2d-691b3abd5e8a","subject":"ATTACK:enterprise:S9041","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--28aabd70-0158-42e3-8d2d-691b3abd5e8a","modified":"2026-07-15T18:54:04.881Z","references":[{"source_name":"Wiz TeamPCP KICS MAR 2026","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--29878d2d-b66f-488f-a721-d6b44885ef66","subject":"ATTACK:enterprise:G1044","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--29878d2d-b66f-488f-a721-d6b44885ef66","modified":"2026-07-31T18:48:16.007Z","references":[{"source_name":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2a79e7df-12a8-41c3-990b-158c31ce9666","subject":"ATTACK:enterprise:G1046","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2a79e7df-12a8-41c3-990b-158c31ce9666","modified":"2026-07-31T18:47:47.794Z","references":[{"source_name":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2c8a4c1a-0faf-444d-a6b2-556c55374fa2","subject":"ATTACK:enterprise:S0496","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2c8a4c1a-0faf-444d-a6b2-556c55374fa2","modified":"2026-04-29T14:23:05.965Z","references":[{"source_name":"Picus Sodinokibi January 2020","url":"https://www.picussecurity.com/blog/a-brief-history-and-further-technical-analysis-of-sodinokibi-ransomware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2d882b40-11c3-4b7e-a400-5e87ae2bd899","subject":"ATTACK:enterprise:S0531","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2d882b40-11c3-4b7e-a400-5e87ae2bd899","modified":"2026-04-29T14:23:05.966Z","references":[{"source_name":"IBM Grandoreiro April 2020","url":"https://securityintelligence.com/posts/grandoreiro-malware-now-targeting-banks-in-spain/"},{"source_name":"ESET Grandoreiro April 2020","url":"https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2f33e27a-6fdf-4121-9e25-a307910b118f","subject":"ATTACK:enterprise:G0119","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2f33e27a-6fdf-4121-9e25-a307910b118f","modified":"2026-07-31T18:47:35.303Z","references":[{"source_name":"Crowdstrike Indrik November 2018","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--306ab1b7-4926-43ae-8989-b0dde2a43111","subject":"ATTACK:enterprise:G0046","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--306ab1b7-4926-43ae-8989-b0dde2a43111","modified":"2026-07-31T20:48:31.773Z","references":[{"source_name":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"},{"source_name":"CrowdStrike Carbon Spider August 2021","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--30ac4618-8059-4e7a-869a-4c3cb84577a2","subject":"ATTACK:enterprise:C0030","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--30ac4618-8059-4e7a-869a-4c3cb84577a2","modified":"2026-07-31T20:48:14.133Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--30c69dcc-9cf7-4352-a30c-0e7bc86b38e7","subject":"ATTACK:enterprise:S0468","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--30c69dcc-9cf7-4352-a30c-0e7bc86b38e7","modified":"2026-04-29T14:23:05.978Z","references":[{"source_name":"Trend Micro Skidmap","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3109f288-8024-4ae4-a284-f4f87d94f33d","subject":"ATTACK:enterprise:S1100","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3109f288-8024-4ae4-a284-f4f87d94f33d","modified":"2026-04-29T14:23:05.979Z","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3564dc8e-09d0-4855-8a90-d4c28a9488e5","subject":"ATTACK:enterprise:C0018","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3564dc8e-09d0-4855-8a90-d4c28a9488e5","modified":"2026-07-31T18:47:22.925Z","references":[{"source_name":"Cisco Talos Avos Jun 2022","url":"https://blog.talosintelligence.com/avoslocker-new-arsenal/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--378bf78e-6c5c-4466-9d6b-a494ae375526","subject":"ATTACK:enterprise:C0024","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--378bf78e-6c5c-4466-9d6b-a494ae375526","modified":"2026-07-31T18:47:26.492Z","references":[{"source_name":"Volexity SolarWinds","url":"https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/"},{"source_name":"Microsoft Analyzing Solorigate Dec 2020","url":"https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--37ad67f8-5b5c-4513-8465-fa584103f25b","subject":"ATTACK:enterprise:G1020","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--37ad67f8-5b5c-4513-8465-fa584103f25b","modified":"2026-07-31T18:47:37.751Z","references":[{"source_name":"SocGholish-update","url":"https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"},{"source_name":"Red Canary SocGholish March 2024","url":"https://redcanary.com/threat-detection-report/threats/socgholish/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--388e6809-55d3-4689-93b1-ddd9058b965c","subject":"ATTACK:enterprise:S1011","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--388e6809-55d3-4689-93b1-ddd9058b965c","modified":"2026-04-29T14:23:05.997Z","references":[{"source_name":"Tarrask scheduled task","url":"https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3a241a6c-11ee-4abc-a551-b5d4e594aad4","subject":"ATTACK:enterprise:S0138","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3a241a6c-11ee-4abc-a551-b5d4e594aad4","modified":"2026-04-29T14:23:06.000Z","references":[{"source_name":"FireEye APT28","url":"https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3c37c043-7f27-4fb9-ba7f-bce3181849ac","subject":"ATTACK:enterprise:M1045","predicate":"mitigates","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3c37c043-7f27-4fb9-ba7f-bce3181849ac","modified":"2026-04-29T14:23:06.005Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3d975f4e-8fea-41f7-9b9f-d995e2a3ee4c","subject":"ATTACK:enterprise:S1182","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3d975f4e-8fea-41f7-9b9f-d995e2a3ee4c","modified":"2026-04-29T14:23:06.009Z","references":[{"source_name":"Cisco MagicRAT 2022","url":"https://blog.talosintelligence.com/lazarus-magicrat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3e79db26-a2ce-4233-a86c-5a97b10dd937","subject":"ATTACK:enterprise:S0589","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3e79db26-a2ce-4233-a86c-5a97b10dd937","modified":"2026-04-29T14:23:06.010Z","references":[{"source_name":"MSTIC NOBELIUM Mar 2021","url":"https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3e82234f-db7b-4a0f-8c0a-979b01381a6a","subject":"ATTACK:enterprise:G0069","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3e82234f-db7b-4a0f-8c0a-979b01381a6a","modified":"2026-07-31T20:48:29.777Z","references":[{"source_name":"FireEye MuddyWater Mar 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"},{"source_name":"Talos MuddyWater May 2019","url":"https://blog.talosintelligence.com/2019/05/recent-muddywater-associated-blackwater.html"},{"source_name":"Anomali Static Kitten February 2021","url":"https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--40b50ac5-b1c1-4f80-b350-460cc0ed9f9f","subject":"ATTACK:enterprise:S1032","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--40b50ac5-b1c1-4f80-b350-460cc0ed9f9f","modified":"2026-04-29T14:23:06.013Z","references":[{"source_name":"Checkpoint MosesStaff Nov 2021","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4258f16d-4484-4b5f-8a2b-76366b2ee46c","subject":"ATTACK:enterprise:G0090","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4258f16d-4484-4b5f-8a2b-76366b2ee46c","modified":"2026-07-31T20:48:52.428Z","references":[{"source_name":"Check Point Wirte NOV 2024","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"},{"source_name":"Kaspersky WIRTE November 2021","url":"https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--42d4ae64-75da-4dfd-b23f-d270252115ee","subject":"ATTACK:enterprise:G0040","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--42d4ae64-75da-4dfd-b23f-d270252115ee","modified":"2026-07-31T20:48:26.262Z","references":[{"source_name":"Cymmetria Patchwork","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"},{"source_name":"Volexity Patchwork June 2018","url":"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--44577477-b599-46f0-84bf-7e0de773d848","subject":"ATTACK:enterprise:S0520","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--44577477-b599-46f0-84bf-7e0de773d848","modified":"2026-04-29T14:23:06.018Z","references":[{"source_name":"US-CERT BLINDINGCAN Aug 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--47d25590-2bcb-4acf-81ac-24d7ef23db91","subject":"ATTACK:enterprise:S0698","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--47d25590-2bcb-4acf-81ac-24d7ef23db91","modified":"2026-04-29T14:23:06.023Z","references":[{"source_name":"ESET Hermetic Wizard March 2022","url":"https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4899bf68-d60e-4132-a962-faafd35f0c4a","subject":"ATTACK:enterprise:S0495","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4899bf68-d60e-4132-a962-faafd35f0c4a","modified":"2026-04-29T14:23:06.024Z","references":[{"source_name":"Unit42 RDAT July 2020","url":"https://unit42.paloaltonetworks.com/oilrig-novel-c2-channel-steganography/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--48b75b8b-5bef-4f99-baa8-5fa978d371d2","subject":"ATTACK:enterprise:S0125","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--48b75b8b-5bef-4f99-baa8-5fa978d371d2","modified":"2026-04-29T14:23:06.024Z","references":[{"source_name":"Kaspersky ProjectSauron Full Report","url":"https://securelist.com/files/2016/07/The-ProjectSauron-APT_research_KL.pdf"},{"source_name":"ComputerWeekly Strider","url":"https://www.computerweekly.com/news/450302128/Strider-cyber-attack-group-deploying-malware-for-espionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--49cf55fb-437d-439d-aeb7-466de585a0ed","subject":"ATTACK:enterprise:S1074","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--49cf55fb-437d-439d-aeb7-466de585a0ed","modified":"2026-04-29T14:23:06.026Z","references":[{"source_name":"Mandiant Suspected Turla Campaign February 2023","url":"https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4a942244-9b88-43d0-9a1c-c0277e7903e8","subject":"ATTACK:enterprise:S0565","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4a942244-9b88-43d0-9a1c-c0277e7903e8","modified":"2026-04-29T14:23:06.027Z","references":[{"source_name":"Symantec RAINDROP January 2021","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware"},{"source_name":"Microsoft Deep Dive Solorigate January 2021","url":"https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4c4cdef4-a2e9-42af-bd3d-876ae3cc2d4d","subject":"ATTACK:enterprise:G1055","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4c4cdef4-a2e9-42af-bd3d-876ae3cc2d4d","modified":"2026-07-31T18:48:25.522Z","references":[{"source_name":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"},{"source_name":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4d1b4d28-84c8-4ae4-9e04-c437dc391eac","subject":"ATTACK:enterprise:G0134","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4d1b4d28-84c8-4ae4-9e04-c437dc391eac","modified":"2026-07-31T18:48:24.171Z","references":[{"source_name":"Kaspersky Transparent Tribe August 2020","url":"https://securelist.com/transparent-tribe-part-1/98127/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4da943df-a7dc-499f-a8b7-ca8d298d8ff6","subject":"ATTACK:enterprise:G0018","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4da943df-a7dc-499f-a8b7-ca8d298d8ff6","modified":"2026-07-31T18:47:39.484Z","references":[{"source_name":"FireEye admin@338","url":"https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4dee672e-a7ed-41de-94b6-83246688171d","subject":"ATTACK:enterprise:S9035","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4dee672e-a7ed-41de-94b6-83246688171d","modified":"2026-04-29T14:23:06.031Z","references":[{"source_name":"Splunk LAMEHUG SEP 2025","url":"https://www.splunk.com/en_us/blog/security/lamehug-ai-driven-malware-llm-cyber-intrusion-analysis.html"},{"source_name":"Nov AI Threat Tracker","url":"https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4e18fbf9-4e26-4425-bb09-f18406284368","subject":"ATTACK:enterprise:C0032","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4e18fbf9-4e26-4425-bb09-f18406284368","modified":"2026-07-31T18:47:25.943Z","references":[{"source_name":"FireEye TRITON 2019","url":"https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4f17c215-893f-4c2d-9d9f-944b170d21e5","subject":"ATTACK:enterprise:S0483","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4f17c215-893f-4c2d-9d9f-944b170d21e5","modified":"2026-04-29T14:23:06.033Z","references":[{"source_name":"Trendmicro_IcedID","url":"https://www.trendmicro.com/en_us/research/22/l/icedid-botnet-distributors-abuse-google-ppc-to-distribute-malware.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4feaa82b-a356-4412-be2b-daa6ea6df82c","subject":"ATTACK:enterprise:G1006","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4feaa82b-a356-4412-be2b-daa6ea6df82c","modified":"2026-07-31T20:48:48.187Z","references":[{"source_name":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4ffe2425-c971-45e5-9256-0b1a2bf63bbf","subject":"ATTACK:enterprise:S0084","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4ffe2425-c971-45e5-9256-0b1a2bf63bbf","modified":"2026-04-29T14:23:06.034Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"},{"source_name":"Microsoft DTC","url":"https://technet.microsoft.com/en-us/library/cc759136(v=ws.10).aspx"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5017f2dc-e43e-438b-b63f-5f3f4603e9db","subject":"ATTACK:enterprise:G0135","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5017f2dc-e43e-438b-b63f-5f3f4603e9db","modified":"2026-07-31T18:48:11.227Z","references":[{"source_name":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--506d7613-59ce-4fa4-90b3-f991691d5b93","subject":"ATTACK:enterprise:S0526","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--506d7613-59ce-4fa4-90b3-f991691d5b93","modified":"2026-04-29T14:23:06.035Z","references":[{"source_name":"Cybereason Kimsuky November 2020","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--509a016a-6243-40b1-b1b5-74f6c79ce413","subject":"ATTACK:enterprise:S0606","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--509a016a-6243-40b1-b1b5-74f6c79ce413","modified":"2026-04-29T14:23:06.035Z","references":[{"source_name":"ESET Bad Rabbit","url":"https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/"},{"source_name":"Secure List Bad Rabbit","url":"https://securelist.com/bad-rabbit-ransomware/82851/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5263da97-9946-4768-99de-b5b7e91e52ba","subject":"ATTACK:enterprise:G1024","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5263da97-9946-4768-99de-b5b7e91e52ba","modified":"2026-07-31T18:47:55.062Z","references":[{"source_name":"Cisco Akira Ransomware OCT 2024","url":"https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5449bc94-31c6-471a-8525-23af9cdc25bd","subject":"ATTACK:enterprise:S0567","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5449bc94-31c6-471a-8525-23af9cdc25bd","modified":"2026-04-29T14:23:06.040Z","references":[{"source_name":"CyberBit Dtrack","url":"https://www.cyberbit.com/blog/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--558b32a6-f870-4d7f-bbdd-1590e21db2c3","subject":"ATTACK:enterprise:S1158","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--558b32a6-f870-4d7f-bbdd-1590e21db2c3","modified":"2026-04-29T14:23:06.042Z","references":[{"source_name":"Google Cloud APT41 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--55eb87ba-64a9-4720-a3ce-fe03f66b074c","subject":"ATTACK:enterprise:S1196","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--55eb87ba-64a9-4720-a3ce-fe03f66b074c","modified":"2026-04-29T14:23:06.042Z","references":[{"source_name":"S2W Troll Stealer 2024","url":"https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"},{"source_name":"Symantec Troll Stealer 2024","url":"https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--59d3a882-3f6d-442a-8fbe-bb2f9cecd2f5","subject":"ATTACK:enterprise:G0137","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--59d3a882-3f6d-442a-8fbe-bb2f9cecd2f5","modified":"2026-07-31T18:47:59.565Z","references":[{"source_name":"Kaspersky Ferocious Kitten Jun 2021","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--59e2e811-8f23-40bc-ae20-040feb1fa1fe","subject":"ATTACK:enterprise:S1042","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--59e2e811-8f23-40bc-ae20-040feb1fa1fe","modified":"2026-04-29T14:23:06.048Z","references":[{"source_name":"Mandiant UNC3890 Aug 2022","url":"https://www.mandiant.com/resources/blog/suspected-iranian-actor-targeting-israeli-shipping"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--59eef083-632d-412d-b8bd-de8ba39c8de6","subject":"ATTACK:enterprise:G1058","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--59eef083-632d-412d-b8bd-de8ba39c8de6","modified":"2026-09-23T22:38:39.505Z","references":[{"source_name":"SoučekESET_Gentlemen_Jun2026","url":"https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5a1876a1-144f-4416-b9bf-6df819613962","subject":"ATTACK:enterprise:S0196","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5a1876a1-144f-4416-b9bf-6df819613962","modified":"2026-04-29T14:23:06.048Z","references":[{"source_name":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"},{"source_name":"Morphisec ShellTea June 2019","url":"http://blog.morphisec.com/security-alert-fin8-is-back"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5bb90c4f-b260-4de2-8312-8de73df3fead","subject":"ATTACK:enterprise:S0340","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5bb90c4f-b260-4de2-8312-8de73df3fead","modified":"2026-04-29T14:23:06.050Z","references":[{"source_name":"Securelist Octopus Oct 2018","url":"https://securelist.com/octopus-infested-seas-of-central-asia/88200/"},{"source_name":"ESET Nomadic Octopus 2018","url":"https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5cba4a5e-c005-495d-9cd6-60794d9b3247","subject":"ATTACK:enterprise:S0446","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5cba4a5e-c005-495d-9cd6-60794d9b3247","modified":"2026-04-29T14:23:06.052Z","references":[{"source_name":"CrowdStrike Ryuk January 2019","url":"https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5df34449-b814-4580-a32c-d02f25cd8fe4","subject":"ATTACK:enterprise:G1039","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5df34449-b814-4580-a32c-d02f25cd8fe4","modified":"2026-07-31T18:48:06.115Z","references":[{"source_name":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source_name":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--62363450-709a-4b52-a07d-2bf0c2f7dd8e","subject":"ATTACK:enterprise:S1242","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--62363450-709a-4b52-a07d-2bf0c2f7dd8e","modified":"2026-04-29T14:23:06.059Z","references":[{"source_name":"Cisco Talos Qilin Ransomware OCT 2025","url":"https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--62f8a6c8-fb99-4fbf-b7ec-46278a6133b9","subject":"ATTACK:enterprise:S9019","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--62f8a6c8-fb99-4fbf-b7ec-46278a6133b9","modified":"2026-04-29T14:23:06.059Z","references":[{"source_name":"Zscaler PureCrypter JUN 2022","url":"https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--654d9e83-9501-4de8-8828-1a1ebf36bc8f","subject":"ATTACK:enterprise:S0070","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--654d9e83-9501-4de8-8828-1a1ebf36bc8f","modified":"2026-04-29T14:23:06.063Z","references":[{"source_name":"ZScaler Hacking Team","url":"http://research.zscaler.com/2015/08/chinese-cyber-espionage-apt-group.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--676e0a28-8e7b-4ee3-b456-e1dedaafccc0","subject":"ATTACK:enterprise:S1237","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--676e0a28-8e7b-4ee3-b456-e1dedaafccc0","modified":"2026-04-29T14:23:06.066Z","references":[{"source_name":"Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--67e631d1-439f-4630-9662-8ea74ab10234","subject":"ATTACK:enterprise:S1063","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--67e631d1-439f-4630-9662-8ea74ab10234","modified":"2026-04-29T14:23:06.066Z","references":[{"source_name":"Palo Alto Brute Ratel July 2022","url":"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--67f1d68d-fe0f-4e65-8b2a-f614fda68e3c","subject":"ATTACK:enterprise:S0353","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--67f1d68d-fe0f-4e65-8b2a-f614fda68e3c","modified":"2026-04-29T14:23:06.066Z","references":[{"source_name":"Unit 42 NOKKI Sept 2018","url":"https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--68017126-a4fe-4c2d-926d-fbc51ea8573c","subject":"ATTACK:enterprise:S0395","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--68017126-a4fe-4c2d-926d-fbc51ea8573c","modified":"2026-04-29T14:23:06.066Z","references":[{"source_name":"ESET LightNeuron May 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6828b200-b067-4667-9a77-9e434a625eaf","subject":"ATTACK:enterprise:G0016","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6828b200-b067-4667-9a77-9e434a625eaf","modified":"2026-07-31T18:48:08.119Z","references":[{"source_name":"Mandiant APT29 Microsoft 365 2022","url":"https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"},{"source_name":"SentinelOne NobleBaron June 2021","url":"https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6a1ddd06-a5bd-440b-aa19-285e7370477c","subject":"ATTACK:enterprise:G0007","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6a1ddd06-a5bd-440b-aa19-285e7370477c","modified":"2026-07-31T20:48:44.801Z","references":[{"source_name":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6a9d5f63-e3f8-4980-834b-f83660095e5c","subject":"ATTACK:enterprise:C0012","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6a9d5f63-e3f8-4980-834b-f83660095e5c","modified":"2026-07-31T18:47:28.284Z","references":[{"source_name":"Cybereason OperationCuckooBees May 2022","url":"https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-winnti-techniques"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6c216abc-f0ae-4ce1-aa74-6ccf2d42e6a5","subject":"ATTACK:enterprise:C0050","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6c216abc-f0ae-4ce1-aa74-6ccf2d42e6a5","modified":"2026-07-31T18:47:23.852Z","references":[{"source_name":"Lumen J-Magic JAN 2025","url":"https://blog.lumen.com/the-j-magic-show-magic-packets-and-where-to-find-them/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6ef55051-c152-4491-a881-31ff98fb773e","subject":"ATTACK:enterprise:S0587","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6ef55051-c152-4491-a881-31ff98fb773e","modified":"2026-04-29T14:23:06.076Z","references":[{"source_name":"Leonardo Turla Penquin May 2020","url":"https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6f201842-1ce8-459f-a7a7-a81d6e7950a9","subject":"ATTACK:enterprise:S0582","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6f201842-1ce8-459f-a7a7-a81d6e7950a9","modified":"2026-04-29T14:23:06.077Z","references":[{"source_name":"Proofpoint LookBack Malware Aug 2019","url":"https://www.proofpoint.com/us/threat-insight/post/lookback-malware-targets-united-states-utilities-sector-phishing-attacks"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7023af7e-91e0-4d7a-852e-ac7299820daa","subject":"ATTACK:enterprise:S0493","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7023af7e-91e0-4d7a-852e-ac7299820daa","modified":"2026-04-29T14:23:06.078Z","references":[{"source_name":"Trustwave GoldenSpy June 2020","url":"https://www.trustwave.com/en-us/resources/library/documents/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7148e604-1e3a-4a37-be3e-cde2fe20f9b6","subject":"ATTACK:enterprise:G0019","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7148e604-1e3a-4a37-be3e-cde2fe20f9b6","modified":"2026-07-31T18:47:46.248Z","references":[{"source_name":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--71b2b21e-bb44-47eb-85da-7a593419c0c5","subject":"ATTACK:enterprise:S0622","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--71b2b21e-bb44-47eb-85da-7a593419c0c5","modified":"2026-04-29T14:23:06.080Z","references":[{"source_name":"Malwarebytes Kimsuky June 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--71d14fd4-c393-4dd9-9ae3-3970295ac4a5","subject":"ATTACK:enterprise:S1124","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--71d14fd4-c393-4dd9-9ae3-3970295ac4a5","modified":"2026-04-29T14:23:06.081Z","references":[{"source_name":"SocGholish-update","url":"https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--71fcb2f2-85d0-4d59-8d6e-8b5a1ccb7d29","subject":"ATTACK:enterprise:S1035","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--71fcb2f2-85d0-4d59-8d6e-8b5a1ccb7d29","modified":"2026-04-29T14:23:06.081Z","references":[{"source_name":"NCSC GCHQ Small Sieve Jan 2022","url":"https://www.ncsc.gov.uk/files/NCSC-Malware-Analysis-Report-Small-Sieve.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--72b03734-7e03-4cfe-8f0f-2d366febfb79","subject":"ATTACK:enterprise:S0386","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--72b03734-7e03-4cfe-8f0f-2d366febfb79","modified":"2026-04-29T14:23:06.082Z","references":[{"source_name":"TrendMicro Ursnif Mar 2015","url":"https://web.archive.org/web/20210719165945/https://www.trendmicro.com/en_us/research/15/c/ursnif-the-multifaceted-malware.html?_ga=2.165628854.808042651.1508120821-744063452.1505819992"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--72cb3a93-f4c1-43a8-9a62-43bf1f6f4889","subject":"ATTACK:enterprise:S0409","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--72cb3a93-f4c1-43a8-9a62-43bf1f6f4889","modified":"2026-04-29T14:23:06.082Z","references":[{"source_name":"ESET Machete July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"},{"source_name":"Securelist Machete Aug 2014","url":"https://securelist.com/el-machete/66108/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7351ee6a-b054-41ab-8485-6875924ac129","subject":"ATTACK:enterprise:S1153","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7351ee6a-b054-41ab-8485-6875924ac129","modified":"2026-04-29T14:23:06.083Z","references":[{"source_name":"Kandji Cuckoo April 2024","url":"https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware"},{"source_name":"SentinelOne Cuckoo Stealer May 2024","url":"https://www.sentinelone.com/blog/macos-cuckoo-stealer-ensuring-detection-and-defense-as-new-samples-rapidly-emerge/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--73672e43-5a42-4b6a-934b-a52f57bdd7ac","subject":"ATTACK:enterprise:T1036.005","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1036","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--73672e43-5a42-4b6a-934b-a52f57bdd7ac","modified":"2026-04-29T14:23:06.083Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--74cc85f8-594d-428b-a44a-5ede87df0ad9","subject":"ATTACK:enterprise:G0114","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--74cc85f8-594d-428b-a44a-5ede87df0ad9","modified":"2026-07-31T20:48:41.358Z","references":[{"source_name":"Cycraft Chimera April 2020","url":"https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--75155c7f-3804-4f83-bbcb-4f654a5182e5","subject":"ATTACK:enterprise:S0595","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--75155c7f-3804-4f83-bbcb-4f654a5182e5","modified":"2026-04-29T14:23:06.085Z","references":[{"source_name":"wardle evilquest partii","url":"https://objective-see.com/blog/blog_0x60.html"},{"source_name":"reed thiefquest ransomware analysis","url":"https://blog.malwarebytes.com/mac/2020/07/mac-thiefquest-malware-may-not-be-ransomware-after-all/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--772a4f4f-459d-411f-a8e9-2c453274f684","subject":"ATTACK:enterprise:S0445","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--772a4f4f-459d-411f-a8e9-2c453274f684","modified":"2026-04-29T14:23:06.088Z","references":[{"source_name":"FOX-IT May 2016 Mofang","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--78ba82a1-e803-42c1-b112-ce999369d348","subject":"ATTACK:enterprise:S0534","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--78ba82a1-e803-42c1-b112-ce999369d348","modified":"2026-04-29T14:23:06.090Z","references":[{"source_name":"Cybereason Bazar July 2020","url":"https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"},{"source_name":"NCC Group Team9 June 2020","url":"https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"},{"source_name":"CrowdStrike Wizard Spider October 2020","url":"https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--79d85e89-658e-4a38-b406-624fbe13ce9e","subject":"ATTACK:enterprise:S0586","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--79d85e89-658e-4a38-b406-624fbe13ce9e","modified":"2026-04-29T14:23:06.092Z","references":[{"source_name":"CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7c73e018-a001-4de1-a607-3add2242bd73","subject":"ATTACK:enterprise:S0694","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7c73e018-a001-4de1-a607-3add2242bd73","modified":"2026-04-29T14:23:06.096Z","references":[{"source_name":"ClearSky Lazarus Aug 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7caebc50-4c1b-4ac0-953b-705d9e1026f4","subject":"ATTACK:enterprise:S1039","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7caebc50-4c1b-4ac0-953b-705d9e1026f4","modified":"2026-04-29T14:23:06.096Z","references":[{"source_name":"Medium Ali Salem Bumblebee April 2022","url":"https://elis531989.medium.com/the-chronicles-of-bumblebee-the-hook-the-bee-and-the-trickbot-connection-686379311056"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7e3afacc-85c0-49a3-ae44-0a57c7ee0427","subject":"ATTACK:enterprise:S1236","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7e3afacc-85c0-49a3-ae44-0a57c7ee0427","modified":"2026-04-29T14:23:06.098Z","references":[{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7e3bef4f-f75a-42a2-bb77-df7b44a322d4","subject":"ATTACK:enterprise:G0143","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7e3bef4f-f75a-42a2-bb77-df7b44a322d4","modified":"2026-07-31T18:47:59.346Z","references":[{"source_name":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7e7d5aa9-6860-44fe-88b9-22a6b36162e2","subject":"ATTACK:enterprise:G0050","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7e7d5aa9-6860-44fe-88b9-22a6b36162e2","modified":"2026-07-31T18:47:44.943Z","references":[{"source_name":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"},{"source_name":"Volexity Ocean Lotus November 2020","url":"https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--81791886-02a4-4417-a2e7-d44f5a7f83bf","subject":"ATTACK:enterprise:S0500","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--81791886-02a4-4417-a2e7-d44f5a7f83bf","modified":"2026-04-29T14:23:06.102Z","references":[{"source_name":"Secureworks MCMD July 2019","url":"https://www.secureworks.com/research/mcmd-malware-analysis"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--81ab128a-9c3f-4237-b6b1-7f2b681a8719","subject":"ATTACK:enterprise:S1034","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--81ab128a-9c3f-4237-b6b1-7f2b681a8719","modified":"2026-04-29T14:23:06.103Z","references":[{"source_name":"Cybereason StrifeWater Feb 2022","url":"https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--81f979db-6420-4686-9239-085ff2a8cc53","subject":"ATTACK:enterprise:S0559","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--81f979db-6420-4686-9239-085ff2a8cc53","modified":"2026-04-29T14:23:06.103Z","references":[{"source_name":"Microsoft Deep Dive Solorigate January 2021","url":"https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--822688d0-d948-414f-b26a-2110d222a233","subject":"ATTACK:enterprise:G0004","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--822688d0-d948-414f-b26a-2110d222a233","modified":"2026-07-31T18:48:01.341Z","references":[{"source_name":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--86b103ec-dfa0-4c0a-ad96-b885345b4711","subject":"ATTACK:enterprise:S0269","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--86b103ec-dfa0-4c0a-ad96-b885345b4711","modified":"2026-04-29T14:23:06.109Z","references":[{"source_name":"Unit 42 QUADAGENT July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--882002ca-25a6-4226-9cc4-3efe5f798449","subject":"ATTACK:enterprise:S0458","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--882002ca-25a6-4226-9cc4-3efe5f798449","modified":"2026-04-29T14:23:06.111Z","references":[{"source_name":"Eset Ramsay May 2020","url":"https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"},{"source_name":"Antiy CERT Ramsay April 2020","url":"https://www.programmersought.com/article/62493896999/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8996ab0b-8bc5-4c17-9bd5-a29b6c771f62","subject":"ATTACK:enterprise:C0017","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8996ab0b-8bc5-4c17-9bd5-a29b6c771f62","modified":"2026-07-31T21:12:32.439Z","references":[{"source_name":"Mandiant APT41","url":"https://www.mandiant.com/resources/apt41-us-state-governments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8a2a70a5-044d-4869-9d11-10499c8848bc","subject":"ATTACK:enterprise:G0081","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8a2a70a5-044d-4869-9d11-10499c8848bc","modified":"2026-07-31T18:47:57.335Z","references":[{"source_name":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8ab4fa22-a24c-4596-996e-4abf190521da","subject":"ATTACK:enterprise:G0059","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8ab4fa22-a24c-4596-996e-4abf190521da","modified":"2026-07-31T18:48:28.896Z","references":[{"source_name":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source_name":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"},{"source_name":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8ac5b693-ed9b-483e-9f7c-7cd1357e3499","subject":"ATTACK:enterprise:S1160","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8ac5b693-ed9b-483e-9f7c-7cd1357e3499","modified":"2026-04-29T14:23:06.114Z","references":[{"source_name":"Elastic Latrodectus May 2024","url":"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8b345565-9a36-4b4a-ace5-b4c50ea894ca","subject":"ATTACK:enterprise:S0578","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8b345565-9a36-4b4a-ace5-b4c50ea894ca","modified":"2026-04-29T14:23:06.115Z","references":[{"source_name":"Guidepoint SUPERNOVA Dec 2020","url":"https://www.guidepointsecurity.com/supernova-solarwinds-net-webshell-analysis/"},{"source_name":"Unit42 SUPERNOVA Dec 2020","url":"https://unit42.paloaltonetworks.com/solarstorm-supernova/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8c689316-1b25-4ca6-9cff-e36a88c0d6b3","subject":"ATTACK:enterprise:G0099","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8c689316-1b25-4ca6-9cff-e36a88c0d6b3","modified":"2026-07-31T18:48:18.585Z","references":[{"source_name":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8e824b6e-a0b7-4a57-9a7e-89b2c390beec","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8e824b6e-a0b7-4a57-9a7e-89b2c390beec","modified":"2026-04-29T14:23:06.119Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"EclecticIQ Mustang Panda PlugX","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"},{"source_name":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"},{"source_name":"Sophos PlugX September 2022","url":"https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"},{"source_name":"Sophos Mustang Panda PLUGX","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8f8d2b41-acb9-4fdf-ad90-c59fd6fad882","subject":"ATTACK:enterprise:S0402","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8f8d2b41-acb9-4fdf-ad90-c59fd6fad882","modified":"2026-04-29T14:23:06.121Z","references":[{"source_name":"Carbon Black Shlayer Feb 2019","url":"https://blogs.vmware.com/security/2020/02/vmware-carbon-black-tau-threat-analysis-shlayer-macos.html"},{"source_name":"Intego Shlayer Feb 2018","url":"https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--90e64a7a-42e6-4b95-ae85-5ac324d7f6e2","subject":"ATTACK:enterprise:S0188","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--90e64a7a-42e6-4b95-ae85-5ac324d7f6e2","modified":"2026-04-29T14:23:06.123Z","references":[{"source_name":"Symantec Sowbug Nov 2017","url":"https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--91668436-9db8-4a88-9dc0-c55681f80a6f","subject":"ATTACK:enterprise:S0631","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--91668436-9db8-4a88-9dc0-c55681f80a6f","modified":"2026-04-29T14:23:06.123Z","references":[{"source_name":"Cybereason Chaes Nov 2020","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--92348457-3761-4298-aedc-14fa7fd4810c","subject":"ATTACK:enterprise:G0056","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--92348457-3761-4298-aedc-14fa7fd4810c","modified":"2026-07-31T20:48:51.306Z","references":[{"source_name":"Talos Promethium June 2020","url":"https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"},{"source_name":"Bitdefender StrongPity June 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--94d68862-0b6a-4a32-ab9c-61c0ddb457c9","subject":"ATTACK:enterprise:S9033","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--94d68862-0b6a-4a32-ab9c-61c0ddb457c9","modified":"2026-04-29T14:23:06.128Z","references":[{"source_name":"ESET_MuddyWater_Dec2025","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9862c41f-f2fe-4178-af9d-903b17c48c14","subject":"ATTACK:enterprise:C0056","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9862c41f-f2fe-4178-af9d-903b17c48c14","modified":"2026-07-31T18:47:20.198Z","references":[{"source_name":"Mandiant UNC3886 Juniper Routers MAR 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9b2a6cfa-3b05-4809-b778-3752bb152c2d","subject":"ATTACK:enterprise:S1019","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9b2a6cfa-3b05-4809-b778-3752bb152c2d","modified":"2026-04-29T14:23:06.137Z","references":[{"source_name":"ClearSky Siamesekitten August 2021","url":"https://www.clearskysec.com/siamesekitten/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9c368600-66c9-4fad-bd0f-faa82eb26304","subject":"ATTACK:enterprise:G1057","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9c368600-66c9-4fad-bd0f-faa82eb26304","modified":"2026-07-31T18:47:58.971Z","references":[{"source_name":"Google_SHOracle_Jun2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9c6c1bab-3c23-4f0f-9e20-1eac082f6e50","subject":"ATTACK:enterprise:S1183","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9c6c1bab-3c23-4f0f-9e20-1eac082f6e50","modified":"2026-04-29T14:23:06.138Z","references":[{"source_name":"IBM StrelaStealer 2024","url":"https://securityintelligence.com/x-force/strela-stealer-todays-invoice-tomorrows-phish/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9defa430-9c4c-4dde-b952-d75394c8fd5e","subject":"ATTACK:enterprise:G1032","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9defa430-9c4c-4dde-b952-d75394c8fd5e","modified":"2026-07-31T20:48:47.729Z","references":[{"source_name":"SOCRadar INC Ransom January 2024","url":"https://socradar.io/dark-web-profile-inc-ransom/"},{"source_name":"Huntress INC Ransom Group August 2023","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a0a166b9-3aec-4dbe-b786-23f6439943eb","subject":"ATTACK:enterprise:S0661","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a0a166b9-3aec-4dbe-b786-23f6439943eb","modified":"2026-04-29T14:23:06.144Z","references":[{"source_name":"MSTIC FoggyWeb September 2021","url":"https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a1086030-ec11-44fe-9965-919a9175f3ea","subject":"ATTACK:enterprise:S0198","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a1086030-ec11-44fe-9965-919a9175f3ea","modified":"2026-04-29T14:23:06.144Z","references":[{"source_name":"Red Canary NETWIRE January 2020","url":"https://redcanary.com/blog/netwire-remote-access-trojan-on-linux/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a15d732e-b911-437b-8693-df38c1732780","subject":"ATTACK:enterprise:C0038","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a15d732e-b911-437b-8693-df38c1732780","modified":"2026-07-31T21:13:11.158Z","references":[{"source_name":"CISA Iran Albanian Attacks September 2022","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a"},{"source_name":"Mandiant ROADSWEEP August 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a1ac633d-3170-4e9e-af4a-e1a3e60a1d11","subject":"ATTACK:enterprise:S1201","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a1ac633d-3170-4e9e-af4a-e1a3e60a1d11","modified":"2026-04-29T14:23:06.145Z","references":[{"source_name":"Zscaler Kimsuky TRANSLATEXT","url":"https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a6538ee3-514a-4ee3-b2d7-1e3b9fd9727a","subject":"ATTACK:enterprise:S9008","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a6538ee3-514a-4ee3-b2d7-1e3b9fd9727a","modified":"2026-04-29T14:23:06.152Z","references":[{"source_name":"Palo Alto Unit 42 Shai-Hulud November 2025","url":"https://unit42.paloaltonetworks.com/npm-supply-chain-attack/"},{"source_name":"Socket Shai-Hulud November 2025","url":"https://socket.dev/blog/shai-hulud-strikes-again-v2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a67d4b9b-0c8f-41d8-a7f2-6d4c61fcb1ea","subject":"ATTACK:enterprise:S0136","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a67d4b9b-0c8f-41d8-a7f2-6d4c61fcb1ea","modified":"2026-04-29T14:23:06.152Z","references":[{"source_name":"ESET Sednit USBStealer 2014","url":"http://www.welivesecurity.com/2014/11/11/sednit-espionage-group-attacking-air-gapped-networks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a7149564-023f-4746-925d-fd10bb1069a9","subject":"ATTACK:enterprise:S1249","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a7149564-023f-4746-925d-fd10bb1069a9","modified":"2026-04-29T14:23:06.153Z","references":[{"source_name":"Socket Contagious Interview NPM April 2025","url":"https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket"},{"source_name":"Socket HexEval BeaverTail Contagious Interview June 2025","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a8b39fac-bfe0-49c0-957f-8b8ebe2088c1","subject":"ATTACK:enterprise:S0652","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a8b39fac-bfe0-49c0-957f-8b8ebe2088c1","modified":"2026-04-29T14:23:06.155Z","references":[{"source_name":"Kaspersky Ferocious Kitten Jun 2021","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a90a5b4d-b677-4a69-8fa0-feab294c9daf","subject":"ATTACK:enterprise:C0014","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a90a5b4d-b677-4a69-8fa0-feab294c9daf","modified":"2026-07-31T18:47:31.825Z","references":[{"source_name":"FoxIT Wocao December 2019","url":"https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a980cbf6-262e-41c8-aec3-890ed77966ce","subject":"ATTACK:enterprise:G1014","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a980cbf6-262e-41c8-aec3-890ed77966ce","modified":"2026-07-31T18:48:14.971Z","references":[{"source_name":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--abc4fb0a-cd49-438e-84bb-7000fbe48b1c","subject":"ATTACK:enterprise:S0697","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--abc4fb0a-cd49-438e-84bb-7000fbe48b1c","modified":"2026-04-29T14:23:06.159Z","references":[{"source_name":"ESET Hermetic Wizard March 2022","url":"https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aca1a51b-89a5-45e9-bce5-14b5a0a4c0f1","subject":"ATTACK:enterprise:G0107","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aca1a51b-89a5-45e9-bce5-14b5a0a4c0f1","modified":"2026-07-31T18:48:14.655Z","references":[{"source_name":"Symantec Whitefly March 2019","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/whitefly-espionage-singapore"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ad1d9fc5-b971-4a89-a099-128317dd1e41","subject":"ATTACK:enterprise:S0630","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ad1d9fc5-b971-4a89-a099-128317dd1e41","modified":"2026-04-29T14:23:06.160Z","references":[{"source_name":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--add011d8-6cd3-4ae5-af51-e52ce81e277a","subject":"ATTACK:enterprise:G0049","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--add011d8-6cd3-4ae5-af51-e52ce81e277a","modified":"2026-07-31T20:48:35.758Z","references":[{"source_name":"Symantec Crambus OCT 2023","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b0e113b1-91b2-4f93-bd3c-c1d564096d34","subject":"ATTACK:enterprise:S1238","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b0e113b1-91b2-4f93-bd3c-c1d564096d34","modified":"2026-04-29T14:23:06.167Z","references":[{"source_name":"Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b19ae2dc-9cbe-45b8-8b9c-ce0cd9add29a","subject":"ATTACK:enterprise:G0095","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b19ae2dc-9cbe-45b8-8b9c-ce0cd9add29a","modified":"2026-07-31T18:47:49.940Z","references":[{"source_name":"360 Machete Sep 2020","url":"https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b3dac4f5-b074-41fa-8737-280c3369c73e","subject":"ATTACK:enterprise:S0669","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b3dac4f5-b074-41fa-8737-280c3369c73e","modified":"2026-04-29T14:23:06.171Z","references":[{"source_name":"Arghire LazyScripter","url":"https://www.securityweek.com/new-lazyscripter-hacking-group-targets-airlines/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b695f761-40ed-4988-935c-a1cf5e67c8d8","subject":"ATTACK:enterprise:S0560","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b695f761-40ed-4988-935c-a1cf5e67c8d8","modified":"2026-04-29T14:23:06.174Z","references":[{"source_name":"FireEye SUNBURST Backdoor December 2020","url":"https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"},{"source_name":"Microsoft Deep Dive Solorigate January 2021","url":"https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ba4e9848-239f-4386-a145-600da133aa39","subject":"ATTACK:enterprise:S1217","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ba4e9848-239f-4386-a145-600da133aa39","modified":"2026-04-29T14:23:06.179Z","references":[{"source_name":"Google Cloud Threat Intelligence ESXi VIBs 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bbf116bf-6f8a-44f4-9d98-db6ccbbff333","subject":"ATTACK:enterprise:G0008","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bbf116bf-6f8a-44f4-9d98-db6ccbbff333","modified":"2026-07-31T18:47:56.610Z","references":[{"source_name":"Kaspersky Carbanak","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bc1bee0f-2e60-452d-8e11-3ba3993ebbd9","subject":"ATTACK:enterprise:C0006","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bc1bee0f-2e60-452d-8e11-3ba3993ebbd9","modified":"2026-07-31T18:47:21.070Z","references":[{"source_name":"McAfee Honeybee","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bcc68931-0e79-4dc2-898d-3e553a7a9669","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bcc68931-0e79-4dc2-898d-3e553a7a9669","modified":"2026-07-31T20:48:47.105Z","references":[{"source_name":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source_name":"CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--be215fcd-d28a-4aa4-9d40-16f536f4e8cb","subject":"ATTACK:enterprise:S0600","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--be215fcd-d28a-4aa4-9d40-16f536f4e8cb","modified":"2026-04-29T14:23:06.185Z","references":[{"source_name":"Intezer Doki July 20","url":"https://www.intezer.com/blog/cloud-security/watch-your-containers-doki-infecting-docker-servers-in-the-cloud/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--be94a9ae-e54a-427e-8caa-36cea954abcb","subject":"ATTACK:enterprise:S0562","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--be94a9ae-e54a-427e-8caa-36cea954abcb","modified":"2026-04-29T14:23:06.186Z","references":[{"source_name":"CrowdStrike SUNSPOT Implant January 2021","url":"https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bf672181-ef16-4d3a-a587-9ac82ac87b8a","subject":"ATTACK:enterprise:S0588","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bf672181-ef16-4d3a-a587-9ac82ac87b8a","modified":"2026-04-29T14:23:06.187Z","references":[{"source_name":"MSTIC NOBELIUM Mar 2021","url":"https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"},{"source_name":"CrowdStrike StellarParticle January 2022","url":"https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bf97744d-8bb9-4ac9-9883-8233a0b3845d","subject":"ATTACK:enterprise:S9030","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bf97744d-8bb9-4ac9-9883-8233a0b3845d","modified":"2026-04-29T14:23:06.187Z","references":[{"source_name":"Check Point Wirte NOV 2024","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bfa9ae5f-0e45-4a43-9d37-00c9574a1528","subject":"ATTACK:enterprise:S0128","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bfa9ae5f-0e45-4a43-9d37-00c9574a1528","modified":"2026-04-29T14:23:06.187Z","references":[{"source_name":"PaloAlto Patchwork Mar 2018","url":"https://researchcenter.paloaltonetworks.com/2018/03/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c5cf4822-a0bf-442a-9943-1937ac45520b","subject":"ATTACK:enterprise:S0058","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c5cf4822-a0bf-442a-9943-1937ac45520b","modified":"2026-04-29T14:23:06.196Z","references":[{"source_name":"Baumgartner Naikon 2015","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c5fd969c-7fda-4f3a-9f54-1f1455f14956","subject":"ATTACK:enterprise:G0012","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c5fd969c-7fda-4f3a-9f54-1f1455f14956","modified":"2026-07-31T18:48:12.060Z","references":[{"source_name":"Microsoft DUBNIUM June 2016","url":"https://www.microsoft.com/security/blog/2016/06/09/reverse-engineering-dubnium-2/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c7823efd-005f-49ad-94cf-ebc44a87abed","subject":"ATTACK:enterprise:G0006","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c7823efd-005f-49ad-94cf-ebc44a87abed","modified":"2026-07-31T18:48:01.478Z","references":[{"source_name":"Mandiant APT1 Appendix","url":"https://www.mandiant.com/sites/default/files/2021-09/mandiant-apt1-report.pdf"},{"source_name":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c7c24601-7125-4079-9d48-138594b3f86c","subject":"ATTACK:enterprise:S0182","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c7c24601-7125-4079-9d48-138594b3f86c","modified":"2026-04-29T14:23:06.198Z","references":[{"source_name":"Microsoft FinFisher March 2018","url":"https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/"},{"source_name":"FinFisher Citation","url":"https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cc42a6c0-ce7c-442b-8ccc-cb5a9fba3462","subject":"ATTACK:enterprise:G0108","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cc42a6c0-ce7c-442b-8ccc-cb5a9fba3462","modified":"2026-07-31T18:48:02.947Z","references":[{"source_name":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ccb80607-a8bf-4e6b-a3e3-1755cd317552","subject":"ATTACK:enterprise:G0121","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ccb80607-a8bf-4e6b-a3e3-1755cd317552","modified":"2026-07-31T18:47:52.114Z","references":[{"source_name":"Rewterz Sidewinder COVID-19 June 2020","url":"https://www.rewterz.com/articles/analysis-on-sidewinder-apt-group-covid-19"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ccd6c063-9699-4592-b903-3becc2008b91","subject":"ATTACK:enterprise:S1018","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ccd6c063-9699-4592-b903-3becc2008b91","modified":"2026-04-29T14:23:06.205Z","references":[{"source_name":"Malwarebytes Saint Bot April 2021","url":"https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cceb2661-fec2-40be-9357-c3949b510e65","subject":"ATTACK:enterprise:S9043","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cceb2661-fec2-40be-9357-c3949b510e65","modified":"2026-07-29T19:52:57.484Z","references":[{"source_name":"Hunt.io TeamPCP Toolkit MAY 2026","url":"https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ceadd093-d60f-452e-a145-671d010bba50","subject":"ATTACK:enterprise:S1078","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ceadd093-d60f-452e-a145-671d010bba50","modified":"2026-04-29T14:23:06.208Z","references":[{"source_name":"netlab360 rotajakiro vs oceanlotus","url":"https://blog.netlab.360.com/rotajakiro_linux_version_of_oceanlotus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cebd1b11-835d-4d96-b1cf-7836bf50f403","subject":"ATTACK:enterprise:S0665","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cebd1b11-835d-4d96-b1cf-7836bf50f403","modified":"2026-04-29T14:23:06.208Z","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cf29f1f0-867f-4e08-9442-d10f75ec7702","subject":"ATTACK:enterprise:S0259","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cf29f1f0-867f-4e08-9442-d10f75ec7702","modified":"2026-04-29T14:23:06.209Z","references":[{"source_name":"ASERT InnaputRAT April 2018","url":"https://asert.arbornetworks.com/innaput-actors-utilize-remote-access-trojan-since-2016-presumably-targeting-victim-files/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cfa19bf2-af5e-4050-a3d9-fbd9684b867e","subject":"ATTACK:enterprise:S0274","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cfa19bf2-af5e-4050-a3d9-fbd9684b867e","modified":"2026-04-29T14:23:06.209Z","references":[{"source_name":"Securelist Calisto July 2018","url":"https://securelist.com/calisto-trojan-for-macos/86543/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d0e52896-097b-4133-9aee-75b74a4bbc7c","subject":"ATTACK:enterprise:S1046","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d0e52896-097b-4133-9aee-75b74a4bbc7c","modified":"2026-04-29T14:23:06.211Z","references":[{"source_name":"DHS CISA AA22-055A MuddyWater February 2022","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d1e98b60-3705-4617-bcec-5b03219d8949","subject":"ATTACK:enterprise:S9034","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d1e98b60-3705-4617-bcec-5b03219d8949","modified":"2026-04-29T14:23:06.212Z","references":[{"source_name":"SecureListUbiedo_Tsundere_Nov2025","url":"https://securelist.com/tsundere-node-js-botnet-uses-ethereum-blockchain/117979/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d1f144a7-1872-44da-94e3-7b2fca53a267","subject":"ATTACK:enterprise:S9042","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d1f144a7-1872-44da-94e3-7b2fca53a267","modified":"2026-07-27T20:20:02.947Z","references":[{"source_name":"Aikido TeamPCP Trivy MAR 2026","url":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d297b77f-9511-429a-b148-d7b8f0b5b502","subject":"ATTACK:enterprise:S0187","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d297b77f-9511-429a-b148-d7b8f0b5b502","modified":"2026-04-29T14:23:06.213Z","references":[{"source_name":"Symantec Tick Apr 2016","url":"https://www.symantec.com/connect/blogs/tick-cyberespionage-group-zeros-japan"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d464c661-d4da-427f-8c16-dfc275735fe9","subject":"ATTACK:enterprise:G0045","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d464c661-d4da-427f-8c16-dfc275735fe9","modified":"2026-07-31T18:47:44.568Z","references":[{"source_name":"District Court of NY APT10 Indictment December 2018","url":"https://www.justice.gov/opa/page/file/1122671/download"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d4ac3315-4b5c-4373-a7ea-0c389545f4a3","subject":"ATTACK:enterprise:S1099","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d4ac3315-4b5c-4373-a7ea-0c389545f4a3","modified":"2026-04-29T14:23:06.216Z","references":[{"source_name":"Kaspersky ToddyCat June 2022","url":"https://securelist.com/toddycat/106799/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d62b68f1-d58d-463e-b7a4-858f196bf8ce","subject":"ATTACK:enterprise:S1197","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d62b68f1-d58d-463e-b7a4-858f196bf8ce","modified":"2026-04-29T14:23:06.218Z","references":[{"source_name":"Symantec Troll Stealer 2024","url":"https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d6829fd4-7c9b-495f-9689-d1be1939f99e","subject":"ATTACK:enterprise:S0455","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d6829fd4-7c9b-495f-9689-d1be1939f99e","modified":"2026-04-29T14:23:06.218Z","references":[{"source_name":"Medium Metamorfo Apr 2020","url":"https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767"},{"source_name":"ESET Casbaneiro Oct 2019","url":"https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d6d66a6f-dbc8-4d7b-b3fc-634f2765429a","subject":"ATTACK:enterprise:G0054","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d6d66a6f-dbc8-4d7b-b3fc-634f2765429a","modified":"2026-07-31T18:48:21.342Z","references":[{"source_name":"Symantec Sowbug Nov 2017","url":"https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d76a4696-ace5-4951-9733-a63a49479240","subject":"ATTACK:enterprise:G1003","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d76a4696-ace5-4951-9733-a63a49479240","modified":"2026-07-31T18:48:13.596Z","references":[{"source_name":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d77aa71a-e37f-4c8e-a4ad-b33a700afb7a","subject":"ATTACK:enterprise:S0583","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d77aa71a-e37f-4c8e-a4ad-b33a700afb7a","modified":"2026-04-29T14:23:06.219Z","references":[{"source_name":"CERT-FR PYSA April 2020","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-003.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d7a244fa-f52c-4e54-9088-6f9ccda8b2b9","subject":"ATTACK:enterprise:G0087","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d7a244fa-f52c-4e54-9088-6f9ccda8b2b9","modified":"2026-07-31T18:47:54.063Z","references":[{"source_name":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"},{"source_name":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d8b43377-366c-42c6-a4d2-ddcfd1228bbf","subject":"ATTACK:enterprise:S1070","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d8b43377-366c-42c6-a4d2-ddcfd1228bbf","modified":"2026-04-29T14:23:06.221Z","references":[{"source_name":"Check Point Black Basta October 2022","url":"https://research.checkpoint.com/2022/black-basta-and-the-unnoticed-delivery/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d9d62a84-34e0-4397-9e88-1a39d29e4e15","subject":"ATTACK:enterprise:G1047","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d9d62a84-34e0-4397-9e88-1a39d29e4e15","modified":"2026-07-31T18:48:24.184Z","references":[{"source_name":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dbbef446-8cc0-43cc-bfae-6fc6d7310e67","subject":"ATTACK:enterprise:G0094","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dbbef446-8cc0-43cc-bfae-6fc6d7310e67","modified":"2026-07-31T20:48:25.550Z","references":[{"source_name":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"},{"source_name":"EnkiWhiteHat_KimsukyDOCSWAP_Dec2025","url":"https://www.enki.co.kr/en/media-center/blog/kimsuky-distributing-malicious-mobile-app-via-qr-code"},{"source_name":"Kimsuky Malwarebytes","url":"https://www.malwarebytes.com/blog/threat-intelligence/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dc580eb2-72fc-4516-9ef0-202da9209e80","subject":"ATTACK:enterprise:C0063","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dc580eb2-72fc-4516-9ef0-202da9209e80","modified":"2026-07-31T20:48:20.015Z","references":[{"source_name":"CERT Polska","url":"https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dccba6fb-529c-44c9-9d98-bea2bfc43f43","subject":"ATTACK:enterprise:S0690","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dccba6fb-529c-44c9-9d98-bea2bfc43f43","modified":"2026-04-29T14:23:06.227Z","references":[{"source_name":"Objective See Green Lambert for OSX Oct 2021","url":"https://objective-see.com/blog/blog_0x68.html"},{"source_name":"Glitch-Cat Green Lambert ATTCK Oct 2021","url":"https://web.archive.org/web/20211018145402/https://www.glitch-cat.com/blog/green-lambert-and-attack"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ddb0965b-83ac-4746-bfaa-a7356691ef43","subject":"ATTACK:enterprise:G1023","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ddb0965b-83ac-4746-bfaa-a7356691ef43","modified":"2026-07-31T18:48:17.516Z","references":[{"source_name":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--de6a4e97-7142-41d8-9830-2146ebef9db7","subject":"ATTACK:enterprise:S9037","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--de6a4e97-7142-41d8-9830-2146ebef9db7","modified":"2026-04-29T14:23:06.229Z","references":[{"source_name":"CloudSEK_RustyWater_Jan2026","url":"https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--de6b1b02-f96d-45b8-b358-eb2bd8abbdec","subject":"ATTACK:enterprise:C0061","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--de6b1b02-f96d-45b8-b358-eb2bd8abbdec","modified":"2026-07-31T18:47:24.877Z","references":[{"source_name":"sentinelone operationDigitalEye Dec 2024","url":"https://www.sentinelone.com/labs/operation-digital-eye-chinese-apt-compromises-critical-digital-infrastructure-via-visual-studio-code-tunnels/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dedfdac6-c76b-4baa-99ca-3f0233141d2d","subject":"ATTACK:enterprise:S0410","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dedfdac6-c76b-4baa-99ca-3f0233141d2d","modified":"2026-04-29T14:23:06.229Z","references":[{"source_name":"Fysbis Dr Web Analysis","url":"https://vms.drweb.com/virus/?i=4276269"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--df69c29c-01c4-4541-988e-8a5765439d56","subject":"ATTACK:enterprise:G0033","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--df69c29c-01c4-4541-988e-8a5765439d56","modified":"2026-07-31T18:48:05.292Z","references":[{"source_name":"Kaspersky Poseidon Group","url":"https://securelist.com/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/73673/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e1034190-fc61-495d-9510-21ae85762173","subject":"ATTACK:enterprise:S9050","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e1034190-fc61-495d-9510-21ae85762173","modified":"2026-09-28T17:56:51.551Z","references":[{"source_name":"Intrinsec_Vidar_April2026","url":"https://www.intrinsec.com/wp-content/uploads/2026/04/TLP_CLEAR-20260424-New_Vidar.pdf"},{"source_name":"Logpoint_StealerMalwareFamilies_2024","url":"https://web.archive.org/web/20240517205011/https://www.logpoint.com/wp-content/uploads/2024/03/logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families-1.pdf"},{"source_name":"Unit42_Vidar_July2026","url":"https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/"},{"source_name":"QuorumCyber_Vidar_March2023","url":"https://www.quorumcyber.com/wp-content/uploads/2023/01/Malware-Analysis-Vidar.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e3038b75-63f6-44c2-9645-673bbf0ffa3b","subject":"ATTACK:enterprise:G0091","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e3038b75-63f6-44c2-9645-673bbf0ffa3b","modified":"2026-07-31T18:48:21.505Z","references":[{"source_name":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e3caf4ea-efa0-4919-8bef-1b56425f7ef5","subject":"ATTACK:enterprise:S1041","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e3caf4ea-efa0-4919-8bef-1b56425f7ef5","modified":"2026-04-29T14:23:06.235Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e51ab951-2e6f-4c7e-bd10-fe0dc0bb4671","subject":"ATTACK:enterprise:G0117","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e51ab951-2e6f-4c7e-bd10-fe0dc0bb4671","modified":"2026-07-31T18:48:17.850Z","references":[{"source_name":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e68684df-28b4-4f06-b553-cacf14866605","subject":"ATTACK:enterprise:S0144","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e68684df-28b4-4f06-b553-cacf14866605","modified":"2026-04-29T14:23:06.239Z","references":[{"source_name":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e7b5511a-3528-48d1-9224-6c5ff88b3825","subject":"ATTACK:enterprise:S0141","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e7b5511a-3528-48d1-9224-6c5ff88b3825","modified":"2026-04-29T14:23:06.240Z","references":[{"source_name":"Microsoft Winnti Jan 2017","url":"https://blogs.technet.microsoft.com/mmpc/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e8352090-00a3-4a0b-b8ba-c2308bdc9312","subject":"ATTACK:enterprise:G1022","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e8352090-00a3-4a0b-b8ba-c2308bdc9312","modified":"2026-07-31T18:48:14.449Z","references":[{"source_name":"Kaspersky ToddyCat June 2022","url":"https://securelist.com/toddycat/106799/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e87dfcbe-5175-4506-93f4-a5a3415d8cc6","subject":"ATTACK:enterprise:S1248","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e87dfcbe-5175-4506-93f4-a5a3415d8cc6","modified":"2026-04-29T14:23:06.241Z","references":[{"source_name":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e8edf0d8-3c24-4082-9177-1bfb6e7d95c6","subject":"ATTACK:enterprise:S0477","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e8edf0d8-3c24-4082-9177-1bfb6e7d95c6","modified":"2026-04-29T14:23:06.242Z","references":[{"source_name":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e92df95b-ac85-4926-9b6a-957b342d47ec","subject":"ATTACK:enterprise:S9031","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e92df95b-ac85-4926-9b6a-957b342d47ec","modified":"2026-04-29T14:23:06.242Z","references":[{"source_name":"Palo Alto Ashen Lepus DEC 2025","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e9b4a99d-6ddb-40bb-918a-363ddbdac448","subject":"ATTACK:enterprise:G1008","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e9b4a99d-6ddb-40bb-918a-363ddbdac448","modified":"2026-07-31T18:47:37.013Z","references":[{"source_name":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e9ddb0b6-298e-4061-b194-c9ea5d49c6d0","subject":"ATTACK:enterprise:S0268","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e9ddb0b6-298e-4061-b194-c9ea5d49c6d0","modified":"2026-04-29T14:23:06.243Z","references":[{"source_name":"Talos Bisonal Mar 2020","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ea606b59-74e1-495c-a93d-c04418d86eb6","subject":"ATTACK:enterprise:S0015","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ea606b59-74e1-495c-a93d-c04418d86eb6","modified":"2026-04-29T14:23:06.244Z","references":[{"source_name":"Trend Micro IXESHE 2012","url":"https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ebf39235-749f-400e-aeb9-185df9e43fe1","subject":"ATTACK:enterprise:S0475","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ebf39235-749f-400e-aeb9-185df9e43fe1","modified":"2026-04-29T14:23:06.246Z","references":[{"source_name":"Unit 42 BackConfig May 2020","url":"https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ed136275-95b7-4f46-914c-a7f964558278","subject":"ATTACK:enterprise:S0625","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ed136275-95b7-4f46-914c-a7f964558278","modified":"2026-04-29T14:23:06.248Z","references":[{"source_name":"McAfee Cuba April 2021","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ee4e5ea3-3d81-42ab-b259-9970f1f7d736","subject":"ATTACK:enterprise:S0501","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ee4e5ea3-3d81-42ab-b259-9970f1f7d736","modified":"2026-04-29T14:23:06.249Z","references":[{"source_name":"ESET PipeMon May 2020","url":"https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ef175c83-cc75-462a-93b1-bf9bb1f99290","subject":"ATTACK:enterprise:G0010","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ef175c83-cc75-462a-93b1-bf9bb1f99290","modified":"2026-07-31T18:48:04.402Z","references":[{"source_name":"ESET Turla Lunar toolset May 2024","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--efe1cabd-63cf-46d6-8010-93504832bc03","subject":"ATTACK:enterprise:G0129","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--efe1cabd-63cf-46d6-8010-93504832bc03","modified":"2026-07-31T18:47:53.755Z","references":[{"source_name":"Recorded Future REDDELTA July 2020","url":"https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"},{"source_name":"Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f0fb848a-8237-4887-b2cf-f916d477a92c","subject":"ATTACK:enterprise:S1228","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f0fb848a-8237-4887-b2cf-f916d477a92c","modified":"2026-04-29T14:23:06.253Z","references":[{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f1e6b3b2-4502-44f6-8340-128a0e3126a6","subject":"ATTACK:enterprise:S1017","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f1e6b3b2-4502-44f6-8340-128a0e3126a6","modified":"2026-04-29T14:23:06.254Z","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f246be13-4b00-4739-aedb-091cf6115182","subject":"ATTACK:enterprise:G1059","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f246be13-4b00-4739-aedb-091cf6115182","modified":"2026-10-01T18:31:18.311Z","references":[{"source_name":"CheckPoint_NimbusManticore_May2026","url":"https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f2502637-0d4a-4b94-928d-1f140f2d0ba1","subject":"ATTACK:enterprise:S0491","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f2502637-0d4a-4b94-928d-1f140f2d0ba1","modified":"2026-09-03T14:50:24.167Z","references":[{"source_name":"Talos Promethium June 2020","url":"https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f49cdf8b-a093-4f24-8b22-d0489756cc0d","subject":"ATTACK:enterprise:S0666","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f49cdf8b-a093-4f24-8b22-d0489756cc0d","modified":"2026-04-29T14:23:06.257Z","references":[{"source_name":"ESET Gelsemium June 2021","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f4f3a2bc-d359-400e-8b1e-95d71a20c323","subject":"ATTACK:enterprise:S0356","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f4f3a2bc-d359-400e-8b1e-95d71a20c323","modified":"2026-04-29T14:23:06.258Z","references":[{"source_name":"Talos Konni May 2017","url":"https://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f5ce003c-c220-4c19-a45f-b2e2a6e924e2","subject":"ATTACK:enterprise:G1016","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f5ce003c-c220-4c19-a45f-b2e2a6e924e2","modified":"2026-07-31T18:48:31.573Z","references":[{"source_name":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f82724f9-846b-442e-826c-a38a74a93737","subject":"ATTACK:enterprise:S0334","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f82724f9-846b-442e-826c-a38a74a93737","modified":"2026-04-29T14:23:06.262Z","references":[{"source_name":"TrendMicro DarkComet Sept 2014","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/DARKCOMET"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f863b935-fd1e-4604-be94-a7ae150b8d53","subject":"ATTACK:enterprise:S0605","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f863b935-fd1e-4604-be94-a7ae150b8d53","modified":"2026-04-29T14:23:06.262Z","references":[{"source_name":"Dragos EKANS","url":"https://www.dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f9dc35b9-5cf9-4dbf-a1fd-698c95c047c5","subject":"ATTACK:enterprise:C0013","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f9dc35b9-5cf9-4dbf-a1fd-698c95c047c5","modified":"2026-07-31T18:47:20.410Z","references":[{"source_name":"McAfee Sharpshooter December 2018","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fabd053f-487c-404f-b1b0-b090e442ff83","subject":"ATTACK:enterprise:S0260","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fabd053f-487c-404f-b1b0-b090e442ff83","modified":"2026-04-29T14:23:06.265Z","references":[{"source_name":"ESET InvisiMole June 2018","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"},{"source_name":"ESET InvisiMole June 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fb9cf04b-ad28-472a-9ee3-a2e744e0e122","subject":"ATTACK:enterprise:S0086","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fb9cf04b-ad28-472a-9ee3-a2e744e0e122","modified":"2026-04-29T14:23:06.266Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fd534cf2-9818-492b-9f11-6e5e7994d77b","subject":"ATTACK:enterprise:S1084","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fd534cf2-9818-492b-9f11-6e5e7994d77b","modified":"2026-04-29T14:23:06.269Z","references":[{"source_name":"Mandiant APT29 Eye Spy Email Nov 22","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fed23938-8fbc-4b67-8452-f2f413eed291","subject":"ATTACK:enterprise:G0034","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fed23938-8fbc-4b67-8452-f2f413eed291","modified":"2026-07-31T20:48:33.452Z","references":[{"source_name":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"},{"source_name":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ff438715-ffa8-4fa2-a69e-7126dd60bfb3","subject":"ATTACK:enterprise:G0106","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ff438715-ffa8-4fa2-a69e-7126dd60bfb3","modified":"2026-07-31T18:47:52.794Z","references":[{"source_name":"Talos Rocke August 2018","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}