{"record":{"id":"ATTACK:enterprise:T1041","title":"Exfiltration Over C2 Channel","type":"Technique","source_url":"https://attack.mitre.org/techniques/T1041","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--92d7da27-2d91-488e-a00c-059dc162766d","external_id":"T1041","domain":"enterprise","created":"2017-05-31T21:30:41.804Z","modified":"2026-09-11T19:45:01.540Z","version":"2.4","aliases":[],"tactics":["exfiltration"],"source_references":[{"source_name":"C2 FRAMEWORKS","url":"https://www.redfoxsec.com/blog/introduction-to-c2-frameworks-how-attackers-control-compromised-systems"}]},"assertions":[{"id":"enterprise:relationship--0116fbf2-4402-41af-bc5b-216e0e27c2db","subject":"ATTACK:enterprise:S1172","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0116fbf2-4402-41af-bc5b-216e0e27c2db","modified":"2026-09-03T19:46:54.026Z","references":[{"source_name":"ESET OilRig Downloaders DEC 2023","url":"https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--03341b9d-6848-4430-a868-b2bc61b357ba","subject":"ATTACK:enterprise:S0459","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--03341b9d-6848-4430-a868-b2bc61b357ba","modified":"2026-09-03T19:46:54.139Z","references":[{"source_name":"Unit 42 MechaFlounder March 2019","url":"https://unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--036d0469-5302-48c9-b957-ae52cee49861","subject":"ATTACK:enterprise:S9035","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--036d0469-5302-48c9-b957-ae52cee49861","modified":"2026-09-03T19:46:54.254Z","references":[{"source_name":"Splunk LAMEHUG SEP 2025","url":"https://www.splunk.com/en_us/blog/security/lamehug-ai-driven-malware-llm-cyber-intrusion-analysis.html"},{"source_name":"Nov AI Threat Tracker","url":"https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--03f69381-89e2-411a-8302-323c8a1bddfa","subject":"ATTACK:enterprise:S0428","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--03f69381-89e2-411a-8302-323c8a1bddfa","modified":"2026-09-03T19:46:54.416Z","references":[{"source_name":"Talos PoetRAT October 2020","url":"https://blog.talosintelligence.com/2020/10/poetrat-update.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--06317104-8397-453e-bef8-aa3269360ffc","subject":"ATTACK:enterprise:S0445","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--06317104-8397-453e-bef8-aa3269360ffc","modified":"2026-09-03T19:46:54.490Z","references":[{"source_name":"FOX-IT May 2016 Mofang","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--08482fa2-6db3-4c82-8ca0-9d666454f2c6","subject":"ATTACK:enterprise:S1019","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--08482fa2-6db3-4c82-8ca0-9d666454f2c6","modified":"2026-09-03T19:46:54.587Z","references":[{"source_name":"ClearSky Siamesekitten August 2021","url":"https://www.clearskysec.com/siamesekitten/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0977de2b-86f0-4c40-bd6f-9c54ad1a56c0","subject":"ATTACK:enterprise:S1210","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0977de2b-86f0-4c40-bd6f-9c54ad1a56c0","modified":"2026-09-03T19:46:54.693Z","references":[{"source_name":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0c6329d8-4f00-4b3b-aa82-3bc2e9f14766","subject":"ATTACK:enterprise:S0533","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0c6329d8-4f00-4b3b-aa82-3bc2e9f14766","modified":"2026-09-03T19:46:54.872Z","references":[{"source_name":"CISA MAR SLOTHFULMEDIA October 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0e08fbc4-2fe5-4761-8f70-3dc74af48a57","subject":"ATTACK:enterprise:S1183","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0e08fbc4-2fe5-4761-8f70-3dc74af48a57","modified":"2026-09-03T19:46:54.968Z","references":[{"source_name":"PaloAlto StrelaStealer 2024","url":"https://unit42.paloaltonetworks.com/strelastealer-campaign/"},{"source_name":"DCSO StrelaStealer 2022","url":"https://medium.com/@DCSO_CyTec/shortandmalicious-strelastealer-aims-for-mail-credentials-a4c3e78c8abc"},{"source_name":"Fortgale StrelaStealer 2023","url":"https://fortgale.com/blog/malware-analysis/strelastealer-malware-analysis-2/"},{"source_name":"IBM StrelaStealer 2024","url":"https://securityintelligence.com/x-force/strela-stealer-todays-invoice-tomorrows-phish/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0f483f1d-cd24-4446-8725-8af01fcd089c","subject":"ATTACK:enterprise:S1017","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0f483f1d-cd24-4446-8725-8af01fcd089c","modified":"2026-09-03T19:46:55.084Z","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--13953007-34e2-44e9-96af-53bed8f4413c","subject":"ATTACK:enterprise:S1246","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--13953007-34e2-44e9-96af-53bed8f4413c","modified":"2026-09-03T19:46:55.264Z","references":[{"source_name":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"},{"source_name":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--13ef6179-f624-4a3f-8095-a86609e31828","subject":"ATTACK:enterprise:S0234","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--13ef6179-f624-4a3f-8095-a86609e31828","modified":"2026-09-03T19:46:55.375Z","references":[{"source_name":"CheckPoint Bandook Nov 2020","url":"https://research.checkpoint.com/2020/bandook-signed-delivered/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--152e4b86-e51c-4470-84ff-5b6985b1c660","subject":"ATTACK:enterprise:S9015","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--152e4b86-e51c-4470-84ff-5b6985b1c660","modified":"2026-09-03T19:46:55.451Z","references":[{"source_name":"CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025","url":"https://www.crowdstrike.com/en-us/blog/warp-panda-cloud-threats/"},{"source_name":"CISA BRICKSTORM UNC5221 AR25-338A February 2026","url":"https://www.cisa.gov/news-events/analysis-reports/ar25-338a"},{"source_name":"Picus Security BRICKSTORM UNC5221 October 2025","url":"https://www.picussecurity.com/resource/blog/brickstorm-malware-unc5221-targets-tech-and-legal-sectors-in-the-united-states"},{"source_name":"Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement"},{"source_name":"NVISO BRICKSTORM April 2025","url":"https://blog.nviso.eu/wp-content/uploads/2025/04/NVISO-BRICKSTORM-Report.pdf"},{"source_name":"Resecurity UNC5221 BRICKSTORM F5 Big-IP October 2025","url":"https://www.resecurity.com/blog/article/f5-big-ip-source-code-leak-tied-to-state-linked-campaigns-using-brickstorm-backdoor"},{"source_name":"Google BRICKSTORM September 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1678d731-c556-4968-aab1-ae745015308f","subject":"ATTACK:enterprise:S0431","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1678d731-c556-4968-aab1-ae745015308f","modified":"2026-09-03T19:46:55.661Z","references":[{"source_name":"Carbon Black HotCroissant April 2020","url":"https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--185bd112-5e1f-4059-9e42-b8b80874e8f2","subject":"ATTACK:enterprise:S1021","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--185bd112-5e1f-4059-9e42-b8b80874e8f2","modified":"2026-09-03T19:46:55.781Z","references":[{"source_name":"Zscaler Lyceum DnsSystem June 2022","url":"https://www.zscaler.com/blogs/security-research/lyceum-net-dns-backdoor"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--18e170d7-ff3f-450b-9366-cea23216b60e","subject":"ATTACK:enterprise:S0409","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--18e170d7-ff3f-450b-9366-cea23216b60e","modified":"2026-09-03T19:46:55.865Z","references":[{"source_name":"ESET Machete July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--19c9e7ee-69eb-4c1f-82de-727a5e37bcb8","subject":"ATTACK:enterprise:S9052","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--19c9e7ee-69eb-4c1f-82de-727a5e37bcb8","modified":"2026-09-24T18:50:51.305Z","references":[{"source_name":"CheckPoint_NimbusManticore_May2026","url":"https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1d02066a-a26b-46fe-a9d6-731c8d8b0566","subject":"ATTACK:enterprise:G1015","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1d02066a-a26b-46fe-a9d6-731c8d8b0566","modified":"2026-09-03T19:46:56.053Z","references":[{"source_name":"Mandiant VMware vSphere JUL 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1d11c326-7640-4ddd-b5fe-c8eaf4097c20","subject":"ATTACK:enterprise:S1039","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1d11c326-7640-4ddd-b5fe-c8eaf4097c20","modified":"2026-09-03T19:46:56.146Z","references":[{"source_name":"Google EXOTIC LILY March 2022","url":"https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1d17e8d5-7a65-4d67-bfec-0ef7cad974d9","subject":"ATTACK:enterprise:S0584","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1d17e8d5-7a65-4d67-bfec-0ef7cad974d9","modified":"2026-09-03T19:46:56.238Z","references":[{"source_name":"CISA AppleJeus Feb 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-048a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1fec545d-436a-4b70-8ab8-87d217956b8f","subject":"ATTACK:enterprise:S1090","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1fec545d-436a-4b70-8ab8-87d217956b8f","modified":"2026-09-03T19:46:56.412Z","references":[{"source_name":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--20411ea5-3d8e-4c97-a04d-418e2798eb5c","subject":"ATTACK:enterprise:S1188","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--20411ea5-3d8e-4c97-a04d-418e2798eb5c","modified":"2026-09-03T19:46:56.472Z","references":[{"source_name":"Cisco ArcaneDoor 2024","url":"https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--213ea969-5e60-4128-9794-a09fb5f5eb5e","subject":"ATTACK:enterprise:S0670","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--213ea969-5e60-4128-9794-a09fb5f5eb5e","modified":"2026-09-03T19:46:56.564Z","references":[{"source_name":"Check Point Warzone Feb 2020","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--21900cf5-72e2-4661-b137-0753710b4f9d","subject":"ATTACK:enterprise:S0678","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--21900cf5-72e2-4661-b137-0753710b4f9d","modified":"2026-09-03T19:46:56.658Z","references":[{"source_name":"McAfee Lazarus Nov 2020","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2211dd80-6ab2-4d3b-90fd-3ae19e75b64f","subject":"ATTACK:enterprise:S1042","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2211dd80-6ab2-4d3b-90fd-3ae19e75b64f","modified":"2026-09-03T19:46:56.728Z","references":[{"source_name":"Mandiant UNC3890 Aug 2022","url":"https://www.mandiant.com/resources/blog/suspected-iranian-actor-targeting-israeli-shipping"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--246b5a38-8569-4145-af9a-0078f398e1d1","subject":"ATTACK:enterprise:S1030","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--246b5a38-8569-4145-af9a-0078f398e1d1","modified":"2026-09-03T19:46:56.808Z","references":[{"source_name":"ZScaler Squirrelwaffle Sep 2021","url":"https://www.zscaler.com/blogs/security-research/squirrelwaffle-new-loader-delivering-cobalt-strike"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--28d81681-8dcf-45ee-a5e6-378327ce93ce","subject":"ATTACK:enterprise:G1014","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--28d81681-8dcf-45ee-a5e6-378327ce93ce","modified":"2026-09-03T19:46:56.901Z","references":[{"source_name":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--29818fd0-e6df-4871-b025-938c77978544","subject":"ATTACK:enterprise:G0034","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--29818fd0-e6df-4871-b025-938c77978544","modified":"2026-09-03T19:46:57.020Z","references":[{"source_name":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2ad83456-5794-44d5-bfd1-3c51b2925c01","subject":"ATTACK:enterprise:G0114","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2ad83456-5794-44d5-bfd1-3c51b2925c01","modified":"2026-09-03T19:46:57.116Z","references":[{"source_name":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2b07bb81-4843-423c-a29c-251169a845ce","subject":"ATTACK:enterprise:C0038","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2b07bb81-4843-423c-a29c-251169a845ce","modified":"2026-09-03T19:46:57.180Z","references":[{"source_name":"CISA Iran Albanian Attacks September 2022","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2c93a27a-c6f0-46b9-857b-b746e2204670","subject":"ATTACK:enterprise:S0661","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2c93a27a-c6f0-46b9-857b-b746e2204670","modified":"2026-09-03T19:46:57.238Z","references":[{"source_name":"MSTIC FoggyWeb September 2021","url":"https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--30c0f7aa-473d-42c3-81ff-f39c6f21ee52","subject":"ATTACK:enterprise:S0484","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--30c0f7aa-473d-42c3-81ff-f39c6f21ee52","modified":"2026-09-03T19:46:57.286Z","references":[{"source_name":"Prevx Carberp March 2011","url":"https://web.archive.org/web/20231227000328/http://pxnow.prevx.com/content/blog/carberp-a_modular_information_stealing_trojan.pdf"},{"source_name":"Trusteer Carberp October 2010","url":"https://web.archive.org/web/20111004014029/http://www.trusteer.com/sites/default/files/Carberp_Analysis.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--314aca1d-01a5-4549-b274-ba1112c3ca51","subject":"ATTACK:enterprise:S0083","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--314aca1d-01a5-4549-b274-ba1112c3ca51","modified":"2026-09-03T19:46:57.349Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3199779f-80be-44fa-8f21-9623e8473381","subject":"ATTACK:enterprise:S1142","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3199779f-80be-44fa-8f21-9623e8473381","modified":"2026-09-03T19:46:57.397Z","references":[{"source_name":"ESET Turla Lunar toolset May 2024","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--344bbf55-0316-49d0-a5ab-c5f79d218908","subject":"ATTACK:enterprise:S1065","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--344bbf55-0316-49d0-a5ab-c5f79d218908","modified":"2026-09-03T19:46:57.441Z","references":[{"source_name":"MalwareBytes WoodyRAT Aug 2022","url":"https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--34503727-d78b-4e67-b944-83546cc473e2","subject":"ATTACK:enterprise:M1031","predicate":"mitigates","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--34503727-d78b-4e67-b944-83546cc473e2","modified":"2026-09-03T19:46:57.502Z","references":[{"source_name":"University of Birmingham C2","url":"https://arxiv.org/pdf/1408.1136"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--354fe9c0-2b9b-43f9-98a0-ae0ee1515d4d","subject":"ATTACK:enterprise:S0491","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--354fe9c0-2b9b-43f9-98a0-ae0ee1515d4d","modified":"2026-09-03T19:46:57.553Z","references":[{"source_name":"Talos Promethium June 2020","url":"https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"},{"source_name":"Bitdefender StrongPity June 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3565539f-7ebf-4288-8422-5212c774821b","subject":"ATTACK:enterprise:S0034","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3565539f-7ebf-4288-8422-5212c774821b","modified":"2026-09-03T19:46:57.614Z","references":[{"source_name":"FireEye APT30","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--36975329-2167-4458-8470-e4a02330828a","subject":"ATTACK:enterprise:C0046","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--36975329-2167-4458-8470-e4a02330828a","modified":"2026-09-03T19:46:57.653Z","references":[{"source_name":"CCCS ArcaneDoor 2024","url":"https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns"},{"source_name":"Cisco ArcaneDoor 2024","url":"https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3757c1fd-7e60-4762-9f8b-823658d4e466","subject":"ATTACK:enterprise:S1185","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3757c1fd-7e60-4762-9f8b-823658d4e466","modified":"2026-09-03T19:46:57.705Z","references":[{"source_name":"Huntress LightSpy macOS 2024","url":"https://www.huntress.com/blog/lightspy-malware-variant-targeting-macos"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--380743e5-616c-4524-96e6-d545e5b653ea","subject":"ATTACK:enterprise:G0093","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--380743e5-616c-4524-96e6-d545e5b653ea","modified":"2026-09-03T19:46:57.751Z","references":[{"source_name":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--382ab873-523f-4455-b3c5-74d81b4fc57b","subject":"ATTACK:enterprise:G0126","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--382ab873-523f-4455-b3c5-74d81b4fc57b","modified":"2026-09-03T19:46:57.796Z","references":[{"source_name":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--399b8688-1fe9-4fa6-a984-7c01f9319a38","subject":"ATTACK:enterprise:S0658","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--399b8688-1fe9-4fa6-a984-7c01f9319a38","modified":"2026-09-03T19:46:57.847Z","references":[{"source_name":"trendmicro xcsset xcode project 2020","url":"https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf"},{"source_name":"Microsoft March 2025 XCSSET","url":"https://www.microsoft.com/en-us/security/blog/2025/03/11/new-xcsset-malware-adds-new-obfuscation-persistence-techniques-to-infect-xcode-projects/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--39d1a7ed-2388-4611-9886-915a3604c300","subject":"ATTACK:enterprise:S0363","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--39d1a7ed-2388-4611-9886-915a3604c300","modified":"2026-09-03T19:46:57.888Z","references":[{"source_name":"Talos Frankenstein June 2019","url":"https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html"},{"source_name":"Github PowerShell Empire","url":"https://github.com/PowerShellEmpire/Empire"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3abe734c-7fd2-4da6-9b0a-420f9187165c","subject":"ATTACK:enterprise:S0192","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3abe734c-7fd2-4da6-9b0a-420f9187165c","modified":"2026-09-03T19:46:57.930Z","references":[{"source_name":"GitHub Pupy","url":"https://github.com/n1nj4sec/pupy"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3b6f4d0d-352f-4e0f-8a7d-5b843a21295a","subject":"ATTACK:enterprise:S0395","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3b6f4d0d-352f-4e0f-8a7d-5b843a21295a","modified":"2026-09-03T19:46:57.974Z","references":[{"source_name":"ESET LightNeuron May 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3c662aa7-0ee8-4e42-b0b9-de0dc2f02a57","subject":"ATTACK:enterprise:S0531","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3c662aa7-0ee8-4e42-b0b9-de0dc2f02a57","modified":"2026-09-03T19:46:58.014Z","references":[{"source_name":"ESET Grandoreiro April 2020","url":"https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3cc0db99-8172-41e5-b386-3488bfb41f43","subject":"ATTACK:enterprise:S1201","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3cc0db99-8172-41e5-b386-3488bfb41f43","modified":"2026-09-03T19:46:58.057Z","references":[{"source_name":"Zscaler Kimsuky TRANSLATEXT","url":"https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3d9c09bd-5b67-40dc-9144-1dc537933865","subject":"ATTACK:enterprise:S1186","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3d9c09bd-5b67-40dc-9144-1dc537933865","modified":"2026-09-03T19:46:58.099Z","references":[{"source_name":"Cisco ArcaneDoor 2024","url":"https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3ed5a1c3-e7c8-4fb7-bfcf-401b29f5f47c","subject":"ATTACK:enterprise:S0266","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3ed5a1c3-e7c8-4fb7-bfcf-401b29f5f47c","modified":"2026-09-03T19:46:58.146Z","references":[{"source_name":"Cyberreason Anchor December 2019","url":"https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"},{"source_name":"Bitdefender Trickbot VNC module Whitepaper 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/399/Bitdefender-PR-Whitepaper-Trickbot-creat5515-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--401c021f-60eb-49ae-8019-561c2785b12f","subject":"ATTACK:enterprise:S1037","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--401c021f-60eb-49ae-8019-561c2785b12f","modified":"2026-09-03T19:46:58.192Z","references":[{"source_name":"DHS CISA AA22-055A MuddyWater February 2022","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4113ccd6-1134-4cef-bf5b-aca9a2364c82","subject":"ATTACK:enterprise:S0657","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4113ccd6-1134-4cef-bf5b-aca9a2364c82","modified":"2026-09-03T19:46:58.243Z","references":[{"source_name":"Volexity InkySquid BLUELIGHT August 2021","url":"https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--41c5b24c-6e33-43b4-ad7e-ebe7506d33b9","subject":"ATTACK:enterprise:S0650","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--41c5b24c-6e33-43b4-ad7e-ebe7506d33b9","modified":"2026-09-03T19:46:58.281Z","references":[{"source_name":"Kaspersky QakBot September 2021","url":"https://securelist.com/qakbot-technical-analysis/103931/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--42de94e7-86f3-41d9-9e01-45fff8be1451","subject":"ATTACK:enterprise:S0386","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--42de94e7-86f3-41d9-9e01-45fff8be1451","modified":"2026-09-03T19:46:58.328Z","references":[{"source_name":"TrendMicro Ursnif Mar 2015","url":"https://web.archive.org/web/20210719165945/https://www.trendmicro.com/en_us/research/15/c/ursnif-the-multifaceted-malware.html?_ga=2.165628854.808042651.1508120821-744063452.1505819992"},{"source_name":"ProofPoint Ursnif Aug 2016","url":"https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality"},{"source_name":"FireEye Ursnif Nov 2017","url":"https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--43fbea18-9a70-4f7f-90c1-2103661185d7","subject":"ATTACK:enterprise:S1173","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--43fbea18-9a70-4f7f-90c1-2103661185d7","modified":"2026-09-03T19:46:58.364Z","references":[{"source_name":"Symantec Crambus OCT 2023","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--463d9d77-abae-4848-aac4-bd4163318b8c","subject":"ATTACK:enterprise:S9020","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--463d9d77-abae-4848-aac4-bd4163318b8c","modified":"2026-09-03T19:46:58.402Z","references":[{"source_name":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--46bc2bac-2b9f-4550-bd2f-9d62ef05b887","subject":"ATTACK:enterprise:S9031","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--46bc2bac-2b9f-4550-bd2f-9d62ef05b887","modified":"2026-09-03T19:46:58.436Z","references":[{"source_name":"Palo Alto Ashen Lepus DEC 2025","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--48106cb0-a9c8-4c68-b90a-8d517078d189","subject":"ATTACK:enterprise:S0351","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--48106cb0-a9c8-4c68-b90a-8d517078d189","modified":"2026-09-03T19:46:58.476Z","references":[{"source_name":"Unit42 Cannon Nov 2018","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--48118305-47d1-4803-9057-6be6b0d2187a","subject":"ATTACK:enterprise:S1111","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--48118305-47d1-4803-9057-6be6b0d2187a","modified":"2026-09-03T19:46:58.519Z","references":[{"source_name":"Ensilo Darkgate 2018","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--48d24989-916a-46ba-b5ea-b3db838a3ae0","subject":"ATTACK:enterprise:S0674","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--48d24989-916a-46ba-b5ea-b3db838a3ae0","modified":"2026-09-03T19:46:58.554Z","references":[{"source_name":"Check Point APT35 CharmPower January 2022","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--49267afd-b71b-4dd0-a68a-128e61f7bdfd","subject":"ATTACK:enterprise:S0340","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--49267afd-b71b-4dd0-a68a-128e61f7bdfd","modified":"2026-09-03T19:46:58.596Z","references":[{"source_name":"Securelist Octopus Oct 2018","url":"https://securelist.com/octopus-infested-seas-of-central-asia/88200/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4971ab34-bfff-4384-b04f-6a7cd004ae2f","subject":"ATTACK:enterprise:S0085","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4971ab34-bfff-4384-b04f-6a7cd004ae2f","modified":"2026-09-03T19:46:58.634Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--49f2c182-bd69-4874-9102-b5fd1acac59c","subject":"ATTACK:enterprise:G0004","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--49f2c182-bd69-4874-9102-b5fd1acac59c","modified":"2026-09-03T19:46:58.659Z","references":[{"source_name":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4b2de33f-c8cf-48dc-aa6d-524460bb3e24","subject":"ATTACK:enterprise:S1064","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4b2de33f-c8cf-48dc-aa6d-524460bb3e24","modified":"2026-09-03T19:46:58.699Z","references":[{"source_name":"HP SVCReady Jun 2022","url":"https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4c5f4c95-2eca-4f8d-8e7e-16f0bb323b07","subject":"ATTACK:enterprise:G0087","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4c5f4c95-2eca-4f8d-8e7e-16f0bb323b07","modified":"2026-09-03T19:46:58.723Z","references":[{"source_name":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4e18e63e-acb5-48fc-8935-eb4416929745","subject":"ATTACK:enterprise:S0455","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4e18e63e-acb5-48fc-8935-eb4416929745","modified":"2026-09-03T19:46:58.753Z","references":[{"source_name":"ESET Casbaneiro Oct 2019","url":"https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4f32ce54-46cf-4141-9700-9978056951db","subject":"ATTACK:enterprise:S0496","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4f32ce54-46cf-4141-9700-9978056951db","modified":"2026-09-03T19:46:58.775Z","references":[{"source_name":"Secureworks REvil September 2019","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4ffcf69a-c7ef-46dc-add7-9093e454a67e","subject":"ATTACK:enterprise:S0079","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4ffcf69a-c7ef-46dc-add7-9093e454a67e","modified":"2026-09-03T19:46:58.808Z","references":[{"source_name":"Scarlet Mimic Jan 2016","url":"http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5201448e-f009-4c24-abb5-9382383dc42d","subject":"ATTACK:enterprise:S0367","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5201448e-f009-4c24-abb5-9382383dc42d","modified":"2026-09-03T19:46:58.831Z","references":[{"source_name":"Binary Defense Emotes Wi-Fi Spreader","url":"https://www.binarydefense.com/resources/blog/emotet-evolves-with-new-wi-fi-spreader/"},{"source_name":"Trend Micro Emotet Jan 2019","url":"https://documents.trendmicro.com/assets/white_papers/ExploringEmotetsActivities_Final.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--520f5440-740f-4efe-850e-ea4db340aef1","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--520f5440-740f-4efe-850e-ea4db340aef1","modified":"2026-09-03T19:46:58.858Z","references":[{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--52fb33e7-e53c-4d1f-b052-d3e373a64672","subject":"ATTACK:enterprise:S1025","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--52fb33e7-e53c-4d1f-b052-d3e373a64672","modified":"2026-09-03T19:46:58.890Z","references":[{"source_name":"BlackBerry Amadey 2020","url":"https://blogs.blackberry.com/en/2020/01/threat-spotlight-amadey-bot"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5409a62e-d298-4026-8829-550306e8e4a6","subject":"ATTACK:enterprise:S0493","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5409a62e-d298-4026-8829-550306e8e4a6","modified":"2026-09-03T19:46:58.922Z","references":[{"source_name":"Trustwave GoldenSpy June 2020","url":"https://www.trustwave.com/en-us/resources/library/documents/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5434447a-d954-4106-9657-ee62a4acf27b","subject":"ATTACK:enterprise:S0062","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5434447a-d954-4106-9657-ee62a4acf27b","modified":"2026-09-03T19:46:58.951Z","references":[{"source_name":"Kaspersky MoleRATs April 2019","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--546fc347-7844-4721-8ec4-dbf45e8ca1e7","subject":"ATTACK:enterprise:S0251","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--546fc347-7844-4721-8ec4-dbf45e8ca1e7","modified":"2026-09-03T19:46:58.984Z","references":[{"source_name":"Accenture SNAKEMACKEREL Nov 2018","url":"https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"},{"source_name":"CISA Zebrocy Oct 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303b"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--551c4e98-3dfb-472b-8fa8-6a8961dfd418","subject":"ATTACK:enterprise:S0375","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--551c4e98-3dfb-472b-8fa8-6a8961dfd418","modified":"2026-09-03T19:46:59.000Z","references":[{"source_name":"Securelist Remexi Jan 2019","url":"https://securelist.com/chafer-used-remexi-malware/89538/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--55af3bd0-d523-4394-99c6-182114c5cdc2","subject":"ATTACK:enterprise:S0600","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--55af3bd0-d523-4394-99c6-182114c5cdc2","modified":"2026-09-03T19:46:59.020Z","references":[{"source_name":"Intezer Doki July 20","url":"https://www.intezer.com/blog/cloud-security/watch-your-containers-doki-infecting-docker-servers-in-the-cloud/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--566913fd-3f30-4d33-b275-4a8c8f31a1c3","subject":"ATTACK:enterprise:S1020","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--566913fd-3f30-4d33-b275-4a8c8f31a1c3","modified":"2026-09-03T19:46:59.044Z","references":[{"source_name":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--56b308f6-0ec9-42cd-8fc7-147c8ecd5c40","subject":"ATTACK:enterprise:S1156","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--56b308f6-0ec9-42cd-8fc7-147c8ecd5c40","modified":"2026-09-03T19:46:59.066Z","references":[{"source_name":"Talos Manjusaka 2022","url":"https://blog.talosintelligence.com/manjusaka-offensive-framework/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--56db53fc-6279-48aa-9d70-f72df6d1664a","subject":"ATTACK:enterprise:G0129","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--56db53fc-6279-48aa-9d70-f72df6d1664a","modified":"2026-09-03T19:46:59.083Z","references":[{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source_name":"EclecticIQ Mustang Panda PlugX","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"},{"source_name":"Sophos PlugX September 2022","url":"https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--64ac42ff-ac81-4617-a63a-5e70f6a709c6","subject":"ATTACK:enterprise:S9062","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--64ac42ff-ac81-4617-a63a-5e70f6a709c6","modified":"2026-10-01T13:50:00.879Z","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--64b3a1a6-42c3-4874-a081-e620577f5cfd","subject":"ATTACK:enterprise:S1022","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--64b3a1a6-42c3-4874-a081-e620577f5cfd","modified":"2026-09-03T19:46:59.108Z","references":[{"source_name":"CrowdStrike IceApple May 2022","url":"https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--655005cc-a289-4878-8dc0-64f0c7d167c4","subject":"ATTACK:enterprise:S0467","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--655005cc-a289-4878-8dc0-64f0c7d167c4","modified":"2026-09-03T19:46:59.129Z","references":[{"source_name":"Kaspersky TajMahal April 2019","url":"https://securelist.com/project-tajmahal/90240/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--684ee30a-a6c6-45c0-a592-1d77eaad6bb8","subject":"ATTACK:enterprise:S1029","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--684ee30a-a6c6-45c0-a592-1d77eaad6bb8","modified":"2026-09-03T19:46:59.157Z","references":[{"source_name":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6862a553-961b-4def-86ed-3c7527bda572","subject":"ATTACK:enterprise:C0049","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6862a553-961b-4def-86ed-3c7527bda572","modified":"2026-09-03T19:46:59.180Z","references":[{"source_name":"CISA Leviathan 2024","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--68edf451-bda3-4159-9715-dbcfda8eb8e2","subject":"ATTACK:enterprise:G0022","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--68edf451-bda3-4159-9715-dbcfda8eb8e2","modified":"2026-09-03T19:46:59.200Z","references":[{"source_name":"FireEye Clandestine Fox","url":"https://www.fireeye.com/blog/threat-research/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--699d04f6-bace-4bf8-af2a-c80c62fcdd23","subject":"ATTACK:enterprise:C0017","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--699d04f6-bace-4bf8-af2a-c80c62fcdd23","modified":"2026-09-03T19:46:59.218Z","references":[{"source_name":"Mandiant APT41","url":"https://www.mandiant.com/resources/apt41-us-state-governments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--69cbfe97-c712-4ffe-ac32-b1ce605e516c","subject":"ATTACK:enterprise:S1145","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--69cbfe97-c712-4ffe-ac32-b1ce605e516c","modified":"2026-09-03T19:46:59.240Z","references":[{"source_name":"Elastic Pikabot 2024","url":"https://www.elastic.co/security-labs/pikabot-i-choose-you"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--69e152de-4cf5-416b-a52b-c6a067f1789e","subject":"ATTACK:enterprise:C0006","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--69e152de-4cf5-416b-a52b-c6a067f1789e","modified":"2026-09-03T19:46:59.262Z","references":[{"source_name":"McAfee Honeybee","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6ccbfb65-9be0-4b7c-947a-fb686e64985a","subject":"ATTACK:enterprise:S1044","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6ccbfb65-9be0-4b7c-947a-fb686e64985a","modified":"2026-09-03T19:46:59.283Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6d148641-2f9b-42af-ab5b-eee715ff14f6","subject":"ATTACK:enterprise:S1153","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6d148641-2f9b-42af-ab5b-eee715ff14f6","modified":"2026-09-03T19:46:59.304Z","references":[{"source_name":"Kandji Cuckoo April 2024","url":"https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6d28f0c8-b835-4a42-b792-bb7660e47ee7","subject":"ATTACK:enterprise:S1149","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6d28f0c8-b835-4a42-b792-bb7660e47ee7","modified":"2026-09-03T19:46:59.333Z","references":[{"source_name":"Mandiant ROADSWEEP August 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6dc0069c-5e6a-474f-946d-cc1cd13bc486","subject":"ATTACK:enterprise:G0050","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6dc0069c-5e6a-474f-946d-cc1cd13bc486","modified":"2026-09-03T19:46:59.353Z","references":[{"source_name":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6ddbec2b-2a42-476f-919d-da3e4b06a1e2","subject":"ATTACK:enterprise:C0022","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6ddbec2b-2a42-476f-919d-da3e4b06a1e2","modified":"2026-09-03T19:46:59.380Z","references":[{"source_name":"ClearSky Lazarus Aug 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6f950d42-13f2-48e0-9ecf-3c48d7562460","subject":"ATTACK:enterprise:S0603","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6f950d42-13f2-48e0-9ecf-3c48d7562460","modified":"2026-09-03T19:46:59.404Z","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7101e112-c694-498f-be15-c0790f5d8547","subject":"ATTACK:enterprise:S0376","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7101e112-c694-498f-be15-c0790f5d8547","modified":"2026-09-03T19:46:59.425Z","references":[{"source_name":"US-CERT HOPLIGHT Apr 2019","url":"https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--72895ca2-baea-4333-959c-0a0f9a97dbd5","subject":"ATTACK:enterprise:S9050","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--72895ca2-baea-4333-959c-0a0f9a97dbd5","modified":"2026-09-11T19:45:00.954Z","references":[{"source_name":"Cyfirma_Vidar_June2024","url":"https://www.cyfirma.com/research/vidar-stealer-an-in-depth-analysis-of-an-information-stealing-malware/"},{"source_name":"Unit42_Vidar_July2026","url":"https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--73779216-1b58-4834-bdd6-8dc7391d0761","subject":"ATTACK:enterprise:S9059","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--73779216-1b58-4834-bdd6-8dc7391d0761","modified":"2026-09-28T18:44:43.793Z","references":[{"source_name":"Mandiant_UNC1549_Feb2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--743a0baf-8d6d-4e4a-a72b-0413a5d49594","subject":"ATTACK:enterprise:S0439","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--743a0baf-8d6d-4e4a-a72b-0413a5d49594","modified":"2026-09-03T19:46:59.446Z","references":[{"source_name":"ESET Okrum July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--76b77ff0-54db-40bd-910b-2776c714075d","subject":"ATTACK:enterprise:S0373","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--76b77ff0-54db-40bd-910b-2776c714075d","modified":"2026-09-03T19:46:59.471Z","references":[{"source_name":"Cybereason Astaroth Feb 2019","url":"https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--77f7e0de-b717-49ce-9941-5189bf4b60f5","subject":"ATTACK:enterprise:G1052","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--77f7e0de-b717-49ce-9941-5189bf4b60f5","modified":"2026-09-03T19:46:59.508Z","references":[{"source_name":"Sentinel One Contagious Interview ClickFix September 2025","url":"https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/"},{"source_name":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source_name":"Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025","url":"https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat"},{"source_name":"Socket Contagious Interview NPM April 2025","url":"https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket"},{"source_name":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"},{"source_name":"Socket HexEval BeaverTail Contagious Interview June 2025","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"},{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"SecurityScorecard Contagious Interview October 2024","url":"https://securityscorecard.com/blog/inside-a-north-korean-phishing-operation-targeting-devops-employees/"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"},{"source_name":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7953c8bf-2e44-45e9-90f5-4db5da4ad8c2","subject":"ATTACK:enterprise:S0115","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7953c8bf-2e44-45e9-90f5-4db5da4ad8c2","modified":"2026-09-03T19:46:59.532Z","references":[{"source_name":"Cisco Talos Transparent Tribe Education Campaign July 2022","url":"https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7ac3aabb-ed01-4e7f-a247-e043261a1c3b","subject":"ATTACK:enterprise:S0391","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7ac3aabb-ed01-4e7f-a247-e043261a1c3b","modified":"2026-09-03T19:46:59.557Z","references":[{"source_name":"FireEye HAWKBALL Jun 2019","url":"https://www.fireeye.com/blog/threat-research/2019/06/government-in-central-asia-targeted-with-hawkball-backdoor.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7acdc32c-1838-47f3-a0c3-2a902de15410","subject":"ATTACK:enterprise:S9007","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7acdc32c-1838-47f3-a0c3-2a902de15410","modified":"2026-09-03T19:46:59.595Z","references":[{"source_name":"Gen Digital Kimsuky HTTPTroy October 2025","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7b28dace-9c62-4226-9878-dee480f541d4","subject":"ATTACK:enterprise:S1089","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7b28dace-9c62-4226-9878-dee480f541d4","modified":"2026-09-03T19:46:59.624Z","references":[{"source_name":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7b3f6e93-2e5e-4083-af31-a6457974cf47","subject":"ATTACK:enterprise:G0090","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7b3f6e93-2e5e-4083-af31-a6457974cf47","modified":"2026-09-03T19:46:59.648Z","references":[{"source_name":"Palo Alto Ashen Lepus DEC 2025","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7cafb7b2-5227-4340-b531-7bd134645d30","subject":"ATTACK:enterprise:S0447","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7cafb7b2-5227-4340-b531-7bd134645d30","modified":"2026-09-03T19:46:59.674Z","references":[{"source_name":"FSecure Lokibot November 2019","url":"https://www.f-secure.com/v-descs/trojan_w32_lokibot.shtml"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7ccf3e90-8099-4445-b39f-956d2807189b","subject":"ATTACK:enterprise:S0240","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7ccf3e90-8099-4445-b39f-956d2807189b","modified":"2026-09-03T19:46:59.699Z","references":[{"source_name":"Talos ROKRAT","url":"https://blog.talosintelligence.com/2017/04/introducing-rokrat.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7cf62137-2a28-4a11-b64d-8b9409656bc9","subject":"ATTACK:enterprise:S0651","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7cf62137-2a28-4a11-b64d-8b9409656bc9","modified":"2026-09-03T19:46:59.722Z","references":[{"source_name":"Checkpoint IndigoZebra July 2021","url":"https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7cfc1c10-b3d5-4e9e-907e-7379c3771161","subject":"ATTACK:enterprise:S0595","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7cfc1c10-b3d5-4e9e-907e-7379c3771161","modified":"2026-09-03T19:46:59.749Z","references":[{"source_name":"wardle evilquest partii","url":"https://objective-see.com/blog/blog_0x60.html"},{"source_name":"reed thiefquest ransomware analysis","url":"https://blog.malwarebytes.com/mac/2020/07/mac-thiefquest-malware-may-not-be-ransomware-after-all/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7f7bf7a4-4f3a-48a6-bc19-4a139ba165a0","subject":"ATTACK:enterprise:S0438","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7f7bf7a4-4f3a-48a6-bc19-4a139ba165a0","modified":"2026-09-03T19:46:59.780Z","references":[{"source_name":"ESET Attor Oct 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7fb33043-4b78-407d-a452-d242349d6c0d","subject":"ATTACK:enterprise:S0687","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7fb33043-4b78-407d-a452-d242349d6c0d","modified":"2026-09-03T19:46:59.804Z","references":[{"source_name":"NCSC Cyclops Blink February 2022","url":"https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8167df91-ca5b-4a65-b94e-a40e6d54ad40","subject":"ATTACK:enterprise:S0568","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8167df91-ca5b-4a65-b94e-a40e6d54ad40","modified":"2026-09-03T19:46:59.825Z","references":[{"source_name":"Prevailion EvilNum May 2020","url":"https://web.archive.org/web/20221209052853/https://www.prevailion.com/phantom-in-the-command-shell-2/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--84694171-7b5a-457d-ac1f-304bf0d71d4c","subject":"ATTACK:enterprise:S0520","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--84694171-7b5a-457d-ac1f-304bf0d71d4c","modified":"2026-09-03T19:46:59.840Z","references":[{"source_name":"NHS UK BLINDINGCAN Aug 2020","url":"https://digital.nhs.uk/cyber-alerts/2020/cc-3603"},{"source_name":"US-CERT BLINDINGCAN Aug 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--84afb7d8-4b2f-4995-a14c-a24b45d314fc","subject":"ATTACK:enterprise:S1160","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--84afb7d8-4b2f-4995-a14c-a24b45d314fc","modified":"2026-09-03T19:46:59.862Z","references":[{"source_name":"Bitsight Latrodectus June 2024","url":"https://www.bitsight.com/blog/latrodectus-are-you-coming-back"},{"source_name":"Latrodectus APR 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--853e7b95-9edb-4260-b08d-3dd3b922cb73","subject":"ATTACK:enterprise:S0663","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--853e7b95-9edb-4260-b08d-3dd3b922cb73","modified":"2026-09-03T19:46:59.885Z","references":[{"source_name":"Lunghi Iron Tiger Linux","url":"https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--87039f89-ab04-4851-be9b-403a599a8c8e","subject":"ATTACK:enterprise:S0652","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--87039f89-ab04-4851-be9b-403a599a8c8e","modified":"2026-09-03T19:46:59.903Z","references":[{"source_name":"Kaspersky Ferocious Kitten Jun 2021","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--89cff2ee-e94a-4707-8da4-078aef71dfa4","subject":"ATTACK:enterprise:S1178","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--89cff2ee-e94a-4707-8da4-078aef71dfa4","modified":"2026-09-03T19:46:59.924Z","references":[{"source_name":"Kaspersky ShrinkLocker 2024","url":"https://securelist.com/ransomware-abuses-bitlocker/112643/"},{"source_name":"Splunk ShrinkLocker 2024","url":"https://www.splunk.com/en_us/blog/security/shrinklocker-malware-abusing-bitlocker-to-lock-your-data.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8a0f5351-66d4-410d-9427-ff58420fc173","subject":"ATTACK:enterprise:S1016","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8a0f5351-66d4-410d-9427-ff58420fc173","modified":"2026-09-03T19:46:59.943Z","references":[{"source_name":"ESET DazzleSpy Jan 2022","url":"https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8a2c36da-dc4f-4e57-ac6f-881fb3f94c99","subject":"ATTACK:enterprise:S1248","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8a2c36da-dc4f-4e57-ac6f-881fb3f94c99","modified":"2026-09-03T19:46:59.968Z","references":[{"source_name":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8ae91ec7-32ed-46a2-9bc2-1c7b856c3cc7","subject":"ATTACK:enterprise:S0476","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8ae91ec7-32ed-46a2-9bc2-1c7b856c3cc7","modified":"2026-09-03T19:46:59.989Z","references":[{"source_name":"Unit 42 Valak July 2020","url":"https://unit42.paloaltonetworks.com/valak-evolution/"},{"source_name":"SentinelOne Valak June 2020","url":"https://assets.sentinelone.com/labs/sentinel-one-valak-i"},{"source_name":"Cybereason Valak May 2020","url":"https://www.cybereason.com/blog/valak-more-than-meets-the-eye"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8b02b838-22f8-469b-97f1-7185b06d286a","subject":"ATTACK:enterprise:S0441","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8b02b838-22f8-469b-97f1-7185b06d286a","modified":"2026-09-03T19:47:00.049Z","references":[{"source_name":"Kaspersky Cloud Atlas August 2019","url":"https://securelist.com/recent-cloud-atlas-activity/92016/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8b953ac7-23b8-4ddc-90a3-7c9d17fc4f54","subject":"ATTACK:enterprise:S1034","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8b953ac7-23b8-4ddc-90a3-7c9d17fc4f54","modified":"2026-09-03T19:47:00.074Z","references":[{"source_name":"Cybereason StrifeWater Feb 2022","url":"https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8c7806ba-febb-45a0-93d1-3d5ee4ce8aa8","subject":"ATTACK:enterprise:S1166","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8c7806ba-febb-45a0-93d1-3d5ee4ce8aa8","modified":"2026-09-03T19:47:00.096Z","references":[{"source_name":"ESET OilRig Campaigns Sep 2023","url":"https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8fbcd4e8-d2b5-408c-8b3a-1e990833705b","subject":"ATTACK:enterprise:S1060","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8fbcd4e8-d2b5-408c-8b3a-1e990833705b","modified":"2026-09-03T19:47:00.113Z","references":[{"source_name":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9124da6c-faad-43e1-a0b9-7a8374ab8c7e","subject":"ATTACK:enterprise:G0082","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9124da6c-faad-43e1-a0b9-7a8374ab8c7e","modified":"2026-09-30T20:12:43.163Z","references":[{"source_name":"Microsoft Sapphire Sleet APR 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"},{"source_name":"MIcrosoft Mastra npm Compromise JUN 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--91f79ff4-3850-4e37-807a-fe303b312e23","subject":"ATTACK:enterprise:G0094","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--91f79ff4-3850-4e37-807a-fe303b312e23","modified":"2026-09-03T19:47:00.137Z","references":[{"source_name":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source_name":"Securelist Kimsuky Sept 2013","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--921181fc-7296-4d9d-9209-86d2094bf0bd","subject":"ATTACK:enterprise:S1169","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--921181fc-7296-4d9d-9209-86d2094bf0bd","modified":"2026-09-03T19:47:00.156Z","references":[{"source_name":"ESET OilRig Campaigns Sep 2023","url":"https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9267fe42-6290-4342-8024-38d703db4376","subject":"ATTACK:enterprise:S0031","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9267fe42-6290-4342-8024-38d703db4376","modified":"2026-09-03T19:47:00.184Z","references":[{"source_name":"FireEye APT30","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9726fa12-6427-4e71-8acb-c3438e7ad5b0","subject":"ATTACK:enterprise:S1213","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9726fa12-6427-4e71-8acb-c3438e7ad5b0","modified":"2026-09-03T19:47:00.213Z","references":[{"source_name":"Fortinet LummaStealer 2024","url":"https://www.fortinet.com/blog/threat-research/lumma-variant-on-youtube"},{"source_name":"Qualys LummaStealer 2024","url":"https://blog.qualys.com/vulnerabilities-threat-research/2024/10/20/unmasking-lumma-stealer-analyzing-deceptive-tactics-with-fake-captcha"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--98402b9f-d9c6-4200-8f05-80c4b46da2bf","subject":"ATTACK:enterprise:S0667","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--98402b9f-d9c6-4200-8f05-80c4b46da2bf","modified":"2026-09-03T19:47:00.253Z","references":[{"source_name":"ESET Gelsemium June 2021","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--987786d7-5f2f-4fdd-b5cb-fddadc9982c8","subject":"ATTACK:enterprise:S0604","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--987786d7-5f2f-4fdd-b5cb-fddadc9982c8","modified":"2026-09-03T19:47:00.288Z","references":[{"source_name":"ESET Industroyer","url":"https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9afc4866-c607-4af6-bd71-eef0ab16c7b6","subject":"ATTACK:enterprise:S0615","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9afc4866-c607-4af6-bd71-eef0ab16c7b6","modified":"2026-09-03T19:47:00.322Z","references":[{"source_name":"BlackBerry CostaRicto November 2020","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9b77175f-5bf4-4f4e-a064-55d88babf1fe","subject":"ATTACK:enterprise:S0381","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9b77175f-5bf4-4f4e-a064-55d88babf1fe","modified":"2026-09-03T19:47:00.339Z","references":[{"source_name":"Korean FSI TA505 2020","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9ccf0f5a-e1c1-4be1-b823-cf087a07c670","subject":"ATTACK:enterprise:G0128","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9ccf0f5a-e1c1-4be1-b823-cf087a07c670","modified":"2026-09-03T19:47:00.357Z","references":[{"source_name":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9daabee7-614e-499a-be20-e39a404f15ee","subject":"ATTACK:enterprise:S1182","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9daabee7-614e-499a-be20-e39a404f15ee","modified":"2026-09-03T19:47:00.388Z","references":[{"source_name":"Cisco MagicRAT 2022","url":"https://blog.talosintelligence.com/lazarus-magicrat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9e26a79d-1982-46b8-b077-0bb6ca30cd3b","subject":"ATTACK:enterprise:S0649","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9e26a79d-1982-46b8-b077-0bb6ca30cd3b","modified":"2026-09-03T19:47:00.404Z","references":[{"source_name":"FireEye SMOKEDHAM June 2021","url":"https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9ed1920b-595b-40ae-954c-1b4769eac07e","subject":"ATTACK:enterprise:S0696","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9ed1920b-595b-40ae-954c-1b4769eac07e","modified":"2026-09-03T19:47:00.426Z","references":[{"source_name":"NTT Security Flagpro new December 2021","url":"https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9ee16333-0c70-4d8a-8fc7-ab81e4fe389a","subject":"ATTACK:enterprise:S0622","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9ee16333-0c70-4d8a-8fc7-ab81e4fe389a","modified":"2026-09-03T19:47:00.443Z","references":[{"source_name":"Malwarebytes Kimsuky June 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9f5398d3-f9fe-4abc-bf10-1112f106b3d5","subject":"ATTACK:enterprise:S0692","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9f5398d3-f9fe-4abc-bf10-1112f106b3d5","modified":"2026-09-03T19:47:00.464Z","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a12ce761-4e08-4fcd-b00a-7b5eb082fda4","subject":"ATTACK:enterprise:S0502","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a12ce761-4e08-4fcd-b00a-7b5eb082fda4","modified":"2026-09-03T19:47:00.478Z","references":[{"source_name":"NSA/FBI Drovorub August 2020","url":"https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a1c31042-ca50-4bcc-bd05-20eb48c655ef","subject":"ATTACK:enterprise:S0572","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a1c31042-ca50-4bcc-bd05-20eb48c655ef","modified":"2026-09-03T19:47:00.495Z","references":[{"source_name":"ClearSky Lebanese Cedar Jan 2021","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a3ff5dc8-8edf-4b2f-b253-3126c4c50a20","subject":"ATTACK:enterprise:G1043","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a3ff5dc8-8edf-4b2f-b253-3126c4c50a20","modified":"2026-09-03T19:47:00.516Z","references":[{"source_name":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a481278b-01b8-47f0-9bf9-af24de713b05","subject":"ATTACK:enterprise:S1170","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a481278b-01b8-47f0-9bf9-af24de713b05","modified":"2026-09-03T19:47:00.535Z","references":[{"source_name":"ESET OilRig Downloaders DEC 2023","url":"https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a5931b14-3087-4fc5-8167-498fc1af23f1","subject":"ATTACK:enterprise:S1075","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a5931b14-3087-4fc5-8167-498fc1af23f1","modified":"2026-09-03T19:47:00.575Z","references":[{"source_name":"Mandiant Suspected Turla Campaign February 2023","url":"https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a5e4292c-10a8-4932-86ec-1b98b96660f1","subject":"ATTACK:enterprise:S1249","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a5e4292c-10a8-4932-86ec-1b98b96660f1","modified":"2026-09-03T19:47:00.624Z","references":[{"source_name":"Socket Contagious Interview NPM April 2025","url":"https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket"},{"source_name":"Socket HexEval BeaverTail Contagious Interview June 2025","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a6d72bce-1f65-40e8-9c7b-c9c384276d6e","subject":"ATTACK:enterprise:S1240","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a6d72bce-1f65-40e8-9c7b-c9c384276d6e","modified":"2026-09-03T19:47:00.674Z","references":[{"source_name":"Proofpoint RedLine Stealer March 2020","url":"https://www.proofpoint.com/us/blog/threat-insight/new-redline-stealer-distributed-using-coronavirus-themed-email-campaign"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a778d83c-5452-49ff-87dd-dbd3ef0d380f","subject":"ATTACK:enterprise:C0014","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a778d83c-5452-49ff-87dd-dbd3ef0d380f","modified":"2026-09-03T19:47:00.712Z","references":[{"source_name":"FoxIT Wocao December 2019","url":"https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a9325bef-18be-4646-9e7b-5e7af4795f18","subject":"ATTACK:enterprise:S1148","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a9325bef-18be-4646-9e7b-5e7af4795f18","modified":"2026-09-03T19:47:00.738Z","references":[{"source_name":"Sekoia Raccoon2 2022","url":"https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis/"},{"source_name":"Sekoia Raccoon1 2022","url":"https://blog.sekoia.io/raccoon-stealer-v2-part-1-the-return-of-the-dead/"},{"source_name":"S2W Racoon 2022","url":"https://medium.com/s2wblog/raccoon-stealer-is-back-with-a-new-version-5f436e04b20d"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a9bb532c-48bf-4103-8e9f-a8951e6c0882","subject":"ATTACK:enterprise:S9008","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a9bb532c-48bf-4103-8e9f-a8951e6c0882","modified":"2026-09-03T19:47:00.766Z","references":[{"source_name":"Aikido Shai-Hulud September 2025","url":"https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-again"},{"source_name":"Palo Alto Unit 42 Shai-Hulud November 2025","url":"https://unit42.paloaltonetworks.com/npm-supply-chain-attack/"},{"source_name":"Wiz Shai-Hulud September 2025","url":"https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aac7b4ce-93ee-4feb-83da-3b2600ad75b0","subject":"ATTACK:enterprise:S0434","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aac7b4ce-93ee-4feb-83da-3b2600ad75b0","modified":"2026-09-03T19:47:00.785Z","references":[{"source_name":"QiAnXin APT-C-36 Feb2019","url":"https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ac3b6751-e615-44f6-a086-0c236742d8fd","subject":"ATTACK:enterprise:S0078","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ac3b6751-e615-44f6-a086-0c236742d8fd","modified":"2026-09-03T19:47:00.808Z","references":[{"source_name":"Scarlet Mimic Jan 2016","url":"http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--acc40539-13a0-4577-a862-e348962bf0fc","subject":"ATTACK:enterprise:S0147","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--acc40539-13a0-4577-a862-e348962bf0fc","modified":"2026-09-03T19:47:00.827Z","references":[{"source_name":"Palo Alto Gamaredon Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--acd25956-0e08-4643-a121-33f20eb4b24c","subject":"ATTACK:enterprise:S0487","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--acd25956-0e08-4643-a121-33f20eb4b24c","modified":"2026-09-03T19:47:00.843Z","references":[{"source_name":"ESET ForSSHe December 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--adbb3959-724e-4219-bf4f-eb527b191baf","subject":"ATTACK:enterprise:S9032","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--adbb3959-724e-4219-bf4f-eb527b191baf","modified":"2026-09-03T19:47:00.861Z","references":[{"source_name":"ESET_MuddyWater_Dec2025","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ae2aeca3-098f-42f2-a35e-e0d206ba84f7","subject":"ATTACK:enterprise:S1059","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ae2aeca3-098f-42f2-a35e-e0d206ba84f7","modified":"2026-09-03T19:47:00.886Z","references":[{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ae81a84a-e7a6-4f9d-b412-3f91b012f052","subject":"ATTACK:enterprise:S0610","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ae81a84a-e7a6-4f9d-b412-3f91b012f052","modified":"2026-09-03T19:47:00.906Z","references":[{"source_name":"Check Point APT34 April 2021","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--afc6e4e4-2bcc-47b7-bc0d-2866d4e1dcda","subject":"ATTACK:enterprise:S0461","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--afc6e4e4-2bcc-47b7-bc0d-2866d4e1dcda","modified":"2026-09-03T19:47:00.932Z","references":[{"source_name":"Korean FSI TA505 2020","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b148a44c-b4f9-4e19-b6b0-730b83445451","subject":"ATTACK:enterprise:G0142","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b148a44c-b4f9-4e19-b6b0-730b83445451","modified":"2026-09-03T19:47:00.961Z","references":[{"source_name":"TrendMicro Confucius APT Aug 2021","url":"https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b16afb1a-b6ee-4cfb-9fb1-966478828480","subject":"ATTACK:enterprise:S0268","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b16afb1a-b6ee-4cfb-9fb1-966478828480","modified":"2026-09-03T19:47:00.980Z","references":[{"source_name":"Talos Bisonal Mar 2020","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b3aa93e7-534f-4bd7-8df7-ed9dfa8ccccc","subject":"ATTACK:enterprise:S0448","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b3aa93e7-534f-4bd7-8df7-ed9dfa8ccccc","modified":"2026-09-03T19:47:00.997Z","references":[{"source_name":"McAfee Sharpshooter December 2018","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b3e603f6-1c4d-45f6-a903-9b945a26c706","subject":"ATTACK:enterprise:S9041","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b3e603f6-1c4d-45f6-a903-9b945a26c706","modified":"2026-09-03T19:47:01.015Z","references":[{"source_name":"Aqua Security Blog Trivy Compromise APR 2026","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"},{"source_name":"Wiz Trivy Compromise MAR 2026","url":"https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"},{"source_name":"Wiz TeamPCP KICS MAR 2026","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"},{"source_name":"Sysdig TeamPCP MAR 2026","url":"https://www.sysdig.com/blog/teampcp-expands-supply-chain-compromise-spreads-from-trivy-to-checkmarx-github-actions"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b471fc88-4709-4e9d-91a4-8072d15e70a3","subject":"ATTACK:enterprise:G1035","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b471fc88-4709-4e9d-91a4-8072d15e70a3","modified":"2026-09-03T19:47:01.036Z","references":[{"source_name":"CERT-UA WinterVivern 2023","url":"https://cert.gov.ua/article/3761104"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b5c5dc62-dbf7-40b2-897b-39243ad0f7e9","subject":"ATTACK:enterprise:S1196","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b5c5dc62-dbf7-40b2-897b-39243ad0f7e9","modified":"2026-09-03T19:47:01.052Z","references":[{"source_name":"S2W Troll Stealer 2024","url":"https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b5edabf5-4ebd-4863-821e-98ba78fcd712","subject":"ATTACK:enterprise:S1132","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b5edabf5-4ebd-4863-821e-98ba78fcd712","modified":"2026-09-03T19:47:01.070Z","references":[{"source_name":"SentinelOne Agrius 2021","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b5f8197f-d703-461a-ba51-6e7749dd8367","subject":"ATTACK:enterprise:S0385","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b5f8197f-d703-461a-ba51-6e7749dd8367","modified":"2026-09-03T19:47:01.088Z","references":[{"source_name":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"},{"source_name":"Trend Micro njRAT 2018","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/autoit-compiled-worm-affecting-removable-media-delivers-fileless-version-of-bladabindi-njrat-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bb72c8e4-4d1b-47c6-ad2d-a345826b5645","subject":"ATTACK:enterprise:S0526","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bb72c8e4-4d1b-47c6-ad2d-a345826b5645","modified":"2026-09-03T19:47:01.115Z","references":[{"source_name":"Cybereason Kimsuky November 2020","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bccb0bfa-f105-4a07-8078-0bbb7adf9073","subject":"ATTACK:enterprise:S1159","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bccb0bfa-f105-4a07-8078-0bbb7adf9073","modified":"2026-09-03T19:47:01.131Z","references":[{"source_name":"Google Cloud APT41 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bd28ef72-9f26-41e0-829c-7c3cd3bc6841","subject":"ATTACK:enterprise:S9066","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bd28ef72-9f26-41e0-829c-7c3cd3bc6841","modified":"2026-10-01T21:36:26.596Z","references":[{"source_name":"Mandiant_UNC1549_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c1bf0daf-42e0-426a-ba8a-ba892f688963","subject":"ATTACK:enterprise:S1026","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c1bf0daf-42e0-426a-ba8a-ba892f688963","modified":"2026-09-03T19:47:01.153Z","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c349ffd1-a380-4855-af78-8d8d180cc6b9","subject":"ATTACK:enterprise:S1122","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c349ffd1-a380-4855-af78-8d8d180cc6b9","modified":"2026-09-03T19:47:01.170Z","references":[{"source_name":"ESET Security Mispadu Facebook Ads 2019","url":"https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/"},{"source_name":"SCILabs Malteiro 2021","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c51d9123-7f7e-41e6-8cf7-7c7dc4170ca0","subject":"ATTACK:enterprise:G0102","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c51d9123-7f7e-41e6-8cf7-7c7dc4170ca0","modified":"2026-09-03T19:47:01.196Z","references":[{"source_name":"CrowdStrike Grim Spider May 2019","url":"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"},{"source_name":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c621754d-39c0-4ed4-96d2-6f47e8263aea","subject":"ATTACK:enterprise:S0238","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c621754d-39c0-4ed4-96d2-6f47e8263aea","modified":"2026-09-03T19:47:01.221Z","references":[{"source_name":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c6761f22-a8ed-4a9a-8d58-e8eee38ead88","subject":"ATTACK:enterprise:S0356","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c6761f22-a8ed-4a9a-8d58-e8eee38ead88","modified":"2026-09-03T19:47:01.237Z","references":[{"source_name":"Talos Konni May 2017","url":"https://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html"},{"source_name":"Malwarebytes KONNI Evolves Jan 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/konni-evolves-into-stealthier-rat/"},{"source_name":"Malwarebytes Konni Aug 2021","url":"https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c6f2fa29-30fd-45c1-8adf-ed621771bd5d","subject":"ATTACK:enterprise:S0633","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c6f2fa29-30fd-45c1-8adf-ed621771bd5d","modified":"2026-09-03T19:47:01.262Z","references":[{"source_name":"GitHub Sliver Download","url":"https://github.com/BishopFox/sliver/blob/7489c69962b52b09ed377d73d142266564845297/client/command/filesystem/download.go"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c7f04f79-4bda-4abf-8f74-4faad8a09f19","subject":"ATTACK:enterprise:S1050","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c7f04f79-4bda-4abf-8f74-4faad8a09f19","modified":"2026-09-03T19:47:01.287Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c868538d-35ff-498f-8420-f16fd4875211","subject":"ATTACK:enterprise:S1245","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c868538d-35ff-498f-8420-f16fd4875211","modified":"2026-09-03T19:47:01.311Z","references":[{"source_name":"Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c8f98ac5-7ed9-4ba7-bb38-ad3982c36559","subject":"ATTACK:enterprise:G1030","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c8f98ac5-7ed9-4ba7-bb38-ad3982c36559","modified":"2026-09-03T19:47:01.341Z","references":[{"source_name":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c902576b-935e-4c1c-ae81-5d878e0ebaa0","subject":"ATTACK:enterprise:S0671","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c902576b-935e-4c1c-ae81-5d878e0ebaa0","modified":"2026-09-03T19:47:01.365Z","references":[{"source_name":"Kaspersky Tomiris Sep 2021","url":"https://securelist.com/darkhalo-after-solarwinds-the-tomiris-connection/104311/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c92d9edc-e2a9-44e4-95ef-81632eaf14f9","subject":"ATTACK:enterprise:S0587","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c92d9edc-e2a9-44e4-95ef-81632eaf14f9","modified":"2026-09-03T19:47:01.388Z","references":[{"source_name":"Leonardo Turla Penquin May 2020","url":"https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ca4d01b7-6e5b-4e4f-8b0a-2d1eaccefa01","subject":"ATTACK:enterprise:S1024","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ca4d01b7-6e5b-4e4f-8b0a-2d1eaccefa01","modified":"2026-09-03T19:47:01.410Z","references":[{"source_name":"Microsoft POLONIUM June 2022","url":"https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cb297293-d9bb-484a-a9fb-b7b09477d38f","subject":"ATTACK:enterprise:S0239","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cb297293-d9bb-484a-a9fb-b7b09477d38f","modified":"2026-09-03T19:47:01.439Z","references":[{"source_name":"McAfee Bankshot","url":"https://securingtomorrow.mcafee.com/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cbc251b7-5541-408f-b11d-c57d600fc8cf","subject":"ATTACK:enterprise:C0001","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cbc251b7-5541-408f-b11d-c57d600fc8cf","modified":"2026-09-03T19:47:01.460Z","references":[{"source_name":"Talos Frankenstein June 2019","url":"https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cd46796f-4a71-468a-b19f-87a13894d254","subject":"ATTACK:enterprise:G0065","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cd46796f-4a71-468a-b19f-87a13894d254","modified":"2026-09-03T19:47:01.482Z","references":[{"source_name":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cd857476-0e6f-4ae1-8065-7b1e8e6661b0","subject":"ATTACK:enterprise:M1057","predicate":"mitigates","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cd857476-0e6f-4ae1-8065-7b1e8e6661b0","modified":"2026-09-03T19:47:01.506Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cdde3e80-af48-40eb-b001-2dea47e68ad8","subject":"ATTACK:enterprise:S0084","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cdde3e80-af48-40eb-b001-2dea47e68ad8","modified":"2026-09-03T19:47:01.528Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cfff835f-4c2b-4c90-b316-3807796269fc","subject":"ATTACK:enterprise:S0495","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cfff835f-4c2b-4c90-b316-3807796269fc","modified":"2026-09-03T19:47:01.547Z","references":[{"source_name":"Unit42 RDAT July 2020","url":"https://unit42.paloaltonetworks.com/oilrig-novel-c2-channel-steganography/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d361058d-a11b-470d-bed8-44bfd8e50393","subject":"ATTACK:enterprise:G0047","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d361058d-a11b-470d-bed8-44bfd8e50393","modified":"2026-09-03T19:47:01.575Z","references":[{"source_name":"Palo Alto Gamaredon Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"},{"source_name":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source_name":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d61aad08-1ad3-4cba-a8e6-a8106089a635","subject":"ATTACK:enterprise:S0680","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d61aad08-1ad3-4cba-a8e6-a8106089a635","modified":"2026-09-03T19:47:01.598Z","references":[{"source_name":"Kaspersky WIRTE November 2021","url":"https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d7ce8b92-ada4-4e8f-b073-5a497de7156a","subject":"ATTACK:enterprise:S0543","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d7ce8b92-ada4-4e8f-b073-5a497de7156a","modified":"2026-09-03T19:47:01.617Z","references":[{"source_name":"Unit42 Molerat Mar 2020","url":"https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d7fa6787-4b79-44cf-986e-558a5c7b2aac","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d7fa6787-4b79-44cf-986e-558a5c7b2aac","modified":"2026-09-03T19:47:01.641Z","references":[{"source_name":"DOJ Affidavit Search and Seizure PlugX December 2024","url":"https://www.justice.gov/archives/opa/media/1384136/dl"},{"source_name":"Sophos PlugX September 2022","url":"https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d8abe157-f6cd-4959-b9d5-e0c87d16bcfe","subject":"ATTACK:enterprise:S0045","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d8abe157-f6cd-4959-b9d5-e0c87d16bcfe","modified":"2026-09-03T19:47:01.671Z","references":[{"source_name":"ESET Sednit Part 2","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--db296410-83e6-4716-af90-ae4b7e7f3171","subject":"ATTACK:enterprise:S0477","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--db296410-83e6-4716-af90-ae4b7e7f3171","modified":"2026-09-03T19:47:01.689Z","references":[{"source_name":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dbb1d0eb-c7ee-4794-80d4-66e6281cbc63","subject":"ATTACK:enterprise:S0077","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dbb1d0eb-c7ee-4794-80d4-66e6281cbc63","modified":"2026-09-03T19:47:01.710Z","references":[{"source_name":"Scarlet Mimic Jan 2016","url":"http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dd06ea48-6dde-4753-8f2b-c2fb56bea4f4","subject":"ATTACK:enterprise:S0588","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dd06ea48-6dde-4753-8f2b-c2fb56bea4f4","modified":"2026-09-03T19:47:01.727Z","references":[{"source_name":"MSTIC NOBELIUM Mar 2021","url":"https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"},{"source_name":"FireEye SUNSHUTTLE Mar 2021","url":"https://www.fireeye.com/blog/threat-research/2021/03/sunshuttle-second-stage-backdoor-targeting-us-based-entity.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dfb4c7e9-e1af-4716-b658-9cfbadd706dc","subject":"ATTACK:enterprise:G0069","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dfb4c7e9-e1af-4716-b658-9cfbadd706dc","modified":"2026-09-03T19:47:01.749Z","references":[{"source_name":"Reaqta MuddyWater November 2017","url":"https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e1592867-e02f-4c1f-a9f2-1c60e25a1301","subject":"ATTACK:enterprise:G0038","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e1592867-e02f-4c1f-a9f2-1c60e25a1301","modified":"2026-09-03T19:47:01.776Z","references":[{"source_name":"Citizen Lab Stealth Falcon May 2016","url":"https://citizenlab.org/2016/05/stealth-falcon/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e2f6a5e0-48d0-4984-8ed7-79d1919c6645","subject":"ATTACK:enterprise:S9043","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e2f6a5e0-48d0-4984-8ed7-79d1919c6645","modified":"2026-09-03T19:47:01.794Z","references":[{"source_name":"Hunt.io TeamPCP Toolkit MAY 2026","url":"https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"},{"source_name":"Trend Micro TeamPCP MAY 2026","url":"https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"},{"source_name":"Phoenix TeamPCP 20 MAY 2026","url":"https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e6ce13c0-7a23-4974-bacc-187eedd9c6da","subject":"ATTACK:enterprise:S0377","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e6ce13c0-7a23-4974-bacc-187eedd9c6da","modified":"2026-09-03T19:47:01.811Z","references":[{"source_name":"ESET Windigo Mar 2014","url":"https://www.welivesecurity.com/2014/03/18/operation-windigo-the-vivisection-of-a-large-linux-server-side-credential-stealing-malware-campaign/"},{"source_name":"ESET Ebury May 2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/ebury-is-alive-but-unseen.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e8f8c497-9931-4b8d-ad46-31a1cf5e2c50","subject":"ATTACK:enterprise:S9014","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e8f8c497-9931-4b8d-ad46-31a1cf5e2c50","modified":"2026-09-03T19:47:01.835Z","references":[{"source_name":"Google UNC5221 Ivanti January 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e9e70d42-7810-4175-aea5-509a6541f4dd","subject":"ATTACK:enterprise:S0086","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e9e70d42-7810-4175-aea5-509a6541f4dd","modified":"2026-09-03T19:47:01.864Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ed543016-8c64-42dd-89e1-7c6a49791d80","subject":"ATTACK:enterprise:S0024","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ed543016-8c64-42dd-89e1-7c6a49791d80","modified":"2026-09-03T19:47:01.887Z","references":[{"source_name":"Malwarebytes Dyreza November 2015","url":"https://blog.malwarebytes.com/threat-analysis/2015/11/a-technical-look-at-dyreza/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--efcc09fb-4c15-4a58-9bc5-b92747eae842","subject":"ATTACK:enterprise:S1078","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--efcc09fb-4c15-4a58-9bc5-b92747eae842","modified":"2026-09-03T19:47:01.911Z","references":[{"source_name":"RotaJakiro 2021 netlab360 analysis","url":"https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--effc0ed6-b472-48ab-99b6-2d3b553f4253","subject":"ATTACK:enterprise:G1012","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--effc0ed6-b472-48ab-99b6-2d3b553f4253","modified":"2026-09-03T19:47:01.938Z","references":[{"source_name":"PWC Yellow Liderc 2023","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f187aa90-df6c-485c-bc01-dec83aca9625","subject":"ATTACK:enterprise:S0632","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f187aa90-df6c-485c-bc01-dec83aca9625","modified":"2026-09-03T19:47:01.954Z","references":[{"source_name":"Group IB GrimAgent July 2021","url":"https://www.group-ib.com/blog/grimagent/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f341ecc4-b80b-4b42-9e02-293449f842dc","subject":"ATTACK:enterprise:S9067","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f341ecc4-b80b-4b42-9e02-293449f842dc","modified":"2026-10-01T21:51:54.503Z","references":[{"source_name":"Mandiant_UNC1549_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f4dc0552-707f-453b-96c9-5e757a408e53","subject":"ATTACK:enterprise:S1081","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f4dc0552-707f-453b-96c9-5e757a408e53","modified":"2026-09-03T19:47:01.975Z","references":[{"source_name":"Gigamon BADHATCH Jul 2019","url":"https://blog.gigamon.com/2019/07/23/abadbabe-8badf00d-discovering-badhatch-and-a-detailed-look-at-fin8s-tooling/"},{"source_name":"BitDefender BADHATCH Mar 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f72dda85-719d-4e6f-bac8-2589934ae6dd","subject":"ATTACK:enterprise:S1031","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f72dda85-719d-4e6f-bac8-2589934ae6dd","modified":"2026-09-03T19:47:02.001Z","references":[{"source_name":"Unit 42 PingPull Jun 2022","url":"https://unit42.paloaltonetworks.com/pingpull-gallium/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f78542d4-3e7b-4a73-a47e-1fc0a15fbe24","subject":"ATTACK:enterprise:S0538","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f78542d4-3e7b-4a73-a47e-1fc0a15fbe24","modified":"2026-09-03T19:47:02.016Z","references":[{"source_name":"ESET Crutch December 2020","url":"https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f8edd351-4ba0-412c-8f41-72380c5aa065","subject":"ATTACK:enterprise:G1055","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f8edd351-4ba0-412c-8f41-72380c5aa065","modified":"2026-09-03T19:47:02.058Z","references":[{"source_name":"Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026","url":"https://dti.domaintools.com/research/handala-mois-linked-cyber-influence-ecosystem-threat-intelligence-assessment"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fb35e052-245d-4da3-b43f-664e1595cca2","subject":"ATTACK:enterprise:C0058","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fb35e052-245d-4da3-b43f-664e1595cca2","modified":"2026-09-03T19:47:02.073Z","references":[{"source_name":"Microsoft SharePoint Exploit JUL 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/#storm-2603"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fbaf4c59-a846-49cc-bb53-84c85e501884","subject":"ATTACK:enterprise:C0056","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fbaf4c59-a846-49cc-bb53-84c85e501884","modified":"2026-09-03T19:47:02.096Z","references":[{"source_name":"Mandiant UNC3886 Juniper Routers MAR 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fbf22973-f91d-440a-9559-65bc2d8e3739","subject":"ATTACK:enterprise:S0264","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fbf22973-f91d-440a-9559-65bc2d8e3739","modified":"2026-09-03T19:47:02.112Z","references":[{"source_name":"Unit 42 OopsIE! Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fde7e333-32e4-439a-8938-f8535c5080cb","subject":"ATTACK:enterprise:S9063","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fde7e333-32e4-439a-8938-f8535c5080cb","modified":"2026-10-01T18:25:32.876Z","references":[{"source_name":"Mandiant_UNC1549_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}