Source assertions are not new attribution claims. No sole inventor or transitive actor-CVE inference.
{
  "record": {
    "id": "ATTACK:enterprise:T1055.001",
    "title": "Dynamic-link Library Injection",
    "type": "Subtechnique",
    "source_url": "https://attack.mitre.org/techniques/T1055/001",
    "snapshot": "enterprise-attack-20.0.json",
    "status": "active",
    "rights": "Source metadata only; source notices retained; no operational prose or payloads",
    "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
    "stix_id": "attack-pattern--f4599aa0-4f85-4a32-80ea-fc39dc965945",
    "external_id": "T1055.001",
    "domain": "enterprise",
    "created": "2020-01-14T01:26:08.145Z",
    "modified": "2026-05-12T15:12:00.724Z",
    "version": "2.0",
    "aliases": [

    ],
    "tactics": [
      "stealth",
      "privilege-escalation"
    ],
    "source_references": [
      {
        "source_name": "Hiding Malicious Code with Module Stomping",
        "url": "https://blog.f-secure.com/hiding-malicious-code-with-module-stomping/"
      },
      {
        "source_name": "Elastic HuntingNMemory June 2017",
        "url": "https://www.endgame.com/blog/technical-blog/hunting-memory"
      },
      {
        "source_name": "Elastic Process Injection July 2017",
        "url": "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
      },
      {
        "source_name": "Module Stomping for Shellcode Injection",
        "url": "https://www.ired.team/offensive-security/code-injection-process-injection/modulestomping-dll-hollowing-shellcode-injection"
      }
    ]
  },
  "assertions": [
    {
      "id": "enterprise:relationship--063ed9e5-4acd-47b4-a169-0ca40ef95025",
      "subject": "ATTACK:enterprise:S1027",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--063ed9e5-4acd-47b4-a169-0ca40ef95025",
      "modified": "2026-04-29T14:23:05.912Z",
      "references": [
        {
          "source_name": "SentinelOne Aoqin Dragon June 2022",
          "url": "https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--092ea2a0-c8f5-409f-b391-119f3446e63c",
      "subject": "ATTACK:enterprise:S1018",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--092ea2a0-c8f5-409f-b391-119f3446e63c",
      "modified": "2026-04-29T14:23:05.916Z",
      "references": [
        {
          "source_name": "Malwarebytes Saint Bot April 2021",
          "url": "https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--106aae81-fab1-42b3-97b0-4f0c1d67c896",
      "subject": "ATTACK:enterprise:S0082",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--106aae81-fab1-42b3-97b0-4f0c1d67c896",
      "modified": "2026-04-29T14:23:05.926Z",
      "references": [
        {
          "source_name": "Lotus Blossom Dec 2015",
          "url": "http://researchcenter.paloaltonetworks.com/2015/12/attack-on-french-diplomat-linked-to-operation-lotus-blossom/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--11247a95-272b-4ae2-8dae-2cd049328734",
      "subject": "ATTACK:enterprise:S0125",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--11247a95-272b-4ae2-8dae-2cd049328734",
      "modified": "2026-04-29T14:23:05.927Z",
      "references": [
        {
          "source_name": "Kaspersky ProjectSauron Technical Analysis",
          "url": "https://securelist.com/files/2016/07/The-ProjectSauron-APT_Technical_Analysis_KL.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--15f40e8e-7ddd-47f8-a11d-fbebc2c4d3fa",
      "subject": "ATTACK:enterprise:S1066",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--15f40e8e-7ddd-47f8-a11d-fbebc2c4d3fa",
      "modified": "2026-04-29T14:23:05.934Z",
      "references": [
        {
          "source_name": "Secureworks DarkTortilla Aug 2022",
          "url": "https://www.secureworks.com/research/darktortilla-malware-analysis"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1a7d1db3-9383-4171-8938-382e9b0375c6",
      "subject": "ATTACK:enterprise:S0089",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1a7d1db3-9383-4171-8938-382e9b0375c6",
      "modified": "2026-04-29T14:23:05.941Z",
      "references": [
        {
          "source_name": "F-Secure BlackEnergy 2014",
          "url": "https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1a978832-f04d-4853-8094-58fc99e30ed1",
      "subject": "ATTACK:enterprise:G0010",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1a978832-f04d-4853-8094-58fc99e30ed1",
      "modified": "2026-07-31T18:48:03.616Z",
      "references": [
        {
          "source_name": "ESET Turla Mosquito May 2018",
          "url": "https://www.welivesecurity.com/2018/05/22/turla-mosquito-shift-towards-generic-tools/"
        },
        {
          "source_name": "Github Rapid7 Meterpreter Elevate",
          "url": "https://github.com/rapid7/meterpreter/tree/master/source/extensions/priv/server/elevate"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1e075dae-a0df-4ab9-a297-fda2248bc254",
      "subject": "ATTACK:enterprise:S0613",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1e075dae-a0df-4ab9-a297-fda2248bc254",
      "modified": "2026-04-29T14:23:05.946Z",
      "references": [
        {
          "source_name": "BlackBerry CostaRicto November 2020",
          "url": "https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--21674a10-7168-420e-b916-2979a3ee3b5e",
      "subject": "ATTACK:enterprise:S0250",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--21674a10-7168-420e-b916-2979a3ee3b5e",
      "modified": "2026-04-29T14:23:05.951Z",
      "references": [
        {
          "source_name": "Github Koadic",
          "url": "https://github.com/offsecginger/koadic"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--22a75bbf-5490-40cb-bdb7-a0eda5e95d21",
      "subject": "ATTACK:enterprise:S0055",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--22a75bbf-5490-40cb-bdb7-a0eda5e95d21",
      "modified": "2026-04-29T14:23:05.952Z",
      "references": [
        {
          "source_name": "Camba RARSTONE",
          "url": "http://blog.trendmicro.com/trendlabs-security-intelligence/bkdr_rarstone-new-rat-to-watch-out-for/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--249897d9-131f-4cf8-93d7-cb20006a511d",
      "subject": "ATTACK:enterprise:S0154",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--249897d9-131f-4cf8-93d7-cb20006a511d",
      "modified": "2026-04-29T14:23:05.955Z",
      "references": [
        {
          "source_name": "Talos Cobalt Strike September 2020",
          "url": "https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf"
        },
        {
          "source_name": "Cobalt Strike Manual 4.3 November 2020",
          "url": "https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--27ccf817-33de-4d85-85e5-851f82e835e4",
      "subject": "ATTACK:enterprise:S0461",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--27ccf817-33de-4d85-85e5-851f82e835e4",
      "modified": "2026-04-29T14:23:05.959Z",
      "references": [
        {
          "source_name": "Proofpoint TA505 October 2019",
          "url": "https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2e418dd3-d6dc-4d02-a555-2b3a13936dc3",
      "subject": "ATTACK:enterprise:S0455",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2e418dd3-d6dc-4d02-a555-2b3a13936dc3",
      "modified": "2026-04-29T14:23:05.967Z",
      "references": [
        {
          "source_name": "Medium Metamorfo Apr 2020",
          "url": "https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--39647c47-c73d-4da7-9b1a-8c67f20c1890",
      "subject": "ATTACK:enterprise:S0126",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--39647c47-c73d-4da7-9b1a-8c67f20c1890",
      "modified": "2026-04-29T14:23:05.999Z",
      "references": [
        {
          "source_name": "ESET ComRAT May 2020",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"
        },
        {
          "source_name": "CISA ComRAT Oct 2020",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3a0c38e8-c174-4c86-a229-fcb4965ce311",
      "subject": "ATTACK:enterprise:S0273",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3a0c38e8-c174-4c86-a229-fcb4965ce311",
      "modified": "2026-04-29T14:23:05.999Z",
      "references": [
        {
          "source_name": "TrendMicro Patchwork Dec 2017",
          "url": "https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3bcce871-6b9d-4eaf-9364-80dea3cb7ef9",
      "subject": "ATTACK:enterprise:S1039",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3bcce871-6b9d-4eaf-9364-80dea3cb7ef9",
      "modified": "2026-04-29T14:23:06.004Z",
      "references": [
        {
          "source_name": "Symantec Bumblebee June 2022",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime"
        },
        {
          "source_name": "Proofpoint Bumblebee April 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--410ec59e-9e11-4acc-98d6-4d7c63f09c8d",
      "subject": "ATTACK:enterprise:S0681",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--410ec59e-9e11-4acc-98d6-4d7c63f09c8d",
      "modified": "2026-04-29T14:23:06.014Z",
      "references": [
        {
          "source_name": "BiZone Lizar May 2021",
          "url": "https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--43f6b172-34cf-4663-836a-df1ad978e7df",
      "subject": "ATTACK:enterprise:G1026",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--43f6b172-34cf-4663-836a-df1ad978e7df",
      "modified": "2026-07-31T18:48:15.933Z",
      "references": [
        {
          "source_name": "SCILabs Malteiro 2021",
          "url": "https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--44a97cbb-ce03-43ee-959e-c582e64372a2",
      "subject": "ATTACK:enterprise:S1044",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--44a97cbb-ce03-43ee-959e-c582e64372a2",
      "modified": "2026-04-29T14:23:06.019Z",
      "references": [
        {
          "source_name": "Bitdefender FunnyDream Campaign November 2020",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--44fab50d-4fb6-4a8a-ab7a-84dcb70443f5",
      "subject": "ATTACK:enterprise:S0449",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--44fab50d-4fb6-4a8a-ab7a-84dcb70443f5",
      "modified": "2026-04-29T14:23:06.020Z",
      "references": [
        {
          "source_name": "McAfee Maze March 2020",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-maze/"
        },
        {
          "source_name": "Sophos Maze VM September 2020",
          "url": "https://news.sophos.com/en-us/2020/09/17/maze-attackers-adopt-ragnar-locker-virtual-machine-technique/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--47415cec-25f8-4425-9125-157e1637a687",
      "subject": "ATTACK:enterprise:S0167",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--47415cec-25f8-4425-9125-157e1637a687",
      "modified": "2026-04-29T14:23:06.022Z",
      "references": [
        {
          "source_name": "CopyKittens Nov 2015",
          "url": "https://cdn2.hubspot.net/hubfs/1903456/Whitepapers/CopyKittens.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4a0cbe7f-e88c-4ef6-8bf7-9f6e17e8de04",
      "subject": "ATTACK:enterprise:S0192",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4a0cbe7f-e88c-4ef6-8bf7-9f6e17e8de04",
      "modified": "2026-04-29T14:23:06.026Z",
      "references": [
        {
          "source_name": "GitHub Pupy",
          "url": "https://github.com/n1nj4sec/pupy"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4bcd21d2-7583-4b82-8d33-2b153eeb6fdb",
      "subject": "ATTACK:enterprise:S0194",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4bcd21d2-7583-4b82-8d33-2b153eeb6fdb",
      "modified": "2026-04-29T14:23:06.029Z",
      "references": [
        {
          "source_name": "GitHub PowerSploit May 2012",
          "url": "https://github.com/PowerShellMafia/PowerSploit"
        },
        {
          "source_name": "PowerSploit Documentation",
          "url": "http://powersploit.readthedocs.io"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4d0ea359-36b3-46f8-818a-5aaff3de574a",
      "subject": "ATTACK:enterprise:S0182",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4d0ea359-36b3-46f8-818a-5aaff3de574a",
      "modified": "2026-04-29T14:23:06.030Z",
      "references": [
        {
          "source_name": "Microsoft FinFisher March 2018",
          "url": "https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/"
        },
        {
          "source_name": "FinFisher Citation",
          "url": "https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4d5f07bd-985d-4dee-8f1b-9143fb158438",
      "subject": "ATTACK:enterprise:S0501",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4d5f07bd-985d-4dee-8f1b-9143fb158438",
      "modified": "2026-04-29T14:23:06.031Z",
      "references": [
        {
          "source_name": "ESET PipeMon May 2020",
          "url": "https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--508879cf-53b7-4578-9a5f-9ed20dfb09ef",
      "subject": "ATTACK:enterprise:S0024",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--508879cf-53b7-4578-9a5f-9ed20dfb09ef",
      "modified": "2026-04-29T14:23:06.035Z",
      "references": [
        {
          "source_name": "Symantec Dyre June 2015",
          "url": "http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/dyre-emerging-threat.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5451c465-0b5d-451c-bdaa-55165e408b9b",
      "subject": "ATTACK:enterprise:S1210",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5451c465-0b5d-451c-bdaa-55165e408b9b",
      "modified": "2026-04-29T14:23:06.040Z",
      "references": [
        {
          "source_name": "Cisco LotusBlossom 2025",
          "url": "https://blog.talosintelligence.com/lotus-blossom-espionage-group/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5893fbd3-f3c0-4332-b2e3-e6a07142ef9d",
      "subject": "ATTACK:enterprise:G0135",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5893fbd3-f3c0-4332-b2e3-e6a07142ef9d",
      "modified": "2026-07-31T18:48:11.252Z",
      "references": [
        {
          "source_name": "ESET BackdoorDiplomacy Jun 2021",
          "url": "https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5a0db1e3-cd18-4f00-936b-4b8ede1e0498",
      "subject": "ATTACK:enterprise:S0460",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5a0db1e3-cd18-4f00-936b-4b8ede1e0498",
      "modified": "2026-04-29T14:23:06.048Z",
      "references": [
        {
          "source_name": "Proofpoint TA505 October 2019",
          "url": "https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5e6cf759-1690-41b3-9e41-d8317f4ef83d",
      "subject": "ATTACK:enterprise:T1055.001",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1055",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5e6cf759-1690-41b3-9e41-d8317f4ef83d",
      "modified": "2026-04-29T14:23:06.054Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5e840479-61c1-44f5-8cb8-0e61ffe12b89",
      "subject": "ATTACK:enterprise:S0011",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5e840479-61c1-44f5-8cb8-0e61ffe12b89",
      "modified": "2026-04-29T14:23:06.054Z",
      "references": [
        {
          "source_name": "TrendMicro Taidoor",
          "url": "http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the_taidoor_campaign.pdf"
        },
        {
          "source_name": "CISA MAR-10292089-1.v2 TAIDOOR August 2021",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--65eff720-b419-4e73-8f6c-c3dd07b78484",
      "subject": "ATTACK:enterprise:S0241",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--65eff720-b419-4e73-8f6c-c3dd07b78484",
      "modified": "2026-04-29T14:23:06.064Z",
      "references": [
        {
          "source_name": "Lazarus RATANKBA",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-campaign-targeting-cryptocurrencies-reveals-remote-controller-tool-evolved-ratankba/"
        },
        {
          "source_name": "RATANKBA",
          "url": "https://www.trendmicro.com/en_us/research/17/b/ratankba-watering-holes-against-enterprises.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6e906ef1-2984-4d8e-ba9f-5f40f30f996e",
      "subject": "ATTACK:enterprise:S1081",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6e906ef1-2984-4d8e-ba9f-5f40f30f996e",
      "modified": "2026-04-29T14:23:06.076Z",
      "references": [
        {
          "source_name": "Gigamon BADHATCH Jul 2019",
          "url": "https://blog.gigamon.com/2019/07/23/abadbabe-8badf00d-discovering-badhatch-and-a-detailed-look-at-fin8s-tooling/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--71c146b5-9afa-41fa-9339-2a6287e7d309",
      "subject": "ATTACK:enterprise:S0576",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--71c146b5-9afa-41fa-9339-2a6287e7d309",
      "modified": "2026-04-29T14:23:06.081Z",
      "references": [
        {
          "source_name": "IBM MegaCortex",
          "url": "https://securityintelligence.com/posts/from-mega-to-giga-cross-version-comparison-of-top-megacortex-modifications/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7307a870-2d74-4e46-9ba0-8fb83d598cfb",
      "subject": "ATTACK:enterprise:S0603",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7307a870-2d74-4e46-9ba0-8fb83d598cfb",
      "modified": "2026-04-29T14:23:06.082Z",
      "references": [
        {
          "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
          "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--749496af-4629-431d-829c-4615b9f41fe5",
      "subject": "ATTACK:enterprise:S1242",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--749496af-4629-431d-829c-4615b9f41fe5",
      "modified": "2026-04-29T14:23:06.085Z",
      "references": [
        {
          "source_name": "Trend Micro Agenda Ransomware AUG 2022",
          "url": "https://www.trendmicro.com/en_us/research/22/h/new-golang-ransomware-agenda-customizes-attacks.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--74afa3c9-bfa3-48a3-85bf-b28e5ecd00b7",
      "subject": "ATTACK:enterprise:C0015",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--74afa3c9-bfa3-48a3-85bf-b28e5ecd00b7",
      "modified": "2026-07-31T18:47:25.436Z",
      "references": [
        {
          "source_name": "DFIR Conti Bazar Nov 2021",
          "url": "https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7995952f-370f-4514-a0c1-ce160b4c90c1",
      "subject": "ATTACK:enterprise:G0065",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7995952f-370f-4514-a0c1-ce160b4c90c1",
      "modified": "2026-07-31T20:48:38.247Z",
      "references": [
        {
          "source_name": "Accenture MUDCARP March 2019",
          "url": "https://web.archive.org/web/20210722005437/https://www.accenture.com/_acnmedia/PDF-96/Accenture-Security-MUDCARP.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7b2329e5-eacf-4626-bc3c-43331bc09aef",
      "subject": "ATTACK:enterprise:S0265",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7b2329e5-eacf-4626-bc3c-43331bc09aef",
      "modified": "2026-04-29T14:23:06.094Z",
      "references": [
        {
          "source_name": "Unit 42 Kazuar May 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7c3b845e-56ca-4580-b060-a3fa42b86a86",
      "subject": "ATTACK:enterprise:S0038",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7c3b845e-56ca-4580-b060-a3fa42b86a86",
      "modified": "2026-06-12T15:51:16.723Z",
      "references": [
        {
          "source_name": "Symantec W32.Duqu",
          "url": "https://web.archive.org/web/20111213083345/https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7d020981-51b3-4ff6-825f-7cd192c934e1",
      "subject": "ATTACK:enterprise:S0012",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7d020981-51b3-4ff6-825f-7cd192c934e1",
      "modified": "2026-04-29T14:23:06.096Z",
      "references": [
        {
          "source_name": "FireEye Poison Ivy",
          "url": "https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf"
        },
        {
          "source_name": "Symantec Darkmoon Aug 2005",
          "url": "https://www.symantec.com/security_response/writeup.jsp?docid=2005-081910-3934-99"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7fd4fe68-0f2a-485c-9b10-6847428ef5da",
      "subject": "ATTACK:enterprise:S0021",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7fd4fe68-0f2a-485c-9b10-6847428ef5da",
      "modified": "2026-04-29T14:23:06.100Z",
      "references": [
        {
          "source_name": "Airbus Derusbi 2015",
          "url": "https://web.archive.org/web/20180607084223/http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8475c5c5-484a-47b6-93ba-0cceeefc59f1",
      "subject": "ATTACK:enterprise:S1239",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8475c5c5-484a-47b6-93ba-0cceeefc59f1",
      "modified": "2026-04-29T14:23:06.106Z",
      "references": [
        {
          "source_name": "Zscaler",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--964d3a29-afcb-4c4a-89a1-c1769d02221f",
      "subject": "ATTACK:enterprise:S1229",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--964d3a29-afcb-4c4a-89a1-c1769d02221f",
      "modified": "2026-04-29T14:23:06.130Z",
      "references": [
        {
          "source_name": "Havoc Framework Documentation",
          "url": "https://havocframework.com/docs/welcome"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a275b407-099a-4f2c-954c-528cf61349f8",
      "subject": "ATTACK:enterprise:S0412",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a275b407-099a-4f2c-954c-528cf61349f8",
      "modified": "2026-04-29T14:23:06.146Z",
      "references": [
        {
          "source_name": "Talos ZxShell Oct 2014",
          "url": "https://blogs.cisco.com/security/talos/opening-zxshell"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a442fcac-55d7-49ff-8ecf-ca61885c27e2",
      "subject": "ATTACK:enterprise:G0024",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a442fcac-55d7-49ff-8ecf-ca61885c27e2",
      "modified": "2026-07-31T18:47:58.423Z",
      "references": [
        {
          "source_name": "CrowdStrike Putter Panda",
          "url": "http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a737a968-1fec-4e9b-b0dd-d4318f07a691",
      "subject": "ATTACK:enterprise:S0666",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a737a968-1fec-4e9b-b0dd-d4318f07a691",
      "modified": "2026-04-29T14:23:06.153Z",
      "references": [
        {
          "source_name": "ESET Gelsemium June 2021",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b808a8ce-9c2c-4563-b63b-4cd23dce04b8",
      "subject": "ATTACK:enterprise:G0094",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b808a8ce-9c2c-4563-b63b-4cd23dce04b8",
      "modified": "2026-07-31T20:48:25.365Z",
      "references": [
        {
          "source_name": "Aryaka Kimsuky July 2025",
          "url": "https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b97e696f-6386-4b15-8f24-81d0abe51830",
      "subject": "ATTACK:enterprise:S0135",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b97e696f-6386-4b15-8f24-81d0abe51830",
      "modified": "2026-04-29T14:23:06.178Z",
      "references": [
        {
          "source_name": "ESET Sednit Part 3",
          "url": "http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b9b2ddad-acb6-4e97-966c-ff18fd36cea3",
      "subject": "ATTACK:enterprise:S0335",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b9b2ddad-acb6-4e97-966c-ff18fd36cea3",
      "modified": "2026-04-29T14:23:06.178Z",
      "references": [
        {
          "source_name": "ESET Carbon Mar 2017",
          "url": "https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c055d228-a0e6-4b76-961a-1eebe99679f5",
      "subject": "ATTACK:enterprise:G0032",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c055d228-a0e6-4b76-961a-1eebe99679f5",
      "modified": "2026-07-31T20:48:47.138Z",
      "references": [
        {
          "source_name": "McAfee Lazarus Resurfaces Feb 2018",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"
        },
        {
          "source_name": "Lazarus APT January 2022",
          "url": "https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c31643e8-86a3-49e4-bd69-572d7e64c7c0",
      "subject": "ATTACK:enterprise:G0081",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c31643e8-86a3-49e4-bd69-572d7e64c7c0",
      "modified": "2026-07-31T18:47:57.544Z",
      "references": [
        {
          "source_name": "TrendMicro Tropic Trooper Mar 2018",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
        },
        {
          "source_name": "TrendMicro Tropic Trooper May 2020",
          "url": "https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c4e3450c-c657-43c3-b825-031b12a33611",
      "subject": "ATTACK:enterprise:S0581",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c4e3450c-c657-43c3-b825-031b12a33611",
      "modified": "2026-04-29T14:23:06.194Z",
      "references": [
        {
          "source_name": "Unit 42 IronNetInjector February 2021 ",
          "url": "https://unit42.paloaltonetworks.com/ironnetinjector/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c7d6694e-cfbf-4883-9f4c-8fb3f187e6ae",
      "subject": "ATTACK:enterprise:S0467",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c7d6694e-cfbf-4883-9f4c-8fb3f187e6ae",
      "modified": "2026-04-29T14:23:06.198Z",
      "references": [
        {
          "source_name": "Kaspersky TajMahal April 2019",
          "url": "https://securelist.com/project-tajmahal/90240/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cc2dd0db-3679-4b14-b9a1-4aff659e2c4a",
      "subject": "ATTACK:enterprise:S1026",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cc2dd0db-3679-4b14-b9a1-4aff659e2c4a",
      "modified": "2026-04-29T14:23:06.204Z",
      "references": [
        {
          "source_name": "SentinelOne Aoqin Dragon June 2022",
          "url": "https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cd79adbd-3d52-4f26-aea4-cbbbc3d6aa66",
      "subject": "ATTACK:enterprise:S0575",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cd79adbd-3d52-4f26-aea4-cbbbc3d6aa66",
      "modified": "2026-04-29T14:23:06.206Z",
      "references": [
        {
          "source_name": "Cybereason Conti Jan 2021",
          "url": "https://www.cybereason.com/blog/cybereason-vs.-conti-ransomware"
        },
        {
          "source_name": "CarbonBlack Conti July 2020",
          "url": "https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d10e82b8-7f30-4845-af05-44ac3287bf70",
      "subject": "ATTACK:enterprise:S0458",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d10e82b8-7f30-4845-af05-44ac3287bf70",
      "modified": "2026-04-29T14:23:06.211Z",
      "references": [
        {
          "source_name": "Eset Ramsay May 2020",
          "url": "https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d5ede6b1-984f-4e43-8d55-92d1efc5e8b6",
      "subject": "ATTACK:enterprise:S0022",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d5ede6b1-984f-4e43-8d55-92d1efc5e8b6",
      "modified": "2026-04-29T14:23:06.218Z",
      "references": [
        {
          "source_name": "Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023",
          "url": "https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d5f2b0fc-c865-419d-aacd-8004ecba00df",
      "subject": "ATTACK:enterprise:S0484",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d5f2b0fc-c865-419d-aacd-8004ecba00df",
      "modified": "2026-04-29T14:23:06.218Z",
      "references": [
        {
          "source_name": "ESET Carberp March 2012",
          "url": "https://www.eset.com/fileadmin/eset/US/resources/docs/white-papers/white-papers-win-32-carberp.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d7aa491f-a801-4611-ad07-5096e12c5c5f",
      "subject": "ATTACK:enterprise:S0615",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d7aa491f-a801-4611-ad07-5096e12c5c5f",
      "modified": "2026-04-29T14:23:06.220Z",
      "references": [
        {
          "source_name": "BlackBerry CostaRicto November 2020",
          "url": "https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--df5bee66-b840-405e-b9d5-2e0ced2e6808",
      "subject": "ATTACK:enterprise:S0018",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--df5bee66-b840-405e-b9d5-2e0ced2e6808",
      "modified": "2026-04-29T14:23:06.230Z",
      "references": [
        {
          "source_name": "AlienVault Sykipot 2011",
          "url": "https://www.alienvault.com/open-threat-exchange/blog/another-sykipot-sample-likely-targeting-us-federal-agencies"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e834920f-bc30-458e-b56e-80947d3a7c6e",
      "subject": "ATTACK:enterprise:S0367",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e834920f-bc30-458e-b56e-80947d3a7c6e",
      "modified": "2026-04-29T14:23:06.241Z",
      "references": [
        {
          "source_name": "Picus Emotet Dec 2018",
          "url": "https://www.picussecurity.com/blog/the-christmas-card-you-never-wanted-a-new-wave-of-emotet-is-back-to-wreak-havoc.html"
        },
        {
          "source_name": "Trend Micro Banking Malware Jan 2019",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/new-banking-malware-uses-network-sniffing-for-data-theft/"
        },
        {
          "source_name": "US-CERT Emotet Jul 2018",
          "url": "https://www.us-cert.gov/ncas/alerts/TA18-201A"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ed113911-e21a-4b1b-a082-42313d5aa887",
      "subject": "ATTACK:enterprise:S0456",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ed113911-e21a-4b1b-a082-42313d5aa887",
      "modified": "2026-04-29T14:23:06.248Z",
      "references": [
        {
          "source_name": "CheckPoint Naikon May 2020",
          "url": "https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f1091b2c-ea09-402b-9717-8b7526fb5c13",
      "subject": "ATTACK:enterprise:S0457",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f1091b2c-ea09-402b-9717-8b7526fb5c13",
      "modified": "2026-04-29T14:23:06.253Z",
      "references": [
        {
          "source_name": "TrendMicro Netwalker May 2020",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f1459bdf-06ae-435a-8506-1e8e444a410b",
      "subject": "ATTACK:enterprise:G0092",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f1459bdf-06ae-435a-8506-1e8e444a410b",
      "modified": "2026-07-31T18:48:05.940Z",
      "references": [
        {
          "source_name": "IBM TA505 April 2020",
          "url": "https://web.archive.org/web/20200420201624/https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f72d9605-eea6-4ed4-8502-231d4c21431f",
      "subject": "ATTACK:enterprise:S0081",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f72d9605-eea6-4ed4-8502-231d4c21431f",
      "modified": "2026-04-29T14:23:06.261Z",
      "references": [
        {
          "source_name": "Accenture Dragonfish Jan 2018",
          "url": "https://web.archive.org/web/20190508165226/https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf"
        },
        {
          "source_name": "Lotus Blossom Jun 2015",
          "url": "https://www.paloaltonetworks.com/resources/research/unit42-operation-lotus-blossom.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f8b6eae9-cf2b-4b16-8c44-03d989533dd6",
      "subject": "ATTACK:enterprise:M1040",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f8b6eae9-cf2b-4b16-8c44-03d989533dd6",
      "modified": "2026-04-29T14:23:06.263Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f9d9b5aa-f4d6-46fc-8831-21ca405ab8e5",
      "subject": "ATTACK:enterprise:G0102",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f9d9b5aa-f4d6-46fc-8831-21ca405ab8e5",
      "modified": "2026-07-31T20:48:50.624Z",
      "references": [
        {
          "source_name": "DHS/CISA Ransomware Targeting Healthcare October 2020",
          "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-302a"
        },
        {
          "source_name": "DFIR Ryuk 2 Hour Speed Run November 2020",
          "url": "https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fa7b6b1c-de8b-4e6b-ae62-785bc6ce3c51",
      "subject": "ATTACK:enterprise:S0596",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1055.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fa7b6b1c-de8b-4e6b-ae62-785bc6ce3c51",
      "modified": "2026-04-29T14:23:06.265Z",
      "references": [
        {
          "source_name": "Kaspersky ShadowPad Aug 2017",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    }
  ],
  "source_snapshot": {
    "file": "enterprise-attack-20.0.json",
    "url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
    "sha256": "81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352",
    "bytes": 55271014,
    "checked_at": "2026-10-16T03:31:39Z"
  },
  "notices_url": "https://aol.pm/source-notices.txt",
  "notices": "License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"
}

License
-------
The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,
development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce
MITRE's copyright designation and this license in any such copy.

"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation."

Disclaimers
-----------
MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part
of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover
full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or
variations on existing techniques not documented by ATT&CK.

ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE
ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,
AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT
THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR
FITNESS FOR A PARTICULAR PURPOSE.