{"record":{"id":"ATTACK:enterprise:T1053.005","title":"Scheduled Task","type":"Subtechnique","source_url":"https://attack.mitre.org/techniques/T1053/005","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--005a06c6-14bf-4118-afa0-ebcd8aebb0c9","external_id":"T1053.005","domain":"enterprise","created":"2019-11-27T14:58:00.429Z","modified":"2026-05-12T15:12:00.618Z","version":"1.8","aliases":[],"tactics":["execution","persistence","privilege-escalation"],"source_references":[{"source_name":"ProofPoint Serpent","url":"https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain"},{"source_name":"Defending Against Scheduled Task Attacks in Windows Environments","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/06/20/defending-against-scheduled-task-attacks-in-windows-environments"},{"source_name":"Twitter Leoloobeek Scheduled Task","url":"https://x.com/leoloobeek/status/939248813465853953"},{"source_name":"Tarrask scheduled task","url":"https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/"},{"source_name":"Microsoft Scheduled Task Events Win10","url":"https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events"},{"source_name":"TechNet Scheduled Task Events","url":"https://technet.microsoft.com/library/dd315590.aspx"},{"source_name":"Red Canary - Atomic Red Team","url":"https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md"},{"source_name":"TechNet Autoruns","url":"https://technet.microsoft.com/en-us/sysinternals/bb963902"},{"source_name":"TechNet Forum Scheduled Task Operational Setting","url":"https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen"},{"source_name":"SigmaHQ","url":"https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_sd_value_removal.yml"},{"source_name":"Stack Overflow","url":"https://stackoverflow.com/questions/2913816/how-to-find-the-location-of-the-scheduled-tasks-folder"}]},"assertions":[{"id":"enterprise:relationship--005b6fd1-be80-424b-b6df-2ff88d390b1b","subject":"ATTACK:enterprise:S0588","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--005b6fd1-be80-424b-b6df-2ff88d390b1b","modified":"2026-04-29T14:23:05.903Z","references":[{"source_name":"MSTIC NOBELIUM Mar 2021","url":"https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--00b0b6ec-a9eb-4fdd-b7ea-6e6c8a8ab1fc","subject":"ATTACK:enterprise:M1026","predicate":"mitigates","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--00b0b6ec-a9eb-4fdd-b7ea-6e6c8a8ab1fc","modified":"2026-04-29T14:23:05.903Z","references":[{"source_name":"TechNet Scheduling Priority","url":"https://technet.microsoft.com/library/dn221960.aspx"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--02085573-6f4a-495f-b3a7-81ac97ce3377","subject":"ATTACK:enterprise:S9001","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--02085573-6f4a-495f-b3a7-81ac97ce3377","modified":"2026-04-29T14:23:05.905Z","references":[{"source_name":"SophosGnGal_SystemBC_Dec2020","url":"https://news.sophos.com/en-us/2020/12/16/systembc/"},{"source_name":"TrumanKroll_SYSTEMBCServer_Jan2024","url":"https://www.kroll.com/en/publications/cyber/inside-the-systembc-malware-server"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0327e5d8-877c-4efe-bedc-9807279d74dc","subject":"ATTACK:enterprise:S0648","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0327e5d8-877c-4efe-bedc-9807279d74dc","modified":"2026-04-29T14:23:05.907Z","references":[{"source_name":"CrowdStrike Carbon Spider August 2021","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--053d1126-0d8d-4048-be96-d1a395a1fe8c","subject":"ATTACK:enterprise:S0414","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--053d1126-0d8d-4048-be96-d1a395a1fe8c","modified":"2026-04-29T14:23:05.910Z","references":[{"source_name":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--081a9ee3-3609-4bab-8956-d0bd2b77754a","subject":"ATTACK:enterprise:C0024","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--081a9ee3-3609-4bab-8956-d0bd2b77754a","modified":"2026-07-31T18:47:26.281Z","references":[{"source_name":"Volexity SolarWinds","url":"https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/"},{"source_name":"CrowdStrike SUNSPOT Implant January 2021","url":"https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/"},{"source_name":"FireEye SUNBURST Backdoor December 2020","url":"https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--08c8fe77-b0b9-45e7-a2bf-e09257fa83f7","subject":"ATTACK:enterprise:S1014","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--08c8fe77-b0b9-45e7-a2bf-e09257fa83f7","modified":"2026-04-29T14:23:05.915Z","references":[{"source_name":"SecureWorks August 2019","url":"https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--09266cb7-26b3-4959-bcff-a91e309b5588","subject":"ATTACK:enterprise:S0170","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--09266cb7-26b3-4959-bcff-a91e309b5588","modified":"2026-04-29T14:23:05.916Z","references":[{"source_name":"ClearSky OilRig Jan 2017","url":"http://www.clearskysec.com/oilrig/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0ca1948b-476c-4ff5-a792-f3790250bdc1","subject":"ATTACK:enterprise:G0022","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0ca1948b-476c-4ff5-a792-f3790250bdc1","modified":"2026-07-31T18:47:37.620Z","references":[{"source_name":"FireEye Operation Double Tap","url":"https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0cc48b39-3f2c-4c27-be1a-0fb6cd7bcaaf","subject":"ATTACK:enterprise:S1015","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0cc48b39-3f2c-4c27-be1a-0fb6cd7bcaaf","modified":"2026-04-29T14:23:05.920Z","references":[{"source_name":"Accenture Lyceum Targets November 2021","url":"https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns"},{"source_name":"ClearSky Siamesekitten August 2021","url":"https://www.clearskysec.com/siamesekitten/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0e35d2ce-3af7-4645-b795-382a75d62fb9","subject":"ATTACK:enterprise:S0697","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0e35d2ce-3af7-4645-b795-382a75d62fb9","modified":"2026-04-29T14:23:05.923Z","references":[{"source_name":"Symantec Ukraine Wipers February 2022","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0e9c2a2e-0f0b-4133-88a1-d44e0669003d","subject":"ATTACK:enterprise:S1166","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0e9c2a2e-0f0b-4133-88a1-d44e0669003d","modified":"2026-04-29T14:23:05.924Z","references":[{"source_name":"ESET OilRig Campaigns Sep 2023","url":"https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--11875739-9167-4e09-8a97-0e5b19d5e795","subject":"ATTACK:enterprise:C0058","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--11875739-9167-4e09-8a97-0e5b19d5e795","modified":"2026-07-31T18:47:17.830Z","references":[{"source_name":"Microsoft SharePoint Exploit JUL 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/#storm-2603"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--17ce446f-1a76-46d5-a276-589713425af8","subject":"ATTACK:enterprise:S0266","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--17ce446f-1a76-46d5-a276-589713425af8","modified":"2026-04-29T14:23:05.937Z","references":[{"source_name":"S2 Grupo TrickBot June 2017","url":"https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf"},{"source_name":"Trend Micro Totbrick Oct 2016","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/tspy_trickload.n"},{"source_name":"Microsoft Totbrick Oct 2017","url":"https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Totbrick"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--185a72dd-e151-4eba-81f4-c3eeaa67873a","subject":"ATTACK:enterprise:S0335","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--185a72dd-e151-4eba-81f4-c3eeaa67873a","modified":"2026-04-29T14:23:05.938Z","references":[{"source_name":"ESET Carbon Mar 2017","url":"https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--19153106-5607-4cac-91a5-c2a900bc5343","subject":"ATTACK:enterprise:S0126","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--19153106-5607-4cac-91a5-c2a900bc5343","modified":"2026-04-29T14:23:05.939Z","references":[{"source_name":"ESET ComRAT May 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"},{"source_name":"CISA ComRAT Oct 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1aa10371-6473-416a-8b8b-17c36f700233","subject":"ATTACK:enterprise:S0044","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1aa10371-6473-416a-8b8b-17c36f700233","modified":"2026-04-29T14:23:05.941Z","references":[{"source_name":"ESET Sednit Part 1","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part1.pdf"},{"source_name":"ESET Sednit July 2015","url":"http://www.welivesecurity.com/2015/07/10/sednit-apt-group-meets-hacking-team/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1b1027ff-81d2-4ae9-85ac-0d886dea8a04","subject":"ATTACK:enterprise:G0080","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1b1027ff-81d2-4ae9-85ac-0d886dea8a04","modified":"2026-07-31T18:48:22.816Z","references":[{"source_name":"Group IB Cobalt Aug 2017","url":"https://www.group-ib.com/blog/cobalt"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1cf0ee67-cf78-419a-acaf-79a49ada0211","subject":"ATTACK:enterprise:S9023","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1cf0ee67-cf78-419a-acaf-79a49ada0211","modified":"2026-04-29T14:23:05.944Z","references":[{"source_name":"ESET HiddenFace 2024","url":"https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_2_8_Breitenbacher_en.pdf"},{"source_name":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1d7e1954-b020-4578-9a57-b1596a7a25ff","subject":"ATTACK:enterprise:G0091","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1d7e1954-b020-4578-9a57-b1596a7a25ff","modified":"2026-07-31T18:48:21.015Z","references":[{"source_name":"Cyber Forensicator Silence Jan 2019","url":"https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1ddc8822-55de-4671-8a73-c95d6383016f","subject":"ATTACK:enterprise:G0114","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1ddc8822-55de-4671-8a73-c95d6383016f","modified":"2026-07-31T20:48:41.194Z","references":[{"source_name":"Cycraft Chimera April 2020","url":"https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"},{"source_name":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1dfccb9f-6a8e-46fb-8a0b-d1b0568da2ed","subject":"ATTACK:enterprise:S1199","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1dfccb9f-6a8e-46fb-8a0b-d1b0568da2ed","modified":"2026-04-29T14:23:05.945Z","references":[{"source_name":"Palo Alto Lockbit 2.0 JUN 2022","url":"https://unit42.paloaltonetworks.com/lockbit-2-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1e666715-f087-44ad-aaa5-d22fbda42fba","subject":"ATTACK:enterprise:G0040","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1e666715-f087-44ad-aaa5-d22fbda42fba","modified":"2026-07-31T20:48:26.211Z","references":[{"source_name":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1ea32af4-a6e3-4ead-9829-35ffc4c91426","subject":"ATTACK:enterprise:G1034","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1ea32af4-a6e3-4ead-9829-35ffc4c91426","modified":"2026-07-31T18:48:26.917Z","references":[{"source_name":"ESET EvasivePanda 2024","url":"https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1ebc312e-68a4-4119-94c5-79897a5bf5b4","subject":"ATTACK:enterprise:S0248","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1ebc312e-68a4-4119-94c5-79897a5bf5b4","modified":"2026-04-29T14:23:05.946Z","references":[{"source_name":"ASERT Donot March 2018","url":"https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1f7b17e9-9ad3-42dd-ab92-e3afe752247b","subject":"ATTACK:enterprise:G0046","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1f7b17e9-9ad3-42dd-ab92-e3afe752247b","modified":"2026-07-31T20:48:31.750Z","references":[{"source_name":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"},{"source_name":"FireEye FIN7 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"},{"source_name":"FireEye FIN7 Aug 2018","url":"https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"},{"source_name":"Morphisec FIN7 June 2017","url":"http://blog.morphisec.com/fin7-attacks-restaurant-industry"},{"source_name":"Flashpoint FIN 7 March 2019","url":"https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2496d1c4-cb04-40ab-9f9a-0102da3e6d77","subject":"ATTACK:enterprise:S0589","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2496d1c4-cb04-40ab-9f9a-0102da3e6d77","modified":"2026-04-29T14:23:05.955Z","references":[{"source_name":"MSTIC NOBELIUM Mar 2021","url":"https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--250638f3-ac26-4aec-adf4-9e705822b621","subject":"ATTACK:enterprise:S0504","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--250638f3-ac26-4aec-adf4-9e705822b621","modified":"2026-04-29T14:23:05.956Z","references":[{"source_name":"Cyberreason Anchor December 2019","url":"https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--256edc9a-e5fa-48fc-b398-eb0873d46e78","subject":"ATTACK:enterprise:S0632","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--256edc9a-e5fa-48fc-b398-eb0873d46e78","modified":"2026-04-29T14:23:05.956Z","references":[{"source_name":"Group IB GrimAgent July 2021","url":"https://www.group-ib.com/blog/grimagent/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--26487c38-877a-4f63-8877-b0fa1624fa71","subject":"ATTACK:enterprise:G1018","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--26487c38-877a-4f63-8877-b0fa1624fa71","modified":"2026-07-31T18:47:55.084Z","references":[{"source_name":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--272c29eb-9f83-4a90-a9b2-e823182204a7","subject":"ATTACK:enterprise:G0093","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--272c29eb-9f83-4a90-a9b2-e823182204a7","modified":"2026-07-31T18:47:37.039Z","references":[{"source_name":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2cc7c10f-45a7-4573-b75e-ad15b11fb813","subject":"ATTACK:enterprise:G0034","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2cc7c10f-45a7-4573-b75e-ad15b11fb813","modified":"2026-07-31T20:48:32.712Z","references":[{"source_name":"mandiant_apt44_unearthing_sandworm","url":"https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2d1b98bb-cbc8-492a-9861-f350153291cd","subject":"ATTACK:enterprise:S1064","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2d1b98bb-cbc8-492a-9861-f350153291cd","modified":"2026-04-29T14:23:05.966Z","references":[{"source_name":"HP SVCReady Jun 2022","url":"https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2d478e66-fa0d-4834-8b17-5761369e9867","subject":"ATTACK:enterprise:G1043","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2d478e66-fa0d-4834-8b17-5761369e9867","modified":"2026-07-31T18:47:35.643Z","references":[{"source_name":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source_name":"FBI BlackByte 2022","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2e532de4-b002-4c2d-a37c-6d535ff090fa","subject":"ATTACK:enterprise:S0409","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2e532de4-b002-4c2d-a37c-6d535ff090fa","modified":"2026-04-29T14:23:05.967Z","references":[{"source_name":"ESET Machete July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"},{"source_name":"Securelist Machete Aug 2014","url":"https://securelist.com/el-machete/66108/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2ed90af5-43e7-4c81-b03d-6d4b54988d75","subject":"ATTACK:enterprise:G1001","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2ed90af5-43e7-4c81-b03d-6d4b54988d75","modified":"2026-07-31T20:48:51.712Z","references":[{"source_name":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--300fe039-5361-41e2-857f-5a8a311824d9","subject":"ATTACK:enterprise:G0129","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--300fe039-5361-41e2-857f-5a8a311824d9","modified":"2026-07-31T18:47:51.887Z","references":[{"source_name":"Anomali MUSTANG PANDA October 2019","url":"https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"},{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source_name":"Secureworks BRONZE PRESIDENT December 2019","url":"https://www.secureworks.com/research/bronze-president-targets-ngos"},{"source_name":"McAfee Dianxun March 2021","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-dianxun.pdf"},{"source_name":"Unit42 Chinese VSCode 06 September 2024","url":"https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--31fe18d1-7799-466c-adb3-3be923ed4f3a","subject":"ATTACK:enterprise:S0546","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--31fe18d1-7799-466c-adb3-3be923ed4f3a","modified":"2026-04-29T14:23:05.982Z","references":[{"source_name":"Cybereason Molerats Dec 2020","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3258c355-677c-452d-b1fc-27767232437b","subject":"ATTACK:enterprise:S0368","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3258c355-677c-452d-b1fc-27767232437b","modified":"2026-04-29T14:23:05.984Z","references":[{"source_name":"Talos Nyetya June 2017","url":"https://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--33390e6e-f262-48fb-a74a-084c310b3aa2","subject":"ATTACK:enterprise:G0059","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--33390e6e-f262-48fb-a74a-084c310b3aa2","modified":"2026-07-31T18:48:28.300Z","references":[{"source_name":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source_name":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--34ed3c2a-3e75-4c9c-966c-7fc33b92092e","subject":"ATTACK:enterprise:C0034","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--34ed3c2a-3e75-4c9c-966c-7fc33b92092e","modified":"2026-07-31T21:11:05.233Z","references":[{"source_name":"Mandiant-Sandworm-Ukraine-2022","url":"https://www.mandiant.com/resources/blog/sandworm-disrupts-power-ukraine-operational-technology"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--35437cd0-280a-407d-9f3a-36dc61deba1a","subject":"ATTACK:enterprise:S1160","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--35437cd0-280a-407d-9f3a-36dc61deba1a","modified":"2026-04-29T14:23:05.991Z","references":[{"source_name":"Bitsight Latrodectus June 2024","url":"https://www.bitsight.com/blog/latrodectus-are-you-coming-back"},{"source_name":"Latrodectus APR 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"},{"source_name":"Elastic Latrodectus May 2024","url":"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3781213b-225b-4c18-bfb6-f69d622887f6","subject":"ATTACK:enterprise:S1147","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3781213b-225b-4c18-bfb6-f69d622887f6","modified":"2026-04-29T14:23:05.996Z","references":[{"source_name":"Symantec Daggerfly 2024","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/daggerfly-espionage-updated-toolset"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--38419f2f-51d2-47ed-9fd9-bba3712474cc","subject":"ATTACK:enterprise:S0350","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--38419f2f-51d2-47ed-9fd9-bba3712474cc","modified":"2026-04-29T14:23:05.997Z","references":[{"source_name":"McAfee Night Dragon","url":"https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--387fa1e2-b8c5-4be4-b566-85b0525ed294","subject":"ATTACK:enterprise:S0375","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--387fa1e2-b8c5-4be4-b566-85b0525ed294","modified":"2026-04-29T14:23:05.997Z","references":[{"source_name":"Securelist Remexi Jan 2019","url":"https://securelist.com/chafer-used-remexi-malware/89538/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3aed2bdf-7d69-46fe-9fea-9fb2b7c626cd","subject":"ATTACK:enterprise:S9052","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3aed2bdf-7d69-46fe-9fea-9fb2b7c626cd","modified":"2026-09-24T18:54:25.805Z","references":[{"source_name":"CheckPoint_NimbusManticore_May2026","url":"https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3bf633ad-4648-4610-ae68-9b3bbca7b512","subject":"ATTACK:enterprise:S1058","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3bf633ad-4648-4610-ae68-9b3bbca7b512","modified":"2026-04-29T14:23:06.004Z","references":[{"source_name":"Microsoft Prestige ransomware October 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3c331c9b-bd73-422b-a62a-560d92946d5b","subject":"ATTACK:enterprise:C0017","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3c331c9b-bd73-422b-a62a-560d92946d5b","modified":"2026-07-31T21:12:31.092Z","references":[{"source_name":"Mandiant APT41","url":"https://www.mandiant.com/resources/apt41-us-state-governments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3ca53c3c-ec7d-4453-a80f-2f3306358a2f","subject":"ATTACK:enterprise:G1016","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3ca53c3c-ec7d-4453-a80f-2f3306358a2f","modified":"2026-07-31T18:48:30.522Z","references":[{"source_name":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3cfb23f1-ae6c-4ba9-acf0-b5e592ea5597","subject":"ATTACK:enterprise:C0001","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3cfb23f1-ae6c-4ba9-acf0-b5e592ea5597","modified":"2026-07-31T18:47:18.819Z","references":[{"source_name":"Talos Frankenstein June 2019","url":"https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3d829924-77dc-42cf-897c-a7def75b6be6","subject":"ATTACK:enterprise:S1081","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3d829924-77dc-42cf-897c-a7def75b6be6","modified":"2026-04-29T14:23:06.009Z","references":[{"source_name":"BitDefender BADHATCH Mar 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3da68907-c8f3-4a45-b831-bdadb1161921","subject":"ATTACK:enterprise:S0384","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3da68907-c8f3-4a45-b831-bdadb1161921","modified":"2026-04-29T14:23:06.009Z","references":[{"source_name":"Red Canary Dridex Threat Report 2021","url":"https://redcanary.com/threat-detection-report/threats/dridex/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3df5e4b3-a26b-4c8f-bf77-8ae3c602f958","subject":"ATTACK:enterprise:S9051","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3df5e4b3-a26b-4c8f-bf77-8ae3c602f958","modified":"2026-09-30T20:27:27.748Z","references":[{"source_name":"CarveyODonnellWelchHuntress_TheGentlemen_May2026","url":"https://www.huntress.com/blog/the-gentlemen-ransomware-defense-evasion-ttps"},{"source_name":"CheckPointResearch_TheGentlemen_April2026","url":"https://research.checkpoint.com/2026/dfir-report-the-gentlemen/"},{"source_name":"MSTI_GentelmenRansomware_May2026","url":"https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3ec64efd-1ee8-4bfd-8ff1-3316806d7979","subject":"ATTACK:enterprise:G1022","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3ec64efd-1ee8-4bfd-8ff1-3316806d7979","modified":"2026-07-31T18:48:14.055Z","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3f221ccc-1be7-4959-b239-6a3e027da1ae","subject":"ATTACK:enterprise:G0108","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3f221ccc-1be7-4959-b239-6a3e027da1ae","modified":"2026-07-31T18:48:02.689Z","references":[{"source_name":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3f3d94c1-f6ae-47b4-b156-8ce8961ec4ad","subject":"ATTACK:enterprise:S1239","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3f3d94c1-f6ae-47b4-b156-8ce8961ec4ad","modified":"2026-04-29T14:23:06.011Z","references":[{"source_name":"ATTACKIQ MUSTANG PANDA TONESHELL March 2023","url":"https://www.attackiq.com/2023/03/23/emulating-the-politically-motivated-chinese-apt-mustang-panda/"},{"source_name":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3f898155-f810-4d2c-8e30-34723d845ade","subject":"ATTACK:enterprise:G0021","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3f898155-f810-4d2c-8e30-34723d845ade","modified":"2026-07-31T18:48:23.642Z","references":[{"source_name":"Unit42 Molerat Mar 2020","url":"https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--40fad687-982e-4cd3-955c-3c458e34e5df","subject":"ATTACK:enterprise:S0439","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--40fad687-982e-4cd3-955c-3c458e34e5df","modified":"2026-04-29T14:23:06.013Z","references":[{"source_name":"ESET Okrum July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--417912a3-95a8-4dd4-a586-88cca62f3ebc","subject":"ATTACK:enterprise:S0458","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--417912a3-95a8-4dd4-a586-88cca62f3ebc","modified":"2026-04-29T14:23:06.014Z","references":[{"source_name":"Eset Ramsay May 2020","url":"https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--43815eb8-45cf-4032-8958-d3e73f0a229e","subject":"ATTACK:enterprise:S0538","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--43815eb8-45cf-4032-8958-d3e73f0a229e","modified":"2026-04-29T14:23:06.017Z","references":[{"source_name":"ESET Crutch December 2020","url":"https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--43ae357d-d0f8-4cdc-a9d6-0f10f603707c","subject":"ATTACK:enterprise:S0671","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--43ae357d-d0f8-4cdc-a9d6-0f10f603707c","modified":"2026-04-29T14:23:06.018Z","references":[{"source_name":"Kaspersky Tomiris Sep 2021","url":"https://securelist.com/darkhalo-after-solarwinds-the-tomiris-connection/104311/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--44426f05-25fc-4b81-956a-a6db04fc1704","subject":"ATTACK:enterprise:C0044","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--44426f05-25fc-4b81-956a-a6db04fc1704","modified":"2026-07-31T21:13:47.622Z","references":[{"source_name":"ESET OilRig Campaigns Sep 2023","url":"https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--455fed31-0d5c-42cb-9a79-03df7600db52","subject":"ATTACK:enterprise:S0606","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--455fed31-0d5c-42cb-9a79-03df7600db52","modified":"2026-04-29T14:23:06.020Z","references":[{"source_name":"Secure List Bad Rabbit","url":"https://securelist.com/bad-rabbit-ransomware/82851/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--47a0dce9-2b56-4ebd-9dea-b76132c81753","subject":"ATTACK:enterprise:S1034","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--47a0dce9-2b56-4ebd-9dea-b76132c81753","modified":"2026-04-29T14:23:06.023Z","references":[{"source_name":"Cybereason StrifeWater Feb 2022","url":"https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--47dddbb1-92c0-4a3f-8234-8418966be1ea","subject":"ATTACK:enterprise:G1053","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--47dddbb1-92c0-4a3f-8234-8418966be1ea","modified":"2026-07-31T18:48:03.616Z","references":[{"source_name":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--499d7aed-5889-4f40-a688-660f976dd112","subject":"ATTACK:enterprise:S0483","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--499d7aed-5889-4f40-a688-660f976dd112","modified":"2026-04-29T14:23:06.026Z","references":[{"source_name":"DFIR_Sodinokibi_Ransomware","url":"https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/"},{"source_name":"DFIR_Quantum_Ransomware","url":"https://thedfirreport.com/2022/04/25/quantum-ransomware/"},{"source_name":"Juniper IcedID June 2020","url":"https://blogs.juniper.net/en-us/threat-research/covid-19-and-fmla-campaigns-used-to-install-new-icedid-banking-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4a0887ab-3ec3-436a-b378-6e28847dfb1e","subject":"ATTACK:enterprise:G0016","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4a0887ab-3ec3-436a-b378-6e28847dfb1e","modified":"2026-07-31T18:48:07.888Z","references":[{"source_name":"Mandiant No Easy Breach","url":"https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4a08a068-209e-40bc-afc2-97cd774a3b89","subject":"ATTACK:enterprise:S1207","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4a08a068-209e-40bc-afc2-97cd774a3b89","modified":"2026-04-29T14:23:06.026Z","references":[{"source_name":"Netskope XLoader 2022","url":"https://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4cb2ba08-aebd-47f2-b1ea-9e28a2f64f77","subject":"ATTACK:enterprise:S1228","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4cb2ba08-aebd-47f2-b1ea-9e28a2f64f77","modified":"2026-04-29T14:23:06.030Z","references":[{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source_name":"Lab52 MUSTANG PANDA PUBLOAD MAY 2023","url":"https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4cd2bbbd-211a-4771-9e9d-a60356c04257","subject":"ATTACK:enterprise:S1089","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4cd2bbbd-211a-4771-9e9d-a60356c04257","modified":"2026-04-29T14:23:06.030Z","references":[{"source_name":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--509a79e0-7ee3-4528-b11a-eefee861e384","subject":"ATTACK:enterprise:S0527","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--509a79e0-7ee3-4528-b11a-eefee861e384","modified":"2026-04-29T14:23:06.035Z","references":[{"source_name":"Cybereason Kimsuky November 2020","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--521278a2-0924-4ff8-b5a6-03f5f69426b6","subject":"ATTACK:enterprise:S0128","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--521278a2-0924-4ff8-b5a6-03f5f69426b6","modified":"2026-04-29T14:23:06.037Z","references":[{"source_name":"PaloAlto Patchwork Mar 2018","url":"https://researchcenter.paloaltonetworks.com/2018/03/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--54d5380e-07a4-49b0-8ffd-c34428c90bbe","subject":"ATTACK:enterprise:G0087","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--54d5380e-07a4-49b0-8ffd-c34428c90bbe","modified":"2026-07-31T18:47:53.574Z","references":[{"source_name":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"},{"source_name":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"},{"source_name":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--55ea8954-9b81-45e4-89c9-a6b55f5b2541","subject":"ATTACK:enterprise:G0061","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--55ea8954-9b81-45e4-89c9-a6b55f5b2541","modified":"2026-07-31T18:48:29.617Z","references":[{"source_name":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--57828888-a833-44c7-af2c-e250d799a9bc","subject":"ATTACK:enterprise:S0024","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--57828888-a833-44c7-af2c-e250d799a9bc","modified":"2026-04-29T14:23:06.045Z","references":[{"source_name":"Malwarebytes Dyreza November 2015","url":"https://blog.malwarebytes.com/threat-analysis/2015/11/a-technical-look-at-dyreza/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--57f8c6d0-406d-4e97-b3ff-5b2f0274231b","subject":"ATTACK:enterprise:G0102","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--57f8c6d0-406d-4e97-b3ff-5b2f0274231b","modified":"2026-07-31T20:48:50.183Z","references":[{"source_name":"DHS/CISA Ransomware Targeting Healthcare October 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-302a"},{"source_name":"CrowdStrike Grim Spider May 2019","url":"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"},{"source_name":"FireEye KEGTAP SINGLEMALT October 2020","url":"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"},{"source_name":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"},{"source_name":"DFIR Ryuk 2 Hour Speed Run November 2020","url":"https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5859c58f-fc6a-4a08-ac8b-96fd21175814","subject":"ATTACK:enterprise:S1013","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5859c58f-fc6a-4a08-ac8b-96fd21175814","modified":"2026-04-29T14:23:06.046Z","references":[{"source_name":"Cisco Talos Bitter Bangladesh May 2022","url":"https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5c962e5a-d3fc-48e4-b8a4-24e3172a9ce0","subject":"ATTACK:enterprise:S9032","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5c962e5a-d3fc-48e4-b8a4-24e3172a9ce0","modified":"2026-04-29T14:23:06.051Z","references":[{"source_name":"ESET_MuddyWater_Dec2025","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5ce08d76-1b27-42c7-88f0-5591ee4b33af","subject":"ATTACK:enterprise:C0030","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5ce08d76-1b27-42c7-88f0-5591ee4b33af","modified":"2026-07-31T20:48:14.186Z","references":[{"source_name":"FireEye TEMP.Veles 2018","url":"https://web.archive.org/web/20190202205824/https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5d972f64-4c81-43ce-ba08-2c791bd78287","subject":"ATTACK:enterprise:S0532","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5d972f64-4c81-43ce-ba08-2c791bd78287","modified":"2026-04-29T14:23:06.053Z","references":[{"source_name":"Unit 42 Lucifer June 2020","url":"https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5dadf8c9-3e69-4e5f-9dc2-829e6601aa11","subject":"ATTACK:enterprise:S1018","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5dadf8c9-3e69-4e5f-9dc2-829e6601aa11","modified":"2026-04-29T14:23:06.053Z","references":[{"source_name":"Malwarebytes Saint Bot April 2021","url":"https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5fa551a6-dc9f-4ca5-a5ec-a393515cb618","subject":"ATTACK:enterprise:G0126","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5fa551a6-dc9f-4ca5-a5ec-a393515cb618","modified":"2026-07-31T18:47:56.533Z","references":[{"source_name":"Malwarebytes Higaisa 2020","url":"https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"},{"source_name":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--60349cdb-6f9a-4962-92aa-105eea1d112a","subject":"ATTACK:enterprise:S0237","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--60349cdb-6f9a-4962-92aa-105eea1d112a","modified":"2026-04-29T14:23:06.056Z","references":[{"source_name":"Talos GravityRAT","url":"https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--632f50e3-abe3-4235-90a6-8cce11df7b35","subject":"ATTACK:enterprise:S1182","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--632f50e3-abe3-4235-90a6-8cce11df7b35","modified":"2026-04-29T14:23:06.060Z","references":[{"source_name":"Cisco MagicRAT 2022","url":"https://blog.talosintelligence.com/lazarus-magicrat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--675e569b-ee71-4dc3-8cc4-d4aa495ef2c4","subject":"ATTACK:enterprise:S1140","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--675e569b-ee71-4dc3-8cc4-d4aa495ef2c4","modified":"2026-04-29T14:23:06.066Z","references":[{"source_name":"Google TAG COLDRIVER January 2024","url":"https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6884d485-5ec1-46ab-b36d-ab11567f38fc","subject":"ATTACK:enterprise:S1190","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6884d485-5ec1-46ab-b36d-ab11567f38fc","modified":"2026-04-29T14:23:06.067Z","references":[{"source_name":"Microsoft KnuckleTouch 2024","url":"https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win64/KnuckleTouch.A!dha&threatId=-2147067254"},{"source_name":"WithSecure Kapeka 2024","url":"https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Research-Kapeka.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6a653820-adc1-4068-ab78-9165f2a2c5c1","subject":"ATTACK:enterprise:G0096","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6a653820-adc1-4068-ab78-9165f2a2c5c1","modified":"2026-07-31T20:48:27.157Z","references":[{"source_name":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"},{"source_name":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6aace1a6-2422-45de-a72e-eb66ebbbca0a","subject":"ATTACK:enterprise:S1149","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6aace1a6-2422-45de-a72e-eb66ebbbca0a","modified":"2026-04-29T14:23:06.070Z","references":[{"source_name":"Mandiant ROADSWEEP August 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6b0992a5-5800-44b2-906b-23d9a7985d22","subject":"ATTACK:enterprise:S1242","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6b0992a5-5800-44b2-906b-23d9a7985d22","modified":"2026-04-29T14:23:06.071Z","references":[{"source_name":"Trend Micro Agenda Ransomware AUG 2022","url":"https://www.trendmicro.com/en_us/research/22/h/new-golang-ransomware-agenda-customizes-attacks.html"},{"source_name":"Cisco Talos Qilin Ransomware OCT 2025","url":"https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/"},{"source_name":"BushidoToken Qilin RaaS JUN 2024","url":"https://blog.bushidotoken.net/2024/06/tracking-adversaries-qilin-raas.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6beb1553-aece-41eb-a1e7-dbe2738f23d6","subject":"ATTACK:enterprise:S0516","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6beb1553-aece-41eb-a1e7-dbe2738f23d6","modified":"2026-04-29T14:23:06.072Z","references":[{"source_name":"CISA SoreFang July 2016","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--70f7caf8-eb30-4ab9-b054-c18edd33b8e9","subject":"ATTACK:enterprise:S9019","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--70f7caf8-eb30-4ab9-b054-c18edd33b8e9","modified":"2026-04-29T14:23:06.079Z","references":[{"source_name":"Check Point Blind Eagle MAR 2025","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7121357f-cc91-4e6b-a2a6-d8bb51bf4a01","subject":"ATTACK:enterprise:G0075","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7121357f-cc91-4e6b-a2a6-d8bb51bf4a01","modified":"2026-07-31T18:48:27.044Z","references":[{"source_name":"Rancor Unit42 June 2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--715f0217-bc9b-4403-90f3-dbe00e558164","subject":"ATTACK:enterprise:S9031","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--715f0217-bc9b-4403-90f3-dbe00e558164","modified":"2026-04-29T14:23:06.080Z","references":[{"source_name":"Palo Alto Ashen Lepus DEC 2025","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--71d82a00-e876-4455-8798-a57ea3ae3d00","subject":"ATTACK:enterprise:G1006","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--71d82a00-e876-4455-8798-a57ea3ae3d00","modified":"2026-07-31T20:48:48.254Z","references":[{"source_name":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--749e3cb9-316a-4f97-8554-d83a9e19dfc5","subject":"ATTACK:enterprise:S0360","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--749e3cb9-316a-4f97-8554-d83a9e19dfc5","modified":"2026-04-29T14:23:06.085Z","references":[{"source_name":"Palo Alto OilRig Sep 2018","url":"https://unit42.paloaltonetworks.com/unit42-oilrig-uses-updated-bondupdater-target-middle-eastern-government/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--754699a2-fa2c-4ac2-82cc-be6b7c0c8a6b","subject":"ATTACK:enterprise:S0447","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--754699a2-fa2c-4ac2-82cc-be6b7c0c8a6b","modified":"2026-04-29T14:23:06.085Z","references":[{"source_name":"Talos Lokibot Jan 2021","url":"https://blog.talosintelligence.com/2021/01/a-deep-dive-into-lokibot-infection-chain.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7a255276-de2b-466b-bb8c-f274e7b4adae","subject":"ATTACK:enterprise:G1003","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7a255276-de2b-466b-bb8c-f274e7b4adae","modified":"2026-07-31T18:48:13.213Z","references":[{"source_name":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7a28c0d9-28cf-4881-b8a5-8d779eb76e0d","subject":"ATTACK:enterprise:S0367","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7a28c0d9-28cf-4881-b8a5-8d779eb76e0d","modified":"2026-04-29T14:23:06.092Z","references":[{"source_name":"emotet_hc3_nov2023","url":"https://www.hhs.gov/sites/default/files/emotet-the-enduring-and-persistent-threat-to-the-hph-tlpclear.pdf"},{"source_name":"US-CERT Emotet Jul 2018","url":"https://www.us-cert.gov/ncas/alerts/TA18-201A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7c9b1259-47e5-41af-b5d5-5b8b25d0bdd2","subject":"ATTACK:enterprise:S0688","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7c9b1259-47e5-41af-b5d5-5b8b25d0bdd2","modified":"2026-04-29T14:23:06.096Z","references":[{"source_name":"Check Point Meteor Aug 2021","url":"https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7d18e839-3e68-4168-8245-4278c6f0dc01","subject":"ATTACK:enterprise:C0004","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7d18e839-3e68-4168-8245-4278c6f0dc01","modified":"2026-07-31T18:47:34.382Z","references":[{"source_name":"BlackBerry CostaRicto November 2020","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7d1c2ebb-bddb-4312-90ca-1449e8509584","subject":"ATTACK:enterprise:G1059","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7d1c2ebb-bddb-4312-90ca-1449e8509584","modified":"2026-10-01T19:10:35.379Z","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7e12ea45-1adc-4c0c-95a7-68d5215760dc","subject":"ATTACK:enterprise:C0022","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7e12ea45-1adc-4c0c-95a7-68d5215760dc","modified":"2026-07-31T21:14:22.708Z","references":[{"source_name":"ESET Lazarus Jun 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_Operation_Interception.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7ea59e67-c82a-4e37-b6d2-2b0b61053924","subject":"ATTACK:enterprise:S1011","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7ea59e67-c82a-4e37-b6d2-2b0b61053924","modified":"2026-04-29T14:23:06.098Z","references":[{"source_name":"Tarrask scheduled task","url":"https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--80e20d44-b799-4734-9de3-009f564f3ca0","subject":"ATTACK:enterprise:C0012","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--80e20d44-b799-4734-9de3-009f564f3ca0","modified":"2026-07-31T18:47:28.389Z","references":[{"source_name":"Cybereason OperationCuckooBees May 2022","url":"https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-winnti-techniques"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--818dc2b8-bc95-4e1e-a25a-8c659b9a141d","subject":"ATTACK:enterprise:G0095","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--818dc2b8-bc95-4e1e-a25a-8c659b9a141d","modified":"2026-07-31T18:47:49.910Z","references":[{"source_name":"360 Machete Sep 2020","url":"https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--81bbe4da-91a3-4e10-95c4-00096422d99b","subject":"ATTACK:enterprise:S1180","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--81bbe4da-91a3-4e10-95c4-00096422d99b","modified":"2026-04-29T14:23:06.103Z","references":[{"source_name":"Trustwave BlackByte 2021","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--83c0f19f-e827-4e82-b771-a322fbe2b337","subject":"ATTACK:enterprise:G1044","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--83c0f19f-e827-4e82-b771-a322fbe2b337","modified":"2026-07-31T18:48:16.313Z","references":[{"source_name":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--84e0c62b-b1a6-4ecd-8607-f0b516cb48f6","subject":"ATTACK:enterprise:S0148","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--84e0c62b-b1a6-4ecd-8607-f0b516cb48f6","modified":"2026-04-29T14:23:06.107Z","references":[{"source_name":"ESET RTM Feb 2017","url":"https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"},{"source_name":"Unit42 Redaman January 2019","url":"https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--89bcfd5b-376a-4191-9b49-553001df844f","subject":"ATTACK:enterprise:S1042","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--89bcfd5b-376a-4191-9b49-553001df844f","modified":"2026-04-29T14:23:06.113Z","references":[{"source_name":"Mandiant UNC3890 Aug 2022","url":"https://www.mandiant.com/resources/blog/suspected-iranian-actor-targeting-israeli-shipping"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8b3f374c-9f56-4493-8b85-72d0750d0c59","subject":"ATTACK:enterprise:G0051","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8b3f374c-9f56-4493-8b85-72d0750d0c59","modified":"2026-07-31T18:48:28.798Z","references":[{"source_name":"FireEye FIN10 June 2017","url":"https://services.google.com/fh/files/misc/rpt-fin-10-anatomy-of-a-cyber-en.pdf"},{"source_name":"Github PowerShell Empire","url":"https://github.com/PowerShellEmpire/Empire"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8cce3864-0c29-4c3c-a1cd-733f792b8565","subject":"ATTACK:enterprise:G0019","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8cce3864-0c29-4c3c-a1cd-733f792b8565","modified":"2026-07-31T18:47:46.342Z","references":[{"source_name":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8dafeeb9-067e-4118-9d96-ee8875711096","subject":"ATTACK:enterprise:S1235","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8dafeeb9-067e-4118-9d96-ee8875711096","modified":"2026-04-29T14:23:06.118Z","references":[{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8dd9d97d-0eb1-4e17-94ac-5589db51f878","subject":"ATTACK:enterprise:S0140","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8dd9d97d-0eb1-4e17-94ac-5589db51f878","modified":"2026-04-29T14:23:06.119Z","references":[{"source_name":"Palo Alto Shamoon Nov 2016","url":"http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/"},{"source_name":"FireEye Shamoon Nov 2016","url":"https://web.archive.org/web/20210126065851/https://www.fireeye.com/blog/threat-research/2016/11/fireeye_respondsto.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8fb40ded-3a84-48ad-ab52-342cf2ab629e","subject":"ATTACK:enterprise:S0581","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8fb40ded-3a84-48ad-ab52-342cf2ab629e","modified":"2026-04-29T14:23:06.121Z","references":[{"source_name":"Unit 42 IronNetInjector February 2021 ","url":"https://unit42.paloaltonetworks.com/ironnetinjector/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--90479403-5ebb-499d-a407-11b0fcd9c911","subject":"ATTACK:enterprise:G1039","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--90479403-5ebb-499d-a407-11b0fcd9c911","modified":"2026-07-31T18:48:06.331Z","references":[{"source_name":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source_name":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"},{"source_name":"trendmicro_redcurl","url":"https://www.trendmicro.com/en_us/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--91c5d713-a89c-49fa-92eb-abaf18fae988","subject":"ATTACK:enterprise:S0194","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--91c5d713-a89c-49fa-92eb-abaf18fae988","modified":"2026-04-29T14:23:06.124Z","references":[{"source_name":"GitHub PowerSploit May 2012","url":"https://github.com/PowerShellMafia/PowerSploit"},{"source_name":"PowerSploit Documentation","url":"http://powersploit.readthedocs.io"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--946eecdd-fa23-4b5d-a992-452f50e8def8","subject":"ATTACK:enterprise:S0331","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--946eecdd-fa23-4b5d-a992-452f50e8def8","modified":"2026-04-29T14:23:06.127Z","references":[{"source_name":"SentinelLabs Agent Tesla Aug 2020","url":"https://labs.sentinelone.com/agent-tesla-old-rat-uses-new-tricks-to-stay-on-top/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--96126522-59b5-4b3a-acfb-0af940c5c43a","subject":"ATTACK:enterprise:S0125","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--96126522-59b5-4b3a-acfb-0af940c5c43a","modified":"2026-04-29T14:23:06.130Z","references":[{"source_name":"Kaspersky ProjectSauron Technical Analysis","url":"https://securelist.com/files/2016/07/The-ProjectSauron-APT_Technical_Analysis_KL.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--96d8b36d-88b1-4cbc-8cc8-9a22487ab648","subject":"ATTACK:enterprise:G1036","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--96d8b36d-88b1-4cbc-8cc8-9a22487ab648","modified":"2026-07-31T18:48:24.851Z","references":[{"source_name":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--98908617-068d-4b6e-bcba-ad213c137b1e","subject":"ATTACK:enterprise:G0050","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--98908617-068d-4b6e-bcba-ad213c137b1e","modified":"2026-07-31T18:47:45.050Z","references":[{"source_name":"FireEye APT32 May 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"},{"source_name":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source_name":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"},{"source_name":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--98d32782-62e2-4cd7-90b1-78c8a062b6ed","subject":"ATTACK:enterprise:S0438","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--98d32782-62e2-4cd7-90b1-78c8a062b6ed","modified":"2026-04-29T14:23:06.134Z","references":[{"source_name":"ESET Attor Oct 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--99c87be1-d8f1-4b41-836f-8811628c4b80","subject":"ATTACK:enterprise:G0117","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--99c87be1-d8f1-4b41-836f-8811628c4b80","modified":"2026-07-31T18:48:17.465Z","references":[{"source_name":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"},{"source_name":"ClearSky Pay2Kitten December 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9a380085-30dd-4a57-bd52-f85acd584e43","subject":"ATTACK:enterprise:G0064","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9a380085-30dd-4a57-bd52-f85acd584e43","modified":"2026-07-31T20:48:53.150Z","references":[{"source_name":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9a99890c-dea1-4ef6-8605-fd4c43f6e37c","subject":"ATTACK:enterprise:S0446","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9a99890c-dea1-4ef6-8605-fd4c43f6e37c","modified":"2026-04-29T14:23:06.136Z","references":[{"source_name":"ANSSI RYUK RANSOMWARE","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9aebf2b6-7688-4946-a12e-ea1d8e62e158","subject":"ATTACK:enterprise:S0396","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9aebf2b6-7688-4946-a12e-ea1d8e62e158","modified":"2026-04-29T14:23:06.136Z","references":[{"source_name":"Cyphort EvilBunny Dec 2014","url":"https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9cd7aeeb-5341-4a84-bdca-788674223e11","subject":"ATTACK:enterprise:S1247","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9cd7aeeb-5341-4a84-bdca-788674223e11","modified":"2026-04-29T14:23:06.139Z","references":[{"source_name":"ESET Embargo Ransomware October 2024","url":"https://www.welivesecurity.com/en/eset-research/embargo-ransomware-rocknrust/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9fad01af-77b7-44b2-a3fc-0a7b338b9ace","subject":"ATTACK:enterprise:M1018","predicate":"mitigates","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9fad01af-77b7-44b2-a3fc-0a7b338b9ace","modified":"2026-04-29T14:23:06.143Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a1e16836-d6d9-4d47-bb9a-35f31f369980","subject":"ATTACK:enterprise:G0049","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a1e16836-d6d9-4d47-bb9a-35f31f369980","modified":"2026-07-31T20:48:35.725Z","references":[{"source_name":"Unit 42 OopsIE! Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"},{"source_name":"Unit 42 QUADAGENT July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"},{"source_name":"FireEye APT34 July 2019","url":"https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"},{"source_name":"Check Point APT34 April 2021","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a3157c50-410e-4218-8707-326ab0146c94","subject":"ATTACK:enterprise:G0082","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a3157c50-410e-4218-8707-326ab0146c94","modified":"2026-07-31T20:48:23.318Z","references":[{"source_name":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"},{"source_name":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a848dadb-f97f-4ded-a28e-a1c9954804a6","subject":"ATTACK:enterprise:S0449","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a848dadb-f97f-4ded-a28e-a1c9954804a6","modified":"2026-04-29T14:23:06.154Z","references":[{"source_name":"Sophos Maze VM September 2020","url":"https://news.sophos.com/en-us/2020/09/17/maze-attackers-adopt-ragnar-locker-virtual-machine-technique/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a901eaf4-7cbe-43c2-9c03-7d716357edc9","subject":"ATTACK:enterprise:G0045","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a901eaf4-7cbe-43c2-9c03-7d716357edc9","modified":"2026-07-31T18:47:44.345Z","references":[{"source_name":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aa5d5fcd-db19-4593-a958-b09853ceb372","subject":"ATTACK:enterprise:G0099","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aa5d5fcd-db19-4593-a958-b09853ceb372","modified":"2026-07-31T18:48:18.662Z","references":[{"source_name":"QiAnXin APT-C-36 Feb2019","url":"https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--abb4a85a-d98a-46f7-965b-48d9f88fe9b6","subject":"ATTACK:enterprise:S0166","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--abb4a85a-d98a-46f7-965b-48d9f88fe9b6","modified":"2026-04-29T14:23:06.159Z","references":[{"source_name":"Symantec Buckeye","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ac85daf7-c5ee-4f53-8ed8-0049ac7cc6e9","subject":"ATTACK:enterprise:S0584","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ac85daf7-c5ee-4f53-8ed8-0049ac7cc6e9","modified":"2026-04-29T14:23:06.160Z","references":[{"source_name":"CISA AppleJeus Feb 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-048a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ae38c68d-cc08-4460-9d98-ddf957f837e2","subject":"ATTACK:enterprise:S0046","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ae38c68d-cc08-4460-9d98-ddf957f837e2","modified":"2026-04-29T14:23:06.162Z","references":[{"source_name":"F-Secure CozyDuke","url":"https://www.f-secure.com/documents/996508/1030745/CozyDuke"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aea8401e-774e-47b1-86ac-220cacd11a3c","subject":"ATTACK:enterprise:G0037","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aea8401e-774e-47b1-86ac-220cacd11a3c","modified":"2026-07-31T20:48:31.025Z","references":[{"source_name":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--af6d4d8e-32ac-4066-a22f-0596cb7d0476","subject":"ATTACK:enterprise:S1236","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--af6d4d8e-32ac-4066-a22f-0596cb7d0476","modified":"2026-04-29T14:23:06.164Z","references":[{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--afea5bf8-f6e0-4b93-8de6-da2e0cd6f569","subject":"ATTACK:enterprise:S0629","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--afea5bf8-f6e0-4b93-8de6-da2e0cd6f569","modified":"2026-04-29T14:23:06.165Z","references":[{"source_name":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b47be693-c3f4-4f21-ba08-4e2fe170bc51","subject":"ATTACK:enterprise:G1014","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b47be693-c3f4-4f21-ba08-4e2fe170bc51","modified":"2026-07-31T18:48:15.002Z","references":[{"source_name":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b5582dcf-f58c-4420-a65d-186e2df9db8f","subject":"ATTACK:enterprise:S1043","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b5582dcf-f58c-4420-a65d-186e2df9db8f","modified":"2026-04-29T14:23:06.173Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b562272b-db14-45e4-8ff2-3eafb2db5179","subject":"ATTACK:enterprise:M1047","predicate":"mitigates","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b562272b-db14-45e4-8ff2-3eafb2db5179","modified":"2026-04-29T14:23:06.173Z","references":[{"source_name":"Powersploit","url":"https://github.com/mattifestation/PowerSploit"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b7c3b6c4-9f4b-4e11-92df-a4bb6e82a66a","subject":"ATTACK:enterprise:C0014","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b7c3b6c4-9f4b-4e11-92df-a4bb6e82a66a","modified":"2026-07-31T18:47:31.862Z","references":[{"source_name":"FoxIT Wocao December 2019","url":"https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b853cee3-a145-407f-83fe-dd52c4efbe2f","subject":"ATTACK:enterprise:S0223","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b853cee3-a145-407f-83fe-dd52c4efbe2f","modified":"2026-04-29T14:23:06.177Z","references":[{"source_name":"ClearSky MuddyWater Nov 2018","url":"https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b91de2c3-897a-4e04-94f8-9e905564b47a","subject":"ATTACK:enterprise:S0476","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b91de2c3-897a-4e04-94f8-9e905564b47a","modified":"2026-04-29T14:23:06.178Z","references":[{"source_name":"Unit 42 Valak July 2020","url":"https://unit42.paloaltonetworks.com/valak-evolution/"},{"source_name":"SentinelOne Valak June 2020","url":"https://assets.sentinelone.com/labs/sentinel-one-valak-i"},{"source_name":"Cybereason Valak May 2020","url":"https://www.cybereason.com/blog/valak-more-than-meets-the-eye"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b9259830-1b82-4303-bb5a-c0285a71f5ef","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b9259830-1b82-4303-bb5a-c0285a71f5ef","modified":"2026-07-31T20:48:47.089Z","references":[{"source_name":"ESET Twitter Ida Pro Nov 2021","url":"https://x.com/ESETresearch/status/1458438155149922312"},{"source_name":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ba7f4c8e-860a-45fc-a9e7-bb7d0ec96a2c","subject":"ATTACK:enterprise:G0060","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ba7f4c8e-860a-45fc-a9e7-bb7d0ec96a2c","modified":"2026-07-31T18:48:10.822Z","references":[{"source_name":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bb16d8ce-3017-4835-a282-b11d10abc8a1","subject":"ATTACK:enterprise:S0500","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bb16d8ce-3017-4835-a282-b11d10abc8a1","modified":"2026-04-29T14:23:06.181Z","references":[{"source_name":"Secureworks MCMD July 2019","url":"https://www.secureworks.com/research/mcmd-malware-analysis"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bb9e291c-4464-41e2-97b7-e19ce9169118","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bb9e291c-4464-41e2-97b7-e19ce9169118","modified":"2026-04-29T14:23:06.181Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bc2770c2-2d08-4b28-bc46-e0451c391f01","subject":"ATTACK:enterprise:G1035","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bc2770c2-2d08-4b28-bc46-e0451c391f01","modified":"2026-07-31T18:48:03.236Z","references":[{"source_name":"DomainTools WinterVivern 2021","url":"https://www.domaintools.com/resources/blog/winter-vivern-a-look-at-re-crafted-government-maldocs/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bdee01a7-16cb-417e-8d9b-c98afd445bbc","subject":"ATTACK:enterprise:S0038","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bdee01a7-16cb-417e-8d9b-c98afd445bbc","modified":"2026-06-12T15:51:16.725Z","references":[{"source_name":"Symantec W32.Duqu","url":"https://web.archive.org/web/20111213083345/https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bed23143-48a0-4883-ae33-416d60c27b5d","subject":"ATTACK:enterprise:G0035","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bed23143-48a0-4883-ae33-416d60c27b5d","modified":"2026-07-31T20:48:28.622Z","references":[{"source_name":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c0417cdc-0451-41e3-8937-88e9ebd68d1a","subject":"ATTACK:enterprise:S0475","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c0417cdc-0451-41e3-8937-88e9ebd68d1a","modified":"2026-04-29T14:23:06.188Z","references":[{"source_name":"Unit 42 BackConfig May 2020","url":"https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c31efd65-8907-41f7-8cc2-17c7f8313a67","subject":"ATTACK:enterprise:S1240","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c31efd65-8907-41f7-8cc2-17c7f8313a67","modified":"2026-04-29T14:23:06.192Z","references":[{"source_name":"McAfee RedLine Stealer April 2024","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/redline-stealer-a-novel-approach/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c55f4782-5303-4ef2-9f5f-49dbe15c138e","subject":"ATTACK:enterprise:S0198","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c55f4782-5303-4ef2-9f5f-49dbe15c138e","modified":"2026-04-29T14:23:06.195Z","references":[{"source_name":"FireEye NETWIRE March 2019","url":"https://www.mandiant.com/resources/blog/dissecting-netwire-phishing-campaigns-usage-process-hollowing"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c5e0e6d9-b7ac-48b2-b22f-d3a3efd1f8f0","subject":"ATTACK:enterprise:S1133","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c5e0e6d9-b7ac-48b2-b22f-d3a3efd1f8f0","modified":"2026-04-29T14:23:06.196Z","references":[{"source_name":"SentinelOne Agrius 2021","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c761f444-3c01-44b4-b8e7-8a26746ce115","subject":"ATTACK:enterprise:S0363","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c761f444-3c01-44b4-b8e7-8a26746ce115","modified":"2026-04-29T14:23:06.198Z","references":[{"source_name":"Github PowerShell Empire","url":"https://github.com/PowerShellEmpire/Empire"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c8aab802-70d9-4f95-b024-4310149518dc","subject":"ATTACK:enterprise:C0032","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c8aab802-70d9-4f95-b024-4310149518dc","modified":"2026-07-31T18:47:26.073Z","references":[{"source_name":"FireEye TRITON 2019","url":"https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c8f3916d-e020-42a8-afe0-25fe8498245a","subject":"ATTACK:enterprise:G0069","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c8f3916d-e020-42a8-afe0-25fe8498245a","modified":"2026-07-31T20:48:30.170Z","references":[{"source_name":"Reaqta MuddyWater November 2017","url":"https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cd07e694-b95b-4797-b2da-63704b4e8939","subject":"ATTACK:enterprise:S0390","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cd07e694-b95b-4797-b2da-63704b4e8939","modified":"2026-04-29T14:23:06.206Z","references":[{"source_name":"Flashpoint FIN 7 March 2019","url":"https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ce459961-3a5a-45f9-b8a4-646e9b475e19","subject":"ATTACK:enterprise:S0264","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ce459961-3a5a-45f9-b8a4-646e9b475e19","modified":"2026-04-29T14:23:06.207Z","references":[{"source_name":"Unit 42 OopsIE! Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"},{"source_name":"Unit 42 OilRig Sept 2018","url":"https://researchcenter.paloaltonetworks.com/2018/09/unit42-oilrig-targets-middle-eastern-government-adds-evasion-techniques-oopsie/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cf72062c-b62f-4127-b7e3-ac3f941a9599","subject":"ATTACK:enterprise:S1039","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cf72062c-b62f-4127-b7e3-ac3f941a9599","modified":"2026-04-29T14:23:06.209Z","references":[{"source_name":"Symantec Bumblebee June 2022","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime"},{"source_name":"Proofpoint Bumblebee April 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cff83f53-0e10-4e98-9e2e-2a4b7d027d70","subject":"ATTACK:enterprise:S0534","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cff83f53-0e10-4e98-9e2e-2a4b7d027d70","modified":"2026-04-29T14:23:06.210Z","references":[{"source_name":"Cybereason Bazar July 2020","url":"https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"},{"source_name":"NCC Group Team9 June 2020","url":"https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d2560c35-b2f6-47d2-b573-236ef99894d5","subject":"ATTACK:enterprise:S0167","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d2560c35-b2f6-47d2-b573-236ef99894d5","modified":"2026-04-29T14:23:06.213Z","references":[{"source_name":"ClearSky Wilted Tulip July 2017","url":"http://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf"},{"source_name":"CopyKittens Nov 2015","url":"https://cdn2.hubspot.net/hubfs/1903456/Whitepapers/CopyKittens.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d27b805a-3570-434e-9ac7-e37407a4dd8e","subject":"ATTACK:enterprise:S0417","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d27b805a-3570-434e-9ac7-e37407a4dd8e","modified":"2026-04-29T14:23:06.213Z","references":[{"source_name":"SecureList Griffon May 2019","url":"https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d3ec9fa2-02c9-4445-83c8-92c8e71a77dd","subject":"ATTACK:enterprise:S1135","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d3ec9fa2-02c9-4445-83c8-92c8e71a77dd","modified":"2026-04-29T14:23:06.215Z","references":[{"source_name":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d535f0e8-dc89-448c-828d-7464767a51a3","subject":"ATTACK:enterprise:S0382","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d535f0e8-dc89-448c-828d-7464767a51a3","modified":"2026-04-29T14:23:06.217Z","references":[{"source_name":"Proofpoint TA505 Jan 2019","url":"https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d5ffcd6e-be9e-4efe-9822-974f3838c7db","subject":"ATTACK:enterprise:T1053.005","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1053","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d5ffcd6e-be9e-4efe-9822-974f3838c7db","modified":"2026-04-29T14:23:06.218Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d61205cb-8b80-49c1-ac2c-76b0770d3e40","subject":"ATTACK:enterprise:S1088","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d61205cb-8b80-49c1-ac2c-76b0770d3e40","modified":"2026-04-29T14:23:06.218Z","references":[{"source_name":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d65c9c85-2206-46c0-b55b-4fe2bd022c41","subject":"ATTACK:enterprise:G0047","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d65c9c85-2206-46c0-b55b-4fe2bd022c41","modified":"2026-07-31T18:47:48.075Z","references":[{"source_name":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source_name":"CERT-EE Gamaredon January 2021","url":"https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf"},{"source_name":"Microsoft Actinium February 2022","url":"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"},{"source_name":"unit42_gamaredon_dec2022","url":"https://unit42.paloaltonetworks.com/trident-ursa/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d7563ead-61fb-4f5e-8832-64ce81c0ecb1","subject":"ATTACK:enterprise:S0673","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d7563ead-61fb-4f5e-8832-64ce81c0ecb1","modified":"2026-04-29T14:23:06.219Z","references":[{"source_name":"Prevailion DarkWatchman 2021","url":"https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d8f91489-be52-4f7d-903f-534dcb8bd962","subject":"ATTACK:enterprise:S9030","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d8f91489-be52-4f7d-903f-534dcb8bd962","modified":"2026-04-29T14:23:06.221Z","references":[{"source_name":"Check Point Wirte NOV 2024","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--db2be919-e747-430b-a7ee-d619a11abd93","subject":"ATTACK:enterprise:G0094","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--db2be919-e747-430b-a7ee-d619a11abd93","modified":"2026-07-31T20:48:25.527Z","references":[{"source_name":"Gen Digital Kimsuky HTTPTroy October 2025","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"},{"source_name":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"},{"source_name":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source_name":"NaumaanProofpoint_GlobalClickFix_April2025","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dbacc7d5-5d10-4b41-994d-51e0792cfb19","subject":"ATTACK:enterprise:S0147","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dbacc7d5-5d10-4b41-994d-51e0792cfb19","modified":"2026-04-29T14:23:06.225Z","references":[{"source_name":"Palo Alto Gamaredon Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"},{"source_name":"Symantec Shuckworm January 2022","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dc19b319-1c17-45f0-9881-9bf2ac8a2611","subject":"ATTACK:enterprise:S0603","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dc19b319-1c17-45f0-9881-9bf2ac8a2611","modified":"2026-04-29T14:23:06.226Z","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e19d37dd-2cee-488b-a05e-1d298eb090cf","subject":"ATTACK:enterprise:S0260","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e19d37dd-2cee-488b-a05e-1d298eb090cf","modified":"2026-04-29T14:23:06.233Z","references":[{"source_name":"ESET InvisiMole June 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e32b53b5-b112-483a-8d95-56bf3f43671f","subject":"ATTACK:enterprise:S0050","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e32b53b5-b112-483a-8d95-56bf3f43671f","modified":"2026-04-29T14:23:06.234Z","references":[{"source_name":"F-Secure Cosmicduke","url":"https://blog.f-secure.com/wp-content/uploads/2019/10/CosmicDuke.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e362d1ad-5d36-4f6d-b2b0-63af2f5f08ff","subject":"ATTACK:enterprise:G0038","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e362d1ad-5d36-4f6d-b2b0-63af2f5f08ff","modified":"2026-07-31T18:48:07.440Z","references":[{"source_name":"Citizen Lab Stealth Falcon May 2016","url":"https://citizenlab.org/2016/05/stealth-falcon/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e6997505-11ce-4ac3-ba26-b14f943b8a99","subject":"ATTACK:enterprise:G1002","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e6997505-11ce-4ac3-ba26-b14f943b8a99","modified":"2026-07-31T20:48:39.596Z","references":[{"source_name":"Cisco Talos Bitter Bangladesh May 2022","url":"https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e916bd35-cd90-4c1f-b600-aedffbf4de3c","subject":"ATTACK:enterprise:S0650","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e916bd35-cd90-4c1f-b600-aedffbf4de3c","modified":"2026-04-29T14:23:06.242Z","references":[{"source_name":"Crowdstrike Qakbot October 2020","url":"https://www.crowdstrike.com/blog/duck-hunting-with-falcon-complete-qakbot-zip-based-campaign/"},{"source_name":"Cyberint Qakbot May 2021","url":"https://blog.cyberint.com/qakbot-banking-trojan"},{"source_name":"Group IB Ransomware September 2020","url":"https://web.archive.org/web/20220119114433/https://groupib.pathfactory.com/ransomware-reports/prolock_wp"},{"source_name":"Kaspersky QakBot September 2021","url":"https://securelist.com/qakbot-technical-analysis/103931/"},{"source_name":"Trend Micro Qakbot May 2020","url":"https://www.trendmicro.com/vinfo/ph/security/news/cybercrime-and-digital-threats/qakbot-resurges-spreads-through-vbs-files"},{"source_name":"Red Canary Qbot","url":"https://redcanary.com/threat-detection-report/threats/qbot/"},{"source_name":"Kroll Qakbot June 2020","url":"https://www.kroll.com/en/insights/publications/cyber/qakbot-malware-exfiltrating-emails-thread-hijacking-attacks"},{"source_name":"Trend Micro Qakbot December 2020","url":"https://success.trendmicro.com/en-US/solution/KA-0011282"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ea5f9e1f-68fb-46dd-9e09-f66066808d0c","subject":"ATTACK:enterprise:S0184","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ea5f9e1f-68fb-46dd-9e09-f66066808d0c","modified":"2026-04-29T14:23:06.244Z","references":[{"source_name":"FireEye APT34 Dec 2017","url":"https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ea8f4a2f-6c4e-451e-a107-407d0fc06459","subject":"ATTACK:enterprise:S0379","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ea8f4a2f-6c4e-451e-a107-407d0fc06459","modified":"2026-04-29T14:23:06.244Z","references":[{"source_name":"Cofense RevengeRAT Feb 2019","url":"https://web.archive.org/web/20200428173819/https://cofense.com/upgrades-delivery-support-infrastructure-revenge-rat-malware-bigger-threat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eb0307d6-901d-4140-84f9-a08c6a8ea14c","subject":"ATTACK:enterprise:S0168","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eb0307d6-901d-4140-84f9-a08c6a8ea14c","modified":"2026-04-29T14:23:06.245Z","references":[{"source_name":"ESET Gazer Aug 2017","url":"https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf"},{"source_name":"Securelist WhiteBear Aug 2017","url":"https://securelist.com/introducing-whitebear/81638/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eca69ead-d0af-4926-9faf-c82baea31296","subject":"ATTACK:enterprise:G0142","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eca69ead-d0af-4926-9faf-c82baea31296","modified":"2026-07-31T20:48:37.667Z","references":[{"source_name":"TrendMicro Confucius APT Aug 2021","url":"https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eccad76f-c5fa-46db-9ccb-5a9ebcada28e","subject":"ATTACK:enterprise:M1028","predicate":"mitigates","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eccad76f-c5fa-46db-9ccb-5a9ebcada28e","modified":"2026-04-29T14:23:06.247Z","references":[{"source_name":"TechNet Server Operator Scheduled Task","url":"https://technet.microsoft.com/library/jj852168.aspx"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ee5e40d0-f72e-4e0b-8b10-cd5c2057cdc0","subject":"ATTACK:enterprise:S0189","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ee5e40d0-f72e-4e0b-8b10-cd5c2057cdc0","modified":"2026-04-29T14:23:06.249Z","references":[{"source_name":"OilRig New Delivery Oct 2017","url":"https://researchcenter.paloaltonetworks.com/2017/10/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eeeac3c6-78d1-4506-a9a9-2518d0c6e500","subject":"ATTACK:enterprise:S0111","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eeeac3c6-78d1-4506-a9a9-2518d0c6e500","modified":"2026-04-29T14:23:06.250Z","references":[{"source_name":"TechNet Schtasks","url":"https://technet.microsoft.com/en-us/library/bb490996.aspx"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f120a700-dcac-4c8d-8e92-d6ba3491c2ba","subject":"ATTACK:enterprise:S0262","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f120a700-dcac-4c8d-8e92-d6ba3491c2ba","modified":"2026-04-29T14:23:06.253Z","references":[{"source_name":"CISA AR18-352A Quasar RAT December 2018","url":"https://www.cisa.gov/uscert/ncas/analysis-reports/AR18-352A"},{"source_name":"Volexity Patchwork June 2018","url":"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f230afd5-2186-4d97-94ce-5ce3face8bc6","subject":"ATTACK:enterprise:S0477","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f230afd5-2186-4d97-94ce-5ce3face8bc6","modified":"2026-04-29T14:23:06.254Z","references":[{"source_name":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f250ea40-1899-4bc4-b7f9-7a795ec32f23","subject":"ATTACK:enterprise:S0680","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f250ea40-1899-4bc4-b7f9-7a795ec32f23","modified":"2026-04-29T14:23:06.254Z","references":[{"source_name":"Kaspersky WIRTE November 2021","url":"https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f3c37734-1f69-44ee-9e27-480ba68c79f4","subject":"ATTACK:enterprise:S0226","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f3c37734-1f69-44ee-9e27-480ba68c79f4","modified":"2026-04-29T14:23:06.256Z","references":[{"source_name":"Talos Smoke Loader July 2018","url":"https://blog.talosintelligence.com/2018/07/smoking-guns-smoke-loader-learned-new.html#more"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f4f8ff63-55bb-46ca-82ee-606302b2d455","subject":"ATTACK:enterprise:S1152","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f4f8ff63-55bb-46ca-82ee-606302b2d455","modified":"2026-04-29T14:23:06.258Z","references":[{"source_name":"PWC Yellow Liderc 2023","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f540a7ab-541a-44a5-8b6a-96b42b044d5b","subject":"ATTACK:enterprise:G0067","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f540a7ab-541a-44a5-8b6a-96b42b044d5b","modified":"2026-07-31T18:47:55.798Z","references":[{"source_name":"Volexity InkySquid RokRAT August 2021","url":"https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f5c05a9e-955d-459d-a761-228ec3803394","subject":"ATTACK:enterprise:S0250","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f5c05a9e-955d-459d-a761-228ec3803394","modified":"2026-04-29T14:23:06.259Z","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f957f429-c0d1-4b02-aef8-1d8500421225","subject":"ATTACK:enterprise:S0251","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f957f429-c0d1-4b02-aef8-1d8500421225","modified":"2026-04-29T14:23:06.264Z","references":[{"source_name":"CISA Zebrocy Oct 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303b"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f9c7cede-2f07-4a54-9dcd-14304055886a","subject":"ATTACK:enterprise:S1087","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f9c7cede-2f07-4a54-9dcd-14304055886a","modified":"2026-04-29T14:23:06.264Z","references":[{"source_name":"Telefonica Snip3 December 2021","url":"https://telefonicatech.com/blog/snip3-investigacion-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fa7381ff-f2b8-4878-a9a0-10a703c7a5dd","subject":"ATTACK:enterprise:S0431","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fa7381ff-f2b8-4878-a9a0-10a703c7a5dd","modified":"2026-04-29T14:23:06.265Z","references":[{"source_name":"Carbon Black HotCroissant April 2020","url":"https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ff2b7bc3-d6ca-488a-bdd5-1f2f27dfc8bd","subject":"ATTACK:enterprise:S0269","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ff2b7bc3-d6ca-488a-bdd5-1f2f27dfc8bd","modified":"2026-04-29T14:23:06.271Z","references":[{"source_name":"Unit 42 QUADAGENT July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ff40df64-826d-4bc2-b0ff-56bc862893d9","subject":"ATTACK:enterprise:S1169","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ff40df64-826d-4bc2-b0ff-56bc862893d9","modified":"2026-04-29T14:23:06.271Z","references":[{"source_name":"ESET OilRig Campaigns Sep 2023","url":"https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}