Source assertions are not new attribution claims. No sole inventor or transitive actor-CVE inference.
{
  "record": {
    "id": "ATTACK:enterprise:T1047",
    "title": "Windows Management Instrumentation",
    "type": "Technique",
    "source_url": "https://attack.mitre.org/techniques/T1047",
    "snapshot": "enterprise-attack-20.0.json",
    "status": "active",
    "rights": "Source metadata only; source notices retained; no operational prose or payloads",
    "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
    "stix_id": "attack-pattern--01a5a209-b94c-450b-b7f9-946497d91055",
    "external_id": "T1047",
    "domain": "enterprise",
    "created": "2017-05-31T21:30:44.329Z",
    "modified": "2026-05-12T15:12:00.619Z",
    "version": "1.6",
    "aliases": [

    ],
    "tactics": [
      "execution"
    ],
    "source_references": [
      {
        "source_name": "FireEye WMI 2015",
        "url": "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf"
      },
      {
        "source_name": "Mandiant WMI",
        "url": "https://www.mandiant.com/resources/reports"
      },
      {
        "source_name": "WMI 6",
        "url": "https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"
      },
      {
        "source_name": "WMI 1-3",
        "url": "https://learn.microsoft.com/en-us/windows/win32/wmisdk/wmi-start-page?redirectedfrom=MSDN"
      },
      {
        "source_name": "WMI 7,8",
        "url": "https://techcommunity.microsoft.com/t5/windows-it-pro-blog/wmi-command-line-wmic-utility-deprecation-next-steps/ba-p/4039242"
      }
    ]
  },
  "assertions": [
    {
      "id": "enterprise:relationship--01000868-19de-44dd-bea5-ad30dae460ad",
      "subject": "ATTACK:enterprise:S1085",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--01000868-19de-44dd-bea5-ad30dae460ad",
      "modified": "2026-04-29T14:23:05.904Z",
      "references": [
        {
          "source_name": "Bitdefender Sardonic Aug 2021",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0182aa0a-a8b9-4a6e-9932-88f34f8ceee3",
      "subject": "ATTACK:enterprise:S0688",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0182aa0a-a8b9-4a6e-9932-88f34f8ceee3",
      "modified": "2026-04-29T14:23:05.905Z",
      "references": [
        {
          "source_name": "Check Point Meteor Aug 2021",
          "url": "https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--01eddb48-5116-494c-9d1c-2ace79b28530",
      "subject": "ATTACK:enterprise:G1021",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--01eddb48-5116-494c-9d1c-2ace79b28530",
      "modified": "2026-07-31T18:48:07.636Z",
      "references": [
        {
          "source_name": "Sygnia Emperor Dragonfly October 2022",
          "url": "https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"
        },
        {
          "source_name": "Microsoft Ransomware as a Service",
          "url": "https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0220b491-9c13-4bc4-a3e2-e3ad0e8c9733",
      "subject": "ATTACK:enterprise:S0270",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0220b491-9c13-4bc4-a3e2-e3ad0e8c9733",
      "modified": "2026-04-29T14:23:05.906Z",
      "references": [
        {
          "source_name": "Unit 42 DarkHydrus July 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
        },
        {
          "source_name": "Unit42 DarkHydrus Jan 2019",
          "url": "https://unit42.paloaltonetworks.com/darkhydrus-delivers-new-trojan-that-can-use-google-drive-for-c2-communications/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--022896ea-ed59-4782-8d53-d559ffcbd64b",
      "subject": "ATTACK:enterprise:G1051",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--022896ea-ed59-4782-8d53-d559ffcbd64b",
      "modified": "2026-07-31T18:48:09.952Z",
      "references": [
        {
          "source_name": "Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024",
          "url": "https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"
        },
        {
          "source_name": "CISA Medusa Group Medusa Ransomware March 2025",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"
        },
        {
          "source_name": "Intel471 Medusa Ransomware May 2025",
          "url": "https://www.intel471.com/blog/threat-hunting-case-study-medusa-ransomware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--04203d88-5fe1-4e63-be65-51a17705716b",
      "subject": "ATTACK:enterprise:G0045",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--04203d88-5fe1-4e63-be65-51a17705716b",
      "modified": "2026-07-31T18:47:43.491Z",
      "references": [
        {
          "source_name": "PWC Cloud Hopper Technical Annex April 2017",
          "url": "https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"
        },
        {
          "source_name": "Symantec Cicada November 2020",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"
        },
        {
          "source_name": "Github AD-Pentest-Script",
          "url": "https://github.com/Twi1ight/AD-Pentest-Script/blob/master/wmiexec.vbs"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--05615e68-064a-467c-99eb-e5d7b510afcc",
      "subject": "ATTACK:enterprise:S9035",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--05615e68-064a-467c-99eb-e5d7b510afcc",
      "modified": "2026-04-29T14:23:05.910Z",
      "references": [
        {
          "source_name": "Splunk LAMEHUG SEP 2025",
          "url": "https://www.splunk.com/en_us/blog/security/lamehug-ai-driven-malware-llm-cyber-intrusion-analysis.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--088f896a-59a4-4bce-aacf-3a1f0d6c4237",
      "subject": "ATTACK:enterprise:S0559",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--088f896a-59a4-4bce-aacf-3a1f0d6c4237",
      "modified": "2026-04-29T14:23:05.915Z",
      "references": [
        {
          "source_name": "FireEye SUNBURST Backdoor December 2020",
          "url": "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0a764574-6288-4f66-b4af-b485424b32d2",
      "subject": "ATTACK:enterprise:C0015",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0a764574-6288-4f66-b4af-b485424b32d2",
      "modified": "2026-07-31T18:47:25.173Z",
      "references": [
        {
          "source_name": "DFIR Conti Bazar Nov 2021",
          "url": "https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0a789ae7-0348-4bec-a7bd-7890f0996d66",
      "subject": "ATTACK:enterprise:G1032",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0a789ae7-0348-4bec-a7bd-7890f0996d66",
      "modified": "2026-07-31T20:48:47.612Z",
      "references": [
        {
          "source_name": "Cybereason INC Ransomware November 2023",
          "url": "https://web.archive.org/web/20231202022946/https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"
        },
        {
          "source_name": "SOCRadar INC Ransom January 2024",
          "url": "https://socradar.io/dark-web-profile-inc-ransom/"
        },
        {
          "source_name": "Huntress INC Ransom Group August 2023",
          "url": "https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0c0b4142-96e7-440b-a01f-f2bda05649b1",
      "subject": "ATTACK:enterprise:S0089",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0c0b4142-96e7-440b-a01f-f2bda05649b1",
      "modified": "2026-04-29T14:23:05.920Z",
      "references": [
        {
          "source_name": "Securelist BlackEnergy Feb 2015",
          "url": "https://securelist.com/be2-extraordinary-plugins-siemens-targeting-dev-fails/68838/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0fc08710-fefb-4109-821e-1130c14914f3",
      "subject": "ATTACK:enterprise:S1044",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0fc08710-fefb-4109-821e-1130c14914f3",
      "modified": "2026-04-29T14:23:05.925Z",
      "references": [
        {
          "source_name": "Bitdefender FunnyDream Campaign November 2020",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1157b635-1cd6-4f65-9be6-09a9f7ac1664",
      "subject": "ATTACK:enterprise:S0283",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1157b635-1cd6-4f65-9be6-09a9f7ac1664",
      "modified": "2026-04-29T14:23:05.927Z",
      "references": [
        {
          "source_name": "jRAT Symantec Aug 2018",
          "url": "https://www.symantec.com/blogs/threat-intelligence/jrat-new-anti-parsing-techniques"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--11f31998-c76f-4433-8e9c-c0ef0b7574d5",
      "subject": "ATTACK:enterprise:S0367",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--11f31998-c76f-4433-8e9c-c0ef0b7574d5",
      "modified": "2026-04-29T14:23:05.928Z",
      "references": [
        {
          "source_name": "Carbon Black Emotet Apr 2019",
          "url": "https://www.carbonblack.com/2019/04/24/cb-tau-threat-intelligence-notification-emotet-utilizing-wmi-to-launch-powershell-encoded-code/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--12e24dfb-3b4c-4244-90c9-2f9675dc6eaa",
      "subject": "ATTACK:enterprise:G0047",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--12e24dfb-3b4c-4244-90c9-2f9675dc6eaa",
      "modified": "2026-07-31T18:47:47.323Z",
      "references": [
        {
          "source_name": "CERT-EE Gamaredon January 2021",
          "url": "https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf"
        },
        {
          "source_name": "ESET Gamaredon Sept2024",
          "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"
        },
        {
          "source_name": "SymantecCarbonBlack_ShuckwormUSB_Apr2025",
          "url": "https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"
        },
        {
          "source_name": "unit42_gamaredon_dec2022",
          "url": "https://unit42.paloaltonetworks.com/trident-ursa/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1395dbee-5ed2-45d4-a807-19fb707e9dab",
      "subject": "ATTACK:enterprise:S9031",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1395dbee-5ed2-45d4-a807-19fb707e9dab",
      "modified": "2026-04-29T14:23:05.931Z",
      "references": [
        {
          "source_name": "Palo Alto Ashen Lepus DEC 2025",
          "url": "https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--15e5da78-6475-426e-acd0-09f8a59ca0bb",
      "subject": "ATTACK:enterprise:S0618",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--15e5da78-6475-426e-acd0-09f8a59ca0bb",
      "modified": "2026-04-29T14:23:05.934Z",
      "references": [
        {
          "source_name": "FireEye FiveHands April 2021",
          "url": "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
        },
        {
          "source_name": "CISA AR21-126A FIVEHANDS May 2021",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--16e1d79d-1eb9-4ce7-a21e-115ce2a414f1",
      "subject": "ATTACK:enterprise:S0251",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--16e1d79d-1eb9-4ce7-a21e-115ce2a414f1",
      "modified": "2026-04-29T14:23:05.935Z",
      "references": [
        {
          "source_name": "Unit42 Sofacy Dec 2018",
          "url": "https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--18e8e653-d924-4fed-a33f-7893cf8a683b",
      "subject": "ATTACK:enterprise:G0050",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--18e8e653-d924-4fed-a33f-7893cf8a683b",
      "modified": "2026-07-31T18:47:43.936Z",
      "references": [
        {
          "source_name": "Cybereason Cobalt Kitty 2017",
          "url": "https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1937b1c7-004f-4d22-bbf2-ab0de1ba8e1a",
      "subject": "ATTACK:enterprise:S0256",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1937b1c7-004f-4d22-bbf2-ab0de1ba8e1a",
      "modified": "2026-04-29T14:23:05.939Z",
      "references": [
        {
          "source_name": "ESET Turla Mosquito Jan 2018",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1969fef1-3e75-4228-b034-b6436f207c01",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1969fef1-3e75-4228-b034-b6436f207c01",
      "modified": "2026-07-31T18:47:51.691Z",
      "references": [
        {
          "source_name": "Anomali MUSTANG PANDA October 2019",
          "url": "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"
        },
        {
          "source_name": "Secureworks BRONZE PRESIDENT December 2019",
          "url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1b6f869f-951c-4323-816f-dbedbe3aac0a",
      "subject": "ATTACK:enterprise:G0069",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1b6f869f-951c-4323-816f-dbedbe3aac0a",
      "modified": "2026-07-31T20:48:29.659Z",
      "references": [
        {
          "source_name": "Talos MuddyWater May 2019",
          "url": "https://blog.talosintelligence.com/2019/05/recent-muddywater-associated-blackwater.html"
        },
        {
          "source_name": "ClearSky MuddyWater Nov 2018",
          "url": "https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"
        },
        {
          "source_name": "DHS CISA AA22-055A MuddyWater February 2022",
          "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"
        },
        {
          "source_name": "Securelist MuddyWater Oct 2018",
          "url": "https://securelist.com/muddywater/88059/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1bce55fa-b34e-4522-9422-85bf3fdda889",
      "subject": "ATTACK:enterprise:S0331",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1bce55fa-b34e-4522-9422-85bf3fdda889",
      "modified": "2026-04-29T14:23:05.942Z",
      "references": [
        {
          "source_name": "Bitdefender Agent Tesla April 2020",
          "url": "https://labs.bitdefender.com/2020/04/oil-gas-spearphishing-campaigns-drop-agent-tesla-spyware-in-advance-of-historic-opec-deal/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1c715763-19ea-475d-9d5c-8d4434b4095f",
      "subject": "ATTACK:enterprise:S0378",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1c715763-19ea-475d-9d5c-8d4434b4095f",
      "modified": "2026-04-29T14:23:05.943Z",
      "references": [
        {
          "source_name": "GitHub PoshC2",
          "url": "https://github.com/nettitude/PoshC2_Python"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1c935a6d-dd69-4be3-bfed-56c01d0f9413",
      "subject": "ATTACK:enterprise:S1039",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1c935a6d-dd69-4be3-bfed-56c01d0f9413",
      "modified": "2026-04-29T14:23:05.944Z",
      "references": [
        {
          "source_name": "Cybereason Bumblebee August 2022",
          "url": "https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control"
        },
        {
          "source_name": "Proofpoint Bumblebee April 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"
        },
        {
          "source_name": "Google EXOTIC LILY March 2022",
          "url": "https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1e0c4d65-a4db-42e0-9eb0-93354ad56d06",
      "subject": "ATTACK:enterprise:M1026",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1e0c4d65-a4db-42e0-9eb0-93354ad56d06",
      "modified": "2026-04-29T14:23:05.946Z",
      "references": [
        {
          "source_name": "FireEye WMI 2015",
          "url": "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1fa97951-8eba-4771-bc42-8084967f0c65",
      "subject": "ATTACK:enterprise:G0102",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1fa97951-8eba-4771-bc42-8084967f0c65",
      "modified": "2026-07-31T20:48:50.048Z",
      "references": [
        {
          "source_name": "Red Canary Hospital Thwarted Ryuk October 2020",
          "url": "https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/"
        },
        {
          "source_name": "DHS/CISA Ransomware Targeting Healthcare October 2020",
          "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-302a"
        },
        {
          "source_name": "CrowdStrike Grim Spider May 2019",
          "url": "https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"
        },
        {
          "source_name": "FireEye KEGTAP SINGLEMALT October 2020",
          "url": "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"
        },
        {
          "source_name": "Mandiant FIN12 Oct 2021",
          "url": "https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--20cb38ca-5e2d-40eb-b104-c1e95ff2ec54",
      "subject": "ATTACK:enterprise:G1055",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--20cb38ca-5e2d-40eb-b104-c1e95ff2ec54",
      "modified": "2026-07-31T18:48:25.338Z",
      "references": [
        {
          "source_name": "Check Point VOID MANTICORE Handala Hack March 2026",
          "url": "https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--23d208f5-cadc-4f80-94c4-5644eaa8b7c7",
      "subject": "ATTACK:enterprise:G0065",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--23d208f5-cadc-4f80-94c4-5644eaa8b7c7",
      "modified": "2026-07-31T20:48:38.040Z",
      "references": [
        {
          "source_name": "Proofpoint Leviathan Oct 2017",
          "url": "https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2440db47-5c7d-4f60-89e8-d5a6f19f0d0d",
      "subject": "ATTACK:enterprise:S1028",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2440db47-5c7d-4f60-89e8-d5a6f19f0d0d",
      "modified": "2026-04-29T14:23:05.955Z",
      "references": [
        {
          "source_name": "MalwareBytes SideCopy Dec 2021",
          "url": "https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--25168e37-9e0c-46ba-9f70-9b5011a96482",
      "subject": "ATTACK:enterprise:S1155",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--25168e37-9e0c-46ba-9f70-9b5011a96482",
      "modified": "2026-04-29T14:23:05.956Z",
      "references": [
        {
          "source_name": "Github Covenant",
          "url": "https://github.com/cobbr/Covenant"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--265686ee-6e90-439f-9966-e40b8472bd06",
      "subject": "ATTACK:enterprise:S0396",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--265686ee-6e90-439f-9966-e40b8472bd06",
      "modified": "2026-04-29T14:23:05.957Z",
      "references": [
        {
          "source_name": "Cyphort EvilBunny Dec 2014",
          "url": "https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2869490f-0728-4a73-a9c2-3a5de5f9f5e7",
      "subject": "ATTACK:enterprise:M1040",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2869490f-0728-4a73-a9c2-3a5de5f9f5e7",
      "modified": "2026-04-29T14:23:05.960Z",
      "references": [
        {
          "source_name": "win10_asr",
          "url": "https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--29552a61-61fe-4265-9468-e53318bd388c",
      "subject": "ATTACK:enterprise:S0603",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--29552a61-61fe-4265-9468-e53318bd388c",
      "modified": "2026-04-29T14:23:05.961Z",
      "references": [
        {
          "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
          "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2d2ebfcb-0b2c-4c69-877e-2ca633c95a17",
      "subject": "ATTACK:enterprise:S0194",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2d2ebfcb-0b2c-4c69-877e-2ca633c95a17",
      "modified": "2026-04-29T14:23:05.966Z",
      "references": [
        {
          "source_name": "GitHub PowerSploit May 2012",
          "url": "https://github.com/PowerShellMafia/PowerSploit"
        },
        {
          "source_name": "PowerSploit Documentation",
          "url": "http://powersploit.readthedocs.io"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--341a8145-4d62-4126-a18d-10976d08d920",
      "subject": "ATTACK:enterprise:G1047",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--341a8145-4d62-4126-a18d-10976d08d920",
      "modified": "2026-07-31T18:48:23.798Z",
      "references": [
        {
          "source_name": "Sygnia VelvetAnt 2024A",
          "url": "https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--344e4ab0-d480-4d70-b64d-539cf5f26c96",
      "subject": "ATTACK:enterprise:S1152",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--344e4ab0-d480-4d70-b64d-539cf5f26c96",
      "modified": "2026-04-29T14:23:05.989Z",
      "references": [
        {
          "source_name": "PWC Yellow Liderc 2023",
          "url": "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--34529aa9-4431-4b7f-af18-e53c5b8b71aa",
      "subject": "ATTACK:enterprise:G0099",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--34529aa9-4431-4b7f-af18-e53c5b8b71aa",
      "modified": "2026-07-31T18:48:18.389Z",
      "references": [
        {
          "source_name": "Zscaler BlindEagle DEC 2025",
          "url": "https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--35419603-7bc2-40f6-8e5d-4e7a8f13ebb7",
      "subject": "ATTACK:enterprise:S0184",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--35419603-7bc2-40f6-8e5d-4e7a8f13ebb7",
      "modified": "2026-04-29T14:23:05.991Z",
      "references": [
        {
          "source_name": "FireEye APT34 Dec 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--36986111-c0c0-40d0-8d88-3b59e655c2d1",
      "subject": "ATTACK:enterprise:S1124",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--36986111-c0c0-40d0-8d88-3b59e655c2d1",
      "modified": "2026-04-29T14:23:05.994Z",
      "references": [
        {
          "source_name": "SocGholish-update",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--38f54e6f-502c-4af5-9867-fa9fb8381662",
      "subject": "ATTACK:enterprise:S0381",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--38f54e6f-502c-4af5-9867-fa9fb8381662",
      "modified": "2026-04-29T14:23:05.998Z",
      "references": [
        {
          "source_name": "Proofpoint TA505 Mar 2018",
          "url": "https://www.proofpoint.com/us/threat-insight/post/leaked-ammyy-admin-source-code-turned-malware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3a30af61-b9b4-488e-aebc-dee4dfce52b6",
      "subject": "ATTACK:enterprise:G0046",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3a30af61-b9b4-488e-aebc-dee4dfce52b6",
      "modified": "2026-07-31T20:48:31.809Z",
      "references": [
        {
          "source_name": "eSentire FIN7 July 2021",
          "url": "https://www.esentire.com/security-advisories/notorious-cybercrime-gang-fin7-lands-malware-in-law-firm-using-fake-legal-complaint-against-jack-daniels-owner-brown-forman-inc"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3dd85bcc-faab-43a0-99d4-9b269e69f2e7",
      "subject": "ATTACK:enterprise:S1242",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3dd85bcc-faab-43a0-99d4-9b269e69f2e7",
      "modified": "2026-04-29T14:23:06.009Z",
      "references": [
        {
          "source_name": "Cisco Talos Qilin Ransomware OCT 2025",
          "url": "https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3f6981d7-5647-41ca-99af-180f8ece72f1",
      "subject": "ATTACK:enterprise:S9020",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3f6981d7-5647-41ca-99af-180f8ece72f1",
      "modified": "2026-04-29T14:23:06.011Z",
      "references": [
        {
          "source_name": "Kaspersky LODEINFO Part II OCT 2022",
          "url": "https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-ii/107745/"
        },
        {
          "source_name": "ITOCHU LODEINFO JAN 2024",
          "url": "https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--402e9430-9d3a-4694-89ca-923dab3fba26",
      "subject": "ATTACK:enterprise:G0093",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--402e9430-9d3a-4694-89ca-923dab3fba26",
      "modified": "2026-07-31T18:47:37.165Z",
      "references": [
        {
          "source_name": "Cybereason Soft Cell June 2019",
          "url": "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--40b2270c-1549-44dc-87b2-d263941eb951",
      "subject": "ATTACK:enterprise:G1017",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--40b2270c-1549-44dc-87b2-d263941eb951",
      "modified": "2026-07-31T18:47:40.146Z",
      "references": [
        {
          "source_name": "CISA AA24-038A PRC Critical Infrastructure February 2024",
          "url": "https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"
        },
        {
          "source_name": "Secureworks BRONZE SILHOUETTE May 2023",
          "url": "https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"
        },
        {
          "source_name": "Microsoft Volt Typhoon May 2023",
          "url": "https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"
        },
        {
          "source_name": "Joint Cybersecurity Advisory Volt Typhoon June 2023",
          "url": "https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--411ea36c-e237-4503-82f2-6e9d87a01380",
      "subject": "ATTACK:enterprise:S0654",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--411ea36c-e237-4503-82f2-6e9d87a01380",
      "modified": "2026-04-29T14:23:06.014Z",
      "references": [
        {
          "source_name": "Group IB Ransomware September 2020",
          "url": "https://web.archive.org/web/20220119114433/https://groupib.pathfactory.com/ransomware-reports/prolock_wp"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--42cc506f-e9c2-43f1-a68f-3c6973cca2dc",
      "subject": "ATTACK:enterprise:S0223",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--42cc506f-e9c2-43f1-a68f-3c6973cca2dc",
      "modified": "2026-04-29T14:23:06.016Z",
      "references": [
        {
          "source_name": "FireEye MuddyWater Mar 2018",
          "url": "https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"
        },
        {
          "source_name": "ClearSky MuddyWater Nov 2018",
          "url": "https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--44271618-cc52-45a9-9799-e9665b73cfc2",
      "subject": "ATTACK:enterprise:S1129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--44271618-cc52-45a9-9799-e9665b73cfc2",
      "modified": "2026-04-29T14:23:06.018Z",
      "references": [
        {
          "source_name": "Kersten Akira 2023",
          "url": "https://www.trellix.com/blogs/research/akira-ransomware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--45bc3eef-6651-4a46-833e-7a2e91fe3ba1",
      "subject": "ATTACK:enterprise:S1239",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--45bc3eef-6651-4a46-833e-7a2e91fe3ba1",
      "modified": "2026-04-29T14:23:06.020Z",
      "references": [
        {
          "source_name": "ATTACKIQ MUSTANG PANDA TONESHELL March 2023",
          "url": "https://www.attackiq.com/2023/03/23/emulating-the-politically-motivated-chinese-apt-mustang-panda/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--48e6b5fc-9d82-4cdf-84aa-bc23647e1234",
      "subject": "ATTACK:enterprise:M1018",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--48e6b5fc-9d82-4cdf-84aa-bc23647e1234",
      "modified": "2026-04-29T14:23:06.024Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--51548d6c-0aa9-4813-8493-3d9bbcd0617a",
      "subject": "ATTACK:enterprise:G0108",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--51548d6c-0aa9-4813-8493-3d9bbcd0617a",
      "modified": "2026-07-31T18:48:02.736Z",
      "references": [
        {
          "source_name": "RedCanary Mockingbird May 2020",
          "url": "https://redcanary.com/blog/blue-mockingbird-cryptominer/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--533a2f2c-6cc9-48fa-b029-17cc827e12d7",
      "subject": "ATTACK:enterprise:S0692",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--533a2f2c-6cc9-48fa-b029-17cc827e12d7",
      "modified": "2026-04-29T14:23:06.039Z",
      "references": [
        {
          "source_name": "GitHub SILENTTRINITY Modules July 2019",
          "url": "https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5422e9a8-4fbe-40c0-8348-53faa9a7d2d3",
      "subject": "ATTACK:enterprise:S0264",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5422e9a8-4fbe-40c0-8348-53faa9a7d2d3",
      "modified": "2026-04-29T14:23:06.040Z",
      "references": [
        {
          "source_name": "Unit 42 OilRig Sept 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/09/unit42-oilrig-targets-middle-eastern-government-adds-evasion-techniques-oopsie/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--55427322-8d66-40f7-92ce-ea489f58870c",
      "subject": "ATTACK:enterprise:S1193",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--55427322-8d66-40f7-92ce-ea489f58870c",
      "modified": "2026-04-29T14:23:06.042Z",
      "references": [
        {
          "source_name": "Mandiant APT42-untangling",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--55670baa-97b1-44fe-abb8-0162b5a9663b",
      "subject": "ATTACK:enterprise:M1038",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--55670baa-97b1-44fe-abb8-0162b5a9663b",
      "modified": "2026-04-29T14:23:06.042Z",
      "references": [
        {
          "source_name": "Microsoft WDAC",
          "url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--597ca258-3af4-4e51-abf9-b192e98939fd",
      "subject": "ATTACK:enterprise:G0019",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--597ca258-3af4-4e51-abf9-b192e98939fd",
      "modified": "2026-07-31T18:47:46.180Z",
      "references": [
        {
          "source_name": "Bitdefender Naikon April 2021",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5d5077b6-4490-4762-8b8f-ba4e0655ec67",
      "subject": "ATTACK:enterprise:S1063",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5d5077b6-4490-4762-8b8f-ba4e0655ec67",
      "modified": "2026-04-29T14:23:06.052Z",
      "references": [
        {
          "source_name": "Palo Alto Brute Ratel July 2022",
          "url": "https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5ddcecdb-9e54-4e8e-b67b-64d24ec3264a",
      "subject": "ATTACK:enterprise:S0250",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5ddcecdb-9e54-4e8e-b67b-64d24ec3264a",
      "modified": "2026-04-29T14:23:06.053Z",
      "references": [
        {
          "source_name": "Github Koadic",
          "url": "https://github.com/offsecginger/koadic"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5e0bb60b-21e7-4913-862b-61f8831c1732",
      "subject": "ATTACK:enterprise:S1139",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5e0bb60b-21e7-4913-862b-61f8831c1732",
      "modified": "2026-04-29T14:23:06.053Z",
      "references": [
        {
          "source_name": "Secureworks GOLD IONIC April 2024",
          "url": "https://www.secureworks.com/blog/gold-ionic-deploys-inc-ransomware"
        },
        {
          "source_name": "Huntress INC Ransom Group August 2023",
          "url": "https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5ea2e743-24d9-4e93-bc71-e504ee876395",
      "subject": "ATTACK:enterprise:S1111",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5ea2e743-24d9-4e93-bc71-e504ee876395",
      "modified": "2026-04-29T14:23:06.054Z",
      "references": [
        {
          "source_name": "Rapid7 BlackBasta 2024",
          "url": "https://www.rapid7.com/blog/post/2024/12/04/black-basta-ransomware-campaign-drops-zbot-darkgate-and-custom-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--64a17aba-5182-4666-bd37-dafa9d835fe8",
      "subject": "ATTACK:enterprise:G0032",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--64a17aba-5182-4666-bd37-dafa9d835fe8",
      "modified": "2026-07-31T20:48:46.783Z",
      "references": [
        {
          "source_name": "Novetta Blockbuster RATs",
          "url": "https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"
        },
        {
          "source_name": "Novetta Blockbuster",
          "url": "https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"
        },
        {
          "source_name": "Qualys LolZarus",
          "url": "https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"
        },
        {
          "source_name": "Kaspersky ThreatNeedle Feb 2021",
          "url": "https://securelist.com/lazarus-threatneedle/100803/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--667aa499-504c-4fb1-9b56-0bb680d773d1",
      "subject": "ATTACK:enterprise:S1178",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--667aa499-504c-4fb1-9b56-0bb680d773d1",
      "modified": "2026-04-29T14:23:06.064Z",
      "references": [
        {
          "source_name": "Kaspersky ShrinkLocker 2024",
          "url": "https://securelist.com/ransomware-abuses-bitlocker/112643/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6988baa7-1b48-4203-8020-7bb3fb38098d",
      "subject": "ATTACK:enterprise:S0589",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6988baa7-1b48-4203-8020-7bb3fb38098d",
      "modified": "2026-04-29T14:23:06.069Z",
      "references": [
        {
          "source_name": "MSTIC NOBELIUM Mar 2021",
          "url": "https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6a58662b-4eb1-4172-b387-13e9b574368a",
      "subject": "ATTACK:enterprise:S0062",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6a58662b-4eb1-4172-b387-13e9b574368a",
      "modified": "2026-04-29T14:23:06.070Z",
      "references": [
        {
          "source_name": "DustySky",
          "url": "https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6ad5d5c8-b53e-417c-a574-3818269d1e85",
      "subject": "ATTACK:enterprise:S0366",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6ad5d5c8-b53e-417c-a574-3818269d1e85",
      "modified": "2026-04-29T14:23:06.070Z",
      "references": [
        {
          "source_name": "FireEye WannaCry 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html"
        },
        {
          "source_name": "SecureWorks WannaCry Analysis",
          "url": "https://www.secureworks.com/research/wcry-ransomware-analysis"
        },
        {
          "source_name": "LogRhythm WannaCry",
          "url": "https://web.archive.org/web/20230522041200/https://logrhythm.com/blog/a-technical-analysis-of-wannacry-ransomware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6ade9df2-d75a-40a6-91aa-f3150e07ac6a",
      "subject": "ATTACK:enterprise:S0605",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6ade9df2-d75a-40a6-91aa-f3150e07ac6a",
      "modified": "2026-04-29T14:23:06.070Z",
      "references": [
        {
          "source_name": "Dragos EKANS",
          "url": "https://www.dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6e05703b-26a3-4429-8d91-3c32053ca662",
      "subject": "ATTACK:enterprise:G0030",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6e05703b-26a3-4429-8d91-3c32053ca662",
      "modified": "2026-07-31T18:48:06.968Z",
      "references": [
        {
          "source_name": "Cisco LotusBlossom 2025",
          "url": "https://blog.talosintelligence.com/lotus-blossom-espionage-group/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6ed1086d-3197-403e-86e4-16e4dee07faa",
      "subject": "ATTACK:enterprise:S0241",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6ed1086d-3197-403e-86e4-16e4dee07faa",
      "modified": "2026-04-29T14:23:06.076Z",
      "references": [
        {
          "source_name": "Lazarus RATANKBA",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-campaign-targeting-cryptocurrencies-reveals-remote-controller-tool-evolved-ratankba/"
        },
        {
          "source_name": "RATANKBA",
          "url": "https://www.trendmicro.com/en_us/research/17/b/ratankba-watering-holes-against-enterprises.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7196c18e-b80f-41ec-ae37-a88e99435f56",
      "subject": "ATTACK:enterprise:S0553",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7196c18e-b80f-41ec-ae37-a88e99435f56",
      "modified": "2026-04-29T14:23:06.080Z",
      "references": [
        {
          "source_name": "Cybereason Molerats Dec 2020",
          "url": "https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--737af098-bd8c-4449-b93d-adaaaa55abea",
      "subject": "ATTACK:enterprise:S1068",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--737af098-bd8c-4449-b93d-adaaaa55abea",
      "modified": "2026-04-29T14:23:06.083Z",
      "references": [
        {
          "source_name": "Microsoft BlackCat Jun 2022",
          "url": "https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--76eae7b3-2e02-41c6-8b31-b81c8d124006",
      "subject": "ATTACK:enterprise:S0368",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--76eae7b3-2e02-41c6-8b31-b81c8d124006",
      "modified": "2026-04-29T14:23:06.088Z",
      "references": [
        {
          "source_name": "Talos Nyetya June 2017",
          "url": "https://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html"
        },
        {
          "source_name": "US-CERT NotPetya 2017",
          "url": "https://www.us-cert.gov/ncas/alerts/TA17-181A"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--77ea5d03-715b-4247-8484-6c1cf2bc7984",
      "subject": "ATTACK:enterprise:S0151",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--77ea5d03-715b-4247-8484-6c1cf2bc7984",
      "modified": "2026-04-29T14:23:06.089Z",
      "references": [
        {
          "source_name": "FireEye FIN7 April 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7dcf8536-cf47-4979-a3a2-cda656431edc",
      "subject": "ATTACK:enterprise:G0034",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7dcf8536-cf47-4979-a3a2-cda656431edc",
      "modified": "2026-07-31T20:48:33.028Z",
      "references": [
        {
          "source_name": "Dragos Crashoverride 2018",
          "url": "https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
        },
        {
          "source_name": "Microsoft Prestige ransomware October 2022",
          "url": "https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--80c90e89-2519-40cb-8757-06471e47d0fb",
      "subject": "ATTACK:enterprise:S0380",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--80c90e89-2519-40cb-8757-06471e47d0fb",
      "modified": "2026-04-29T14:23:06.101Z",
      "references": [
        {
          "source_name": "Kaspersky StoneDrill 2017",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--812699e3-ffb0-4aec-b7d9-96680311d5a4",
      "subject": "ATTACK:enterprise:C0058",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--812699e3-ffb0-4aec-b7d9-96680311d5a4",
      "modified": "2026-07-31T18:47:18.486Z",
      "references": [
        {
          "source_name": "Microsoft SharePoint Exploit JUL 2025",
          "url": "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/#storm-2603"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--84221e86-8ed7-42d4-878f-951cc6eaf65c",
      "subject": "ATTACK:enterprise:S0375",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--84221e86-8ed7-42d4-878f-951cc6eaf65c",
      "modified": "2026-04-29T14:23:06.106Z",
      "references": [
        {
          "source_name": "Securelist Remexi Jan 2019",
          "url": "https://securelist.com/chafer-used-remexi-malware/89538/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--85216e27-5d58-4d89-8b04-3ef50ed14f95",
      "subject": "ATTACK:enterprise:G1006",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--85216e27-5d58-4d89-8b04-3ef50ed14f95",
      "modified": "2026-07-31T20:48:48.275Z",
      "references": [
        {
          "source_name": "TrendMicro EarthLusca 2022",
          "url": "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8561e826-0aa8-4711-ab0b-fffb0b03ff13",
      "subject": "ATTACK:enterprise:S0363",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8561e826-0aa8-4711-ab0b-fffb0b03ff13",
      "modified": "2026-04-29T14:23:06.107Z",
      "references": [
        {
          "source_name": "Github PowerShell Empire",
          "url": "https://github.com/PowerShellEmpire/Empire"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--85ee8dfa-7f36-406a-a87c-97633530bdda",
      "subject": "ATTACK:enterprise:S0488",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--85ee8dfa-7f36-406a-a87c-97633530bdda",
      "modified": "2026-04-29T14:23:06.108Z",
      "references": [
        {
          "source_name": "CME Github September 2018",
          "url": "https://github.com/byt3bl33d3r/CrackMapExec/wiki/SMB-Command-Reference"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--891f701a-b0d3-408a-8e2c-e9d9e727930e",
      "subject": "ATTACK:enterprise:S0357",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--891f701a-b0d3-408a-8e2c-e9d9e727930e",
      "modified": "2026-04-29T14:23:06.112Z",
      "references": [
        {
          "source_name": "Impacket Tools",
          "url": "https://www.secureauth.com/labs/open-source-tools/impacket"
        },
        {
          "source_name": "Sygnia VelvetAnt 2024A",
          "url": "https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--89fad9cc-d20b-43c4-a98d-105ff6642f2c",
      "subject": "ATTACK:enterprise:G0119",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--89fad9cc-d20b-43c4-a98d-105ff6642f2c",
      "modified": "2026-07-31T18:47:35.651Z",
      "references": [
        {
          "source_name": "Symantec WastedLocker June 2020",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8a61202f-ec67-4ec2-8640-c148147731e0",
      "subject": "ATTACK:enterprise:S1086",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8a61202f-ec67-4ec2-8640-c148147731e0",
      "modified": "2026-04-29T14:23:06.114Z",
      "references": [
        {
          "source_name": "Morphisec Snip3 May 2021",
          "url": "https://blog.morphisec.com/revealing-the-snip3-crypter-a-highly-evasive-rat-loader"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8a9e5785-f1cb-4127-9045-07e7bba11e80",
      "subject": "ATTACK:enterprise:S0267",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8a9e5785-f1cb-4127-9045-07e7bba11e80",
      "modified": "2026-04-29T14:23:06.114Z",
      "references": [
        {
          "source_name": "ESET GreyEnergy Oct 2018",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8e883c7a-3f13-42f6-8cf5-ce373586487e",
      "subject": "ATTACK:enterprise:S0365",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8e883c7a-3f13-42f6-8cf5-ce373586487e",
      "modified": "2026-04-29T14:23:06.119Z",
      "references": [
        {
          "source_name": "Talos Olympic Destroyer 2018",
          "url": "https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8f0ca79a-3768-46a2-b2c1-8aa638c6a8d2",
      "subject": "ATTACK:enterprise:G1018",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8f0ca79a-3768-46a2-b2c1-8aa638c6a8d2",
      "modified": "2026-07-31T18:47:55.436Z",
      "references": [
        {
          "source_name": "Proofpoint TA2541 February 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9137e2ff-166c-4d99-80e8-2694f262626c",
      "subject": "ATTACK:enterprise:S1130",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9137e2ff-166c-4d99-80e8-2694f262626c",
      "modified": "2026-04-29T14:23:06.123Z",
      "references": [
        {
          "source_name": "TrendMicro RaspberryRobin 2022",
          "url": "https://www.trendmicro.com/en_us/research/22/l/raspberry-robin-malware-targets-telecom-governments.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--92b7c137-0317-44fa-b1b7-8a7f3ceb6da6",
      "subject": "ATTACK:enterprise:S0698",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--92b7c137-0317-44fa-b1b7-8a7f3ceb6da6",
      "modified": "2026-04-29T14:23:06.125Z",
      "references": [
        {
          "source_name": "ESET Hermetic Wizard March 2022",
          "url": "https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--93086acc-65f7-4e41-b765-04bae1bc12fd",
      "subject": "ATTACK:enterprise:S0617",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--93086acc-65f7-4e41-b765-04bae1bc12fd",
      "modified": "2026-04-29T14:23:06.125Z",
      "references": [
        {
          "source_name": "FireEye FiveHands April 2021",
          "url": "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--94b4648a-4108-468c-be51-cca365fd97ac",
      "subject": "ATTACK:enterprise:G0038",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--94b4648a-4108-468c-be51-cca365fd97ac",
      "modified": "2026-07-31T18:48:07.360Z",
      "references": [
        {
          "source_name": "Citizen Lab Stealth Falcon May 2016",
          "url": "https://citizenlab.org/2016/05/stealth-falcon/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--969d588f-7357-4349-b158-2bf78704c1b4",
      "subject": "ATTACK:enterprise:S0483",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--969d588f-7357-4349-b158-2bf78704c1b4",
      "modified": "2026-04-29T14:23:06.130Z",
      "references": [
        {
          "source_name": "DFIR_Sodinokibi_Ransomware",
          "url": "https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/"
        },
        {
          "source_name": "Juniper IcedID June 2020",
          "url": "https://blogs.juniper.net/en-us/threat-research/covid-19-and-fmla-campaigns-used-to-install-new-icedid-banking-malware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--98d908da-f2b1-47f8-a74a-41984e88f55e",
      "subject": "ATTACK:enterprise:G0143",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--98d908da-f2b1-47f8-a74a-41984e88f55e",
      "modified": "2026-07-31T18:47:59.432Z",
      "references": [
        {
          "source_name": "Crowdstrike HuntReport 2022",
          "url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9e80392b-1b7c-4e82-9fbf-73d8ddb6b876",
      "subject": "ATTACK:enterprise:S0496",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9e80392b-1b7c-4e82-9fbf-73d8ddb6b876",
      "modified": "2026-04-29T14:23:06.141Z",
      "references": [
        {
          "source_name": "Secureworks GandCrab and REvil September 2019",
          "url": "https://www.secureworks.com/blog/revil-the-gandcrab-connection"
        },
        {
          "source_name": "Group IB Ransomware May 2020",
          "url": "https://www.group-ib.com/whitepapers/ransomware-uncovered.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9ef2a5a7-3be8-426a-8411-ca78e35cef3a",
      "subject": "ATTACK:enterprise:C0001",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9ef2a5a7-3be8-426a-8411-ca78e35cef3a",
      "modified": "2026-07-31T18:47:19.279Z",
      "references": [
        {
          "source_name": "Talos Frankenstein June 2019",
          "url": "https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9f4718ff-f030-447e-b195-a7bedfe2e64f",
      "subject": "ATTACK:enterprise:S1141",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9f4718ff-f030-447e-b195-a7bedfe2e64f",
      "modified": "2026-04-29T14:23:06.142Z",
      "references": [
        {
          "source_name": "ESET Turla Lunar toolset May 2024",
          "url": "https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a0419eb3-f257-4b1a-8577-600b7105e318",
      "subject": "ATTACK:enterprise:S1199",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a0419eb3-f257-4b1a-8577-600b7105e318",
      "modified": "2026-04-29T14:23:06.143Z",
      "references": [
        {
          "source_name": "Cybereason Lockbit 2.0",
          "url": "https://www.cybereason.com/blog/threat-analysis-report-lockbit-2.0-all-paths-lead-to-ransom"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a04db303-7ae6-4ecd-a397-f3e964bd6e3c",
      "subject": "ATTACK:enterprise:S0373",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a04db303-7ae6-4ecd-a397-f3e964bd6e3c",
      "modified": "2026-04-29T14:23:06.143Z",
      "references": [
        {
          "source_name": "Cofense Astaroth Sept 2018",
          "url": "https://web.archive.org/web/20200302071436/https://cofense.com/seeing-resurgence-demonic-astaroth-wmic-trojan/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a0f0d977-ccb9-4634-9b0a-f6887be60b4c",
      "subject": "ATTACK:enterprise:S1066",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a0f0d977-ccb9-4634-9b0a-f6887be60b4c",
      "modified": "2026-04-29T14:23:06.144Z",
      "references": [
        {
          "source_name": "Secureworks DarkTortilla Aug 2022",
          "url": "https://www.secureworks.com/research/darktortilla-malware-analysis"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a295ad0d-28fe-4707-a699-7e49b4e8d9f3",
      "subject": "ATTACK:enterprise:S1064",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a295ad0d-28fe-4707-a699-7e49b4e8d9f3",
      "modified": "2026-04-29T14:23:06.146Z",
      "references": [
        {
          "source_name": "HP SVCReady Jun 2022",
          "url": "https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--aa60abd5-cc76-48b0-b39f-510317b18434",
      "subject": "ATTACK:enterprise:S0673",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--aa60abd5-cc76-48b0-b39f-510317b18434",
      "modified": "2026-04-29T14:23:06.157Z",
      "references": [
        {
          "source_name": "Prevailion DarkWatchman 2021",
          "url": "https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ab4d5c44-b402-4b17-8c23-719e74076dce",
      "subject": "ATTACK:enterprise:C0027",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ab4d5c44-b402-4b17-8c23-719e74076dce",
      "modified": "2026-07-31T18:47:33.595Z",
      "references": [
        {
          "source_name": "Crowdstrike TELCO BPO Campaign December 2022",
          "url": "https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ab51525b-93c6-4ea8-bd83-b9547f1317bb",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ab51525b-93c6-4ea8-bd83-b9547f1317bb",
      "modified": "2026-07-31T18:48:08.645Z",
      "references": [
        {
          "source_name": "Mandiant No Easy Breach",
          "url": "https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ab5f4ee8-c7fc-4be4-bb39-0536d7d7eba3",
      "subject": "ATTACK:enterprise:S1070",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ab5f4ee8-c7fc-4be4-bb39-0536d7d7eba3",
      "modified": "2026-04-29T14:23:06.158Z",
      "references": [
        {
          "source_name": "NCC Group Black Basta June 2022",
          "url": "https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--afd3118f-bde5-4c02-8e82-045edec0dfdc",
      "subject": "ATTACK:enterprise:C0022",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--afd3118f-bde5-4c02-8e82-045edec0dfdc",
      "modified": "2026-07-31T21:14:22.803Z",
      "references": [
        {
          "source_name": "ESET Lazarus Jun 2020",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_Operation_Interception.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b26c15f9-0679-402b-bcf5-bdae40921f93",
      "subject": "ATTACK:enterprise:S0640",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b26c15f9-0679-402b-bcf5-bdae40921f93",
      "modified": "2026-04-29T14:23:06.169Z",
      "references": [
        {
          "source_name": "Hornet Security Avaddon June 2020",
          "url": "https://www.hornetsecurity.com/en/security-information/avaddon-from-seeking-affiliates-to-in-the-wild-in-2-days/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b4810e29-e543-4816-a6a2-d9c0b96eed07",
      "subject": "ATTACK:enterprise:S0340",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b4810e29-e543-4816-a6a2-d9c0b96eed07",
      "modified": "2026-04-29T14:23:06.172Z",
      "references": [
        {
          "source_name": "Securelist Octopus Oct 2018",
          "url": "https://securelist.com/octopus-infested-seas-of-central-asia/88200/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b55a3ac1-bb12-4507-a323-221b893df51b",
      "subject": "ATTACK:enterprise:S0376",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b55a3ac1-bb12-4507-a323-221b893df51b",
      "modified": "2026-04-29T14:23:06.173Z",
      "references": [
        {
          "source_name": "US-CERT HOPLIGHT Apr 2019",
          "url": "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b67e0e26-717f-4aab-871c-22d9bfddc5d1",
      "subject": "ATTACK:enterprise:S9026",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b67e0e26-717f-4aab-871c-22d9bfddc5d1",
      "modified": "2026-04-29T14:23:06.174Z",
      "references": [
        {
          "source_name": "Trend Micro Earth Kasha Anel NOV 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"
        },
        {
          "source_name": "Trend Micro Earth Kasha Updates APR 2025",
          "url": "https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b792772b-381c-4ad3-896b-52f7873d88fa",
      "subject": "ATTACK:enterprise:C0025",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b792772b-381c-4ad3-896b-52f7873d88fa",
      "modified": "2026-07-31T21:05:26.285Z",
      "references": [
        {
          "source_name": "Dragos Crashoverride 2018",
          "url": "https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b835f71a-b961-4d69-a7eb-6bf682f433de",
      "subject": "ATTACK:enterprise:S1032",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b835f71a-b961-4d69-a7eb-6bf682f433de",
      "modified": "2026-04-29T14:23:06.177Z",
      "references": [
        {
          "source_name": "Checkpoint MosesStaff Nov 2021",
          "url": "https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b8ead9c4-0403-4b23-b33f-8ac1c57f8e82",
      "subject": "ATTACK:enterprise:S0449",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b8ead9c4-0403-4b23-b33f-8ac1c57f8e82",
      "modified": "2026-04-29T14:23:06.178Z",
      "references": [
        {
          "source_name": "McAfee Maze March 2020",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-maze/"
        },
        {
          "source_name": "Sophos Maze VM September 2020",
          "url": "https://news.sophos.com/en-us/2020/09/17/maze-attackers-adopt-ragnar-locker-virtual-machine-technique/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bd0cff5e-762e-4ba0-ab42-9bfe84e8db4f",
      "subject": "ATTACK:enterprise:G0049",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bd0cff5e-762e-4ba0-ab42-9bfe84e8db4f",
      "modified": "2026-07-31T20:48:35.804Z",
      "references": [
        {
          "source_name": "FireEye APT34 Webinar Dec 2017",
          "url": "https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"
        },
        {
          "source_name": "Symantec Crambus OCT 2023",
          "url": "https://www.security.com/threat-intelligence/crambus-middle-east-government"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bf2a459d-7a6f-4945-a3f6-3dbf8a40a8c6",
      "subject": "ATTACK:enterprise:C0060",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bf2a459d-7a6f-4945-a3f6-3dbf8a40a8c6",
      "modified": "2026-07-31T18:47:27.283Z",
      "references": [
        {
          "source_name": "ESET MirrorFace 2025",
          "url": "https://www.welivesecurity.com/en/eset-research/operation-akairyu-mirrorface-invites-europe-expo-2025-revives-anel-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c380f574-0f88-4481-84c2-f429bd47c84d",
      "subject": "ATTACK:enterprise:C0014",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c380f574-0f88-4481-84c2-f429bd47c84d",
      "modified": "2026-07-31T18:47:31.898Z",
      "references": [
        {
          "source_name": "FoxIT Wocao December 2019",
          "url": "https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c53a4d1a-7d41-451e-a4f8-4f69ad27ab7d",
      "subject": "ATTACK:enterprise:G0112",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c53a4d1a-7d41-451e-a4f8-4f69ad27ab7d",
      "modified": "2026-09-02T18:52:47.155Z",
      "references": [
        {
          "source_name": "BlackBerry Bahamut",
          "url": "https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c5517f93-efd9-4fa5-83a4-8403ac85f831",
      "subject": "ATTACK:enterprise:C0038",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c5517f93-efd9-4fa5-83a4-8403ac85f831",
      "modified": "2026-07-31T21:13:11.198Z",
      "references": [
        {
          "source_name": "Microsoft Albanian Government Attacks September 2022",
          "url": "https://www.microsoft.com/en-us/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c8e9b49a-4509-407b-9d49-1c1d6f4cb794",
      "subject": "ATTACK:enterprise:G0037",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c8e9b49a-4509-407b-9d49-1c1d6f4cb794",
      "modified": "2026-07-31T20:48:31.054Z",
      "references": [
        {
          "source_name": "Security Intelligence More Eggs Aug 2019",
          "url": "https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c99fffdf-67c0-4ac4-85c8-d700395a2368",
      "subject": "ATTACK:enterprise:G1059",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c99fffdf-67c0-4ac4-85c8-d700395a2368",
      "modified": "2026-10-01T21:37:41.736Z",
      "references": [
        {
          "source_name": "Mandiant_UNC1549TTPsTools_Nov2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cc506d7d-c2c4-4a56-b8d6-bfca131bfcca",
      "subject": "ATTACK:enterprise:S0616",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cc506d7d-c2c4-4a56-b8d6-bfca131bfcca",
      "modified": "2026-04-29T14:23:06.204Z",
      "references": [
        {
          "source_name": "FireEye FiveHands April 2021",
          "url": "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d1c6f29d-56e0-4d46-a7ec-a6d0a868cde3",
      "subject": "ATTACK:enterprise:G1022",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d1c6f29d-56e0-4d46-a7ec-a6d0a868cde3",
      "modified": "2026-07-31T18:48:14.402Z",
      "references": [
        {
          "source_name": "Kaspersky ToddyCat Check Logs October 2023",
          "url": "https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d295beee-439c-44f9-9908-4cb194331de9",
      "subject": "ATTACK:enterprise:G0009",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d295beee-439c-44f9-9908-4cb194331de9",
      "modified": "2026-07-31T18:48:12.808Z",
      "references": [
        {
          "source_name": "Alperovitch 2014",
          "url": "https://web.archive.org/web/20200424075623/https:/www.crowdstrike.com/blog/deep-thought-chinese-targeting-national-security-think-tanks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d47ea1ea-ea4c-46e0-b761-9b6c24888be6",
      "subject": "ATTACK:enterprise:S1081",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d47ea1ea-ea4c-46e0-b761-9b6c24888be6",
      "modified": "2026-04-29T14:23:06.216Z",
      "references": [
        {
          "source_name": "Gigamon BADHATCH Jul 2019",
          "url": "https://blog.gigamon.com/2019/07/23/abadbabe-8badf00d-discovering-badhatch-and-a-detailed-look-at-fin8s-tooling/"
        },
        {
          "source_name": "BitDefender BADHATCH Mar 2021",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d4c4e420-4e1a-420d-9d6a-08fe6d322217",
      "subject": "ATTACK:enterprise:G0027",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d4c4e420-4e1a-420d-9d6a-08fe6d322217",
      "modified": "2026-07-31T18:48:29.734Z",
      "references": [
        {
          "source_name": "Nccgroup Emissary Panda May 2018",
          "url": "https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d9c20d20-cd4a-45cf-81a2-e9a8f6c9e78c",
      "subject": "ATTACK:enterprise:S0386",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d9c20d20-cd4a-45cf-81a2-e9a8f6c9e78c",
      "modified": "2026-04-29T14:23:06.222Z",
      "references": [
        {
          "source_name": "Bromium Ursnif Mar 2017",
          "url": "https://www.bromium.com/how-ursnif-evades-detection/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--da68887e-3811-4537-90b1-21d42a90e960",
      "subject": "ATTACK:enterprise:C0024",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--da68887e-3811-4537-90b1-21d42a90e960",
      "modified": "2026-07-31T18:47:27.543Z",
      "references": [
        {
          "source_name": "Microsoft 365 Defender Solorigate",
          "url": "https://www.microsoft.com/security/blog/2020/12/28/using-microsoft-365-defender-to-coordinate-protection-against-solorigate/"
        },
        {
          "source_name": "Microsoft Deep Dive Solorigate January 2021",
          "url": "https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--db1a20ca-55a0-42db-b0e5-d600478baddd",
      "subject": "ATTACK:enterprise:S0154",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--db1a20ca-55a0-42db-b0e5-d600478baddd",
      "modified": "2026-04-29T14:23:06.224Z",
      "references": [
        {
          "source_name": "DFIR Conti Bazar Nov 2021",
          "url": "https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/"
        },
        {
          "source_name": "cobaltstrike manual",
          "url": "https://web.archive.org/web/20210825130434/https://cobaltstrike.com/downloads/csmanual38.pdf"
        },
        {
          "source_name": "Cobalt Strike Manual 4.3 November 2020",
          "url": "https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--dcd99f6a-c554-4b04-a962-dc3a5f89cdf9",
      "subject": "ATTACK:enterprise:S0546",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--dcd99f6a-c554-4b04-a962-dc3a5f89cdf9",
      "modified": "2026-04-29T14:23:06.227Z",
      "references": [
        {
          "source_name": "Cybereason Molerats Dec 2020",
          "url": "https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf"
        },
        {
          "source_name": "BleepingComputer Molerats Dec 2020",
          "url": "https://www.bleepingcomputer.com/news/security/hacking-group-s-new-malware-abuses-google-and-facebook-services/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--dcda00f6-f5c1-412f-acb1-a431235fc6cc",
      "subject": "ATTACK:enterprise:S0650",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--dcda00f6-f5c1-412f-acb1-a431235fc6cc",
      "modified": "2026-04-29T14:23:06.227Z",
      "references": [
        {
          "source_name": "Kaspersky QakBot September 2021",
          "url": "https://securelist.com/qakbot-technical-analysis/103931/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--dd050277-bfac-41ba-a40f-7970f2d36189",
      "subject": "ATTACK:enterprise:S0339",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--dd050277-bfac-41ba-a40f-7970f2d36189",
      "modified": "2026-04-29T14:23:06.227Z",
      "references": [
        {
          "source_name": "Talos Micropsia June 2017",
          "url": "https://blog.talosintelligence.com/2017/06/palestine-delphi.html"
        },
        {
          "source_name": "Radware Micropsia July 2018",
          "url": "https://www.radware.com/blog/security/2018/07/micropsia-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--dd9f0b9b-a1f9-4cd7-a80f-69ae0b52af95",
      "subject": "ATTACK:enterprise:G1054",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--dd9f0b9b-a1f9-4cd7-a80f-69ae0b52af95",
      "modified": "2026-07-31T18:48:09.203Z",
      "references": [
        {
          "source_name": "JPCERT MirrorFace JUL 2024",
          "url": "https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ddd5f16a-68c9-44fd-a5d1-b43b8f6ea79d",
      "subject": "ATTACK:enterprise:G1044",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ddd5f16a-68c9-44fd-a5d1-b43b8f6ea79d",
      "modified": "2026-07-31T18:48:16.454Z",
      "references": [
        {
          "source_name": "Mandiant APT42-untangling",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e1ffe097-446d-4a68-b273-efee58aa110c",
      "subject": "ATTACK:enterprise:S1228",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e1ffe097-446d-4a68-b273-efee58aa110c",
      "modified": "2026-04-29T14:23:06.233Z",
      "references": [
        {
          "source_name": "Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e38d9f5e-70bd-40ed-8164-565caab36b65",
      "subject": "ATTACK:enterprise:G1003",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e38d9f5e-70bd-40ed-8164-565caab36b65",
      "modified": "2026-07-31T18:48:13.655Z",
      "references": [
        {
          "source_name": "CISA GRU29155 2024",
          "url": "https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e3cd7b09-c244-4b5e-9a99-f1431489ed49",
      "subject": "ATTACK:enterprise:S0534",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e3cd7b09-c244-4b5e-9a99-f1431489ed49",
      "modified": "2026-04-29T14:23:06.235Z",
      "references": [
        {
          "source_name": "Cybereason Bazar July 2020",
          "url": "https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"
        },
        {
          "source_name": "DFIR Ryuk's Return October 2020",
          "url": "https://thedfirreport.com/2020/10/08/ryuks-return/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e40a416e-ca15-4c15-b469-20549b81e6bd",
      "subject": "ATTACK:enterprise:G0114",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e40a416e-ca15-4c15-b469-20549b81e6bd",
      "modified": "2026-07-31T20:48:41.613Z",
      "references": [
        {
          "source_name": "Cycraft Chimera April 2020",
          "url": "https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"
        },
        {
          "source_name": "NCC Group Chimera January 2021",
          "url": "https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e50b989c-9ad6-44c6-8eb7-b44af742cc40",
      "subject": "ATTACK:enterprise:S0457",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e50b989c-9ad6-44c6-8eb7-b44af742cc40",
      "modified": "2026-04-29T14:23:06.237Z",
      "references": [
        {
          "source_name": "TrendMicro Netwalker May 2020",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e5462f64-0583-4228-bc85-c3650a4dcfbb",
      "subject": "ATTACK:enterprise:C0007",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e5462f64-0583-4228-bc85-c3650a4dcfbb",
      "modified": "2026-07-31T18:47:27.579Z",
      "references": [
        {
          "source_name": "Bitdefender FunnyDream Campaign November 2020",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e725b4a0-9efd-4960-a05c-f2f184b25840",
      "subject": "ATTACK:enterprise:G1043",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e725b4a0-9efd-4960-a05c-f2f184b25840",
      "modified": "2026-07-31T18:47:36.667Z",
      "references": [
        {
          "source_name": "FBI BlackByte 2022",
          "url": "https://www.ic3.gov/CSA/2022/220211.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e75c948b-7ce8-4872-a3c4-4a2b01828418",
      "subject": "ATTACK:enterprise:G1016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e75c948b-7ce8-4872-a3c4-4a2b01828418",
      "modified": "2026-07-31T18:48:31.527Z",
      "references": [
        {
          "source_name": "Sygnia Elephant Beetle Jan 2022",
          "url": "https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"
        },
        {
          "source_name": "Mandiant FIN13 Aug 2022",
          "url": "https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e7995f43-d3f1-4ad2-b3bd-fc835faa3333",
      "subject": "ATTACK:enterprise:S1160",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e7995f43-d3f1-4ad2-b3bd-fc835faa3333",
      "modified": "2026-04-29T14:23:06.240Z",
      "references": [
        {
          "source_name": "Bitsight Latrodectus June 2024",
          "url": "https://www.bitsight.com/blog/latrodectus-are-you-coming-back"
        },
        {
          "source_name": "Elastic Latrodectus May 2024",
          "url": "https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e8e4b87c-3d30-4627-8060-5b5116d057fc",
      "subject": "ATTACK:enterprise:S0156",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e8e4b87c-3d30-4627-8060-5b5116d057fc",
      "modified": "2026-04-29T14:23:06.242Z",
      "references": [
        {
          "source_name": "FireEye APT32 May 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e91ec241-b329-4488-ac65-442992f84fb5",
      "subject": "ATTACK:enterprise:S0476",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e91ec241-b329-4488-ac65-442992f84fb5",
      "modified": "2026-04-29T14:23:06.242Z",
      "references": [
        {
          "source_name": "SentinelOne Valak June 2020",
          "url": "https://assets.sentinelone.com/labs/sentinel-one-valak-i"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ed656cf9-64ea-411b-82b8-5260c2694cfd",
      "subject": "ATTACK:enterprise:S0568",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ed656cf9-64ea-411b-82b8-5260c2694cfd",
      "modified": "2026-04-29T14:23:06.248Z",
      "references": [
        {
          "source_name": "Prevailion EvilNum May 2020",
          "url": "https://web.archive.org/web/20221209052853/https://www.prevailion.com/phantom-in-the-command-shell-2/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ee38932c-ab04-4ac5-9ca3-d14cc98f5476",
      "subject": "ATTACK:enterprise:G0059",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ee38932c-ab04-4ac5-9ca3-d14cc98f5476",
      "modified": "2026-07-31T18:48:29.674Z",
      "references": [
        {
          "source_name": "DFIR Report APT35 ProxyShell March 2022",
          "url": "https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ef41cf60-c60d-4c1f-aa2c-ee9cc73641f4",
      "subject": "ATTACK:enterprise:S0663",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ef41cf60-c60d-4c1f-aa2c-ee9cc73641f4",
      "modified": "2026-04-29T14:23:06.251Z",
      "references": [
        {
          "source_name": "Trend Micro Iron Tiger April 2021",
          "url": "https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ef8154b8-b6d3-493f-9bf5-1d5c147108bc",
      "subject": "ATTACK:enterprise:S0674",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ef8154b8-b6d3-493f-9bf5-1d5c147108bc",
      "modified": "2026-04-29T14:23:06.251Z",
      "references": [
        {
          "source_name": "Check Point APT35 CharmPower January 2022",
          "url": "https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f1eaa7b9-4320-4549-aaa5-f992aad3ae1e",
      "subject": "ATTACK:enterprise:S0265",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f1eaa7b9-4320-4549-aaa5-f992aad3ae1e",
      "modified": "2026-04-29T14:23:06.254Z",
      "references": [
        {
          "source_name": "Unit 42 Kazuar May 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f395cb28-5bc0-487e-b679-155ac785b7d9",
      "subject": "ATTACK:enterprise:G0096",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f395cb28-5bc0-487e-b679-155ac785b7d9",
      "modified": "2026-07-31T20:48:27.653Z",
      "references": [
        {
          "source_name": "apt41_dcsocytec_dec2022",
          "url": "https://medium.com/@DCSO_CyTec/apt41-the-spy-who-failed-to-encrypt-me-24fc0f49cad1"
        },
        {
          "source_name": "FireEye APT41 Aug 2019",
          "url": "https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"
        },
        {
          "source_name": "Group IB APT 41 June 2021",
          "url": "https://www.group-ib.com/blog/colunmtk-apt41/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f95453f6-4b23-4ec4-bd76-7f44bca126b4",
      "subject": "ATTACK:enterprise:C0018",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f95453f6-4b23-4ec4-bd76-7f44bca126b4",
      "modified": "2026-07-31T18:47:23.344Z",
      "references": [
        {
          "source_name": "Costa AvosLocker May 2022",
          "url": "https://www.linkedin.com/pulse/raas-avoslocker-incident-response-analysis-fl%C3%A1vio-costa?trk=articles_directory"
        },
        {
          "source_name": "Cisco Talos Avos Jun 2022",
          "url": "https://blog.talosintelligence.com/avoslocker-new-arsenal/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fb9a793b-0ed7-4152-8802-e1861ad32ad2",
      "subject": "ATTACK:enterprise:S0532",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fb9a793b-0ed7-4152-8802-e1861ad32ad2",
      "modified": "2026-04-29T14:23:06.266Z",
      "references": [
        {
          "source_name": "Unit 42 Lucifer June 2020",
          "url": "https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fd763f17-409d-428b-825c-f731b0ad88cc",
      "subject": "ATTACK:enterprise:G0061",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fd763f17-409d-428b-825c-f731b0ad88cc",
      "modified": "2026-07-31T18:48:30.176Z",
      "references": [
        {
          "source_name": "FireEye Obfuscation June 2017",
          "url": "https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html"
        },
        {
          "source_name": "FireEye Know Your Enemy FIN8 Aug 2016",
          "url": "https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"
        },
        {
          "source_name": "Bitdefender FIN8 July 2021",
          "url": "https://businessinsights.bitdefender.com/deep-dive-into-a-fin8-attack-a-forensic-investigation"
        },
        {
          "source_name": "Symantec FIN8 Jul 2023",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fdb57199-1097-4e0b-92c9-c578283c12e8",
      "subject": "ATTACK:enterprise:S9051",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fdb57199-1097-4e0b-92c9-c578283c12e8",
      "modified": "2026-09-30T20:26:06.736Z",
      "references": [
        {
          "source_name": "CheckPointResearch_TheGentlemen_April2026",
          "url": "https://research.checkpoint.com/2026/dfir-report-the-gentlemen/"
        },
        {
          "source_name": "MSTI_GentelmenRansomware_May2026",
          "url": "https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fe4c0535-7491-4345-a524-11f8434e3678",
      "subject": "ATTACK:enterprise:S0237",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fe4c0535-7491-4345-a524-11f8434e3678",
      "modified": "2026-04-29T14:23:06.270Z",
      "references": [
        {
          "source_name": "Talos GravityRAT",
          "url": "https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    }
  ],
  "source_snapshot": {
    "file": "enterprise-attack-20.0.json",
    "url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
    "sha256": "81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352",
    "bytes": 55271014,
    "checked_at": "2026-10-16T03:31:39Z"
  },
  "notices_url": "https://aol.pm/source-notices.txt",
  "notices": "License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"
}

License
-------
The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,
development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce
MITRE's copyright designation and this license in any such copy.

"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation."

Disclaimers
-----------
MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part
of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover
full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or
variations on existing techniques not documented by ATT&CK.

ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE
ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,
AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT
THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR
FITNESS FOR A PARTICULAR PURPOSE.